Academics.pdf.exe
Windows Exe (x86-32)
Created at 2019-05-13T21:56:00
Monitored Processes
Behavior Information - Grouped by Category
Process #1: academics.pdf.exe
13037
0
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\desktop\academics.pdf.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:02:07, Reason: Analysis Target |
| Unmonitor | End Time: 00:05:22, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:15 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb0c |
| Parent PID | 0x45c (Unknown) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
B10
0x
B1C
0x
B20
0x
B58
0x
B5C
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| academics.pdf.exe | 0x00400000 | 0x004BDFFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | 895.26 KB |
MD5:
aea013d01453f97db80b01838255e414
SHA1: 5bd9da40e494bde647a96814b9948363bc97ef7b SHA256: ba2598fdd2e5c12e072fbe4c10fcdc6742bace92c0edba42ca4ca7bc195cb813 SSDeep: 24576:/RmJkcoQricOIQxiZY1iaCUTGkFMYaTzCCqhBN+:UJZoQrbTFZY1ia/xFgQT+ |
|
|
| C:\Users\5P5NRG~1\AppData\Local\Temp\autDB22.tmp | 47.73 KB |
MD5:
9dda4db9e90ff039ad5a58785b9d626d
SHA1: 507730d87b32541886ec1dd77f3459fa7bf1e973 SHA256: fc31b205d5e4f32fa0c71c8f72ee06b92a28bd8690f71ab8f94ff401af2228fe SSDeep: 768:2/Z+ueBxRGAGrpp2PYuIsxHXJfvbaECkqHm9+3rYmQD8ZE57V9xypU2Whnm5:2/Z+DQnud3hv64+bYiEn9spU2WhnO |
|
|
| C:\Users\5P5NRG~1\AppData\Local\Temp\autDB43.tmp | 49.90 KB |
MD5:
8cfa6b4acd035a2651291a2a4623b1c7
SHA1: 43571537bf2ce9f8e8089fadcbf876eaf4cf3ae9 SHA256: 6e438201a14a70980048d2377c2195608d5dc2cf915f489c0a59ac0627c98fa9 SSDeep: 1536:Q3H66Re+tn+03wA4nrsgTu2Tv+pBW6sFNghF:OHNQ+F+GwJrsgTRzcl |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.eGIW Yzvh.gif | 58.29 KB |
MD5:
4d78a75a5a01bc41cfe6394ff2f9792a
SHA1: b262fd24c120fff256d763aee275bf3e06b00f07 SHA256: dc679efbcef5e45c8d54f786d0b21ae884d8053a8ac77ffaac040b84a3319992 SSDeep: 1536:XnwbWREXpUQq3Rm4Fk5TZBpnWy+jEB6GIpZ:XnWJXSQARmO8TZThsEi |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.gJ2GDQDH7i.ots | 2.01 KB |
MD5:
a897f48a37e6f844b39f5e4999c89e52
SHA1: 1e7fc69cc6c4cfc7d803473529a6e868103f497c SHA256: c6ce83c7f073ba7dba40fd6a01f430ada429537a5bafdc4e448857e1d5e68c0e SSDeep: 48:8nuI9hFV4AZDLcxtK664Ge9MHvNo9ekLzzBOorp:S4ANR664LYEQ4p |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.md6gSAuODLhq.avi | 30.70 KB |
MD5:
b4c89feac510afbbacf65400fadce1de
SHA1: c7da34e02245f26fbd9e68f1fd8053f1f0c5647b SHA256: 01fb31401948279bef7b82369484d82d97f9034aa9af711709a3527f9255a26b SSDeep: 768:3OqEpfYalQtOP41jAgHLxdxFEgs/zjcrmI9bM:3OqE1CMAjXrxOguvcqt |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.AX5eJBJ82y3.jpg | 83.30 KB |
MD5:
5c039fb7ad20b5dd5019d0aa1124162c
SHA1: 154cbab070e35a735b221aeaef65e7804e2cedd1 SHA256: 71d4c3412167aaddc8b54ffb28f47cb3fec0ef1092216eabef7a9e818f552f6f SSDeep: 1536:/kJGbpIllegFlhhD8GmaynigAmd6GHTnOb+LiGxVlxH8W4ke2FCI:sJG2llegFtGauiUTOb+LiGTjHMkew |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.CoWnh3Q5rTDnpXdJ.mp3 | 5.83 KB |
MD5:
603adfa1ba5b1a1ca3bb14949d0d4c7f
SHA1: ffe116b334fa6415aaeece8b7a333ff9f96fe733 SHA256: 26bf266c221241a84f5e11965032ed187be158f405cc0b12a1d2e1c2c1682a45 SSDeep: 96:ZwzbAfRake1WBytIL/Y96nKJ6nUJqixf4eQrfhnW3YqsjVcqoSpjFP1mLILm4dfC:WzMeIBI1AnUE24VmYzpoSpj5ES7f9p6 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.JLaCurEw.pdf | 6.59 KB |
MD5:
8c1edf9dea9b7f5b35b553299126dcf8
SHA1: 957c5458e02ccf7380621b5704428b85eabc707d SHA256: 277c426f26a0a895994364d21dbd01d064a0279234925529b21d879594e6a0c3 SSDeep: 192:Tf1ErrbEfUrxfBTw+Sc79IQmaccTvW3VY0YMbOd:6zEk8X+5BcpFY6yd |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.desktop.ini | 512 bytes |
MD5:
3e5d2582a5d0c915afef6c8cafa343d1
SHA1: 7062928a2ec000838f78dce8c48693a1859471e1 SHA256: 34ae08d15c34e017facda7c39f7b5f9e8cc891b160072b908969a1a2523772aa SSDeep: 12:x/YcZ74iPoQKG9CHlw5Ok9LIDNV86xqSx95b+1ywId21p4sE0e11:xwA71FCdk9LIU4x3b4bId2Y4er |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.xBQp6dTr52cBE6l-Un.m4a | 5.74 KB |
MD5:
f4bcd9a849e415e7bc44033fbda83b01
SHA1: 787e68742e7f5c0f1e0b4a84cf8017118acd9fb7 SHA256: 619e98da164c31e6855541e609367c84fc3bcaa84061fc5462b9012ada2c763d SSDeep: 96:Hx6970iIkTW4Xhv4KzVyb6xeFMi7dslgwgJvQyyO3mSgSzh5i7OZ3cHb:Hxy0KTfJVybBFMi5Uv3roFzrilb |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.70BY_GgaY1.bmp | 19.01 KB |
MD5:
56de9f9b765e032e2cedf42c043add1d
SHA1: f2862dacd19d746020252163e444db9f0e4eb300 SHA256: bec0497dbd0d07e8528b5d38f0dfa46acfb61295373c0d18a57cbe165d2ad4c9 SSDeep: 384:gFDc+pfFkE7pWKCLiJ78cf+MdlN1Rx1sYH/sHHQhLIL4OrWRB7TMDOcVb:wg6aEEKDZh0YfsqE1rW/yVb |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.krvo L5sveZ W.png | 37.19 KB |
MD5:
c65b331b171cef966354fde5e849c695
SHA1: 4f190274588d2108a6b3badcecf1c86ba705f6ad SHA256: 82fe1fbf4895679f4ef1e69c7de3f768a95fa20b42811d132e69d6df46bed96b SSDeep: 768:Uzdthadn4ZvX1LFmaBFun1gL1C6B/begC4ViUyaWoBBZ9uF1:AdD+n4Zvlx5BFzrjeZ4lsW81 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.4Qauyoz6.avi | 41.67 KB |
MD5:
18f61e63cc7f0376f67cca1bc1e1152f
SHA1: 3ef07fb6a23663c449e84f6bbd3bf8141005e0a3 SHA256: f1a05bb599c264a95e696dea6274612fd6c190667952b1be0a65141042ac6bbd SSDeep: 768:06NKIHnyDVq0trvgKgJ1xe3Yr+h+F9MWgPsOCxJXacZk3ELS6auFqLqFM8/:06HHoVq07gxMsiWLlLZ+EVaBz8/ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/Microsoft Update.lnk | 964 bytes |
MD5:
f9e553b8c2213c64dd754ebbdafd16de
SHA1: 2445dcf86debc53fd452f7af3a952e0e92ae1c6d SHA256: 756c2abbbdfd65a4d10c788e0e5d216d216d8ec9581aa5408406c0899a57078e SSDeep: 12:8wl0SY5/KRF67GyuR+/fGyqQ1PQ1SCc4t2YaGBMWWdOINR:8Xy0qRQRbikDQTkOIN |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.gXTZQTDkC2czFZpWnC.gif | 23.36 KB |
MD5:
653ca531eb4569c1de9b3b2c12ff87ef
SHA1: e6b4d210284030aef9a4b3f7cdb7c5c8b9d893a7 SHA256: 872b492bf89bc4766983995a9bc4daf07cd2dd1be1c857b569862a11b91b36e1 SSDeep: 384:RZl1pBhUH+1LjcZMYNBbwqqoDU77uvcS60j51FDjKSh26fVt+qDCgS8n/UGZZLo0:RzXR1LolBUqi7uUSfV7jKSg6VlCgS8n9 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.SFHBP1D1LBQEeR.wav | 77.02 KB |
MD5:
2fcb23f5e442b8b32ba697e9b9112d2b
SHA1: 090170c8c771e66e5471aa1a2df68a78159a0530 SHA256: caf6ec5b01314a88a802e45326894faca8311fda2f6e691b9e594dd9f9eb5a82 SSDeep: 1536:/KpAubRZrQkn+T/csiMVClqWw+hbkJChG1HI0bccwCANwtqsqfMthLz4y3JBsFd:/ebHjM/AZzhKNccwChtqBEthLzSd |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.dunBms1jB_.jpg | 28.77 KB |
MD5:
007deb81fa0a924ee18c0a6806b67636
SHA1: 0602c5267b0e490d5294552073313aa9b6cf849d SHA256: 620f3627dda4bf0093bbc7273abdcbeb97bb53b4892de57a960aaf17781322cd SSDeep: 768:xfglUvpkXbVrSxewbEfThzWY4lUKmqFbZneU6M:faXbcwfx9yUAlZnVt |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.LVDYQUpAZwEha.mp3 | 40.67 KB |
MD5:
4525d2707e5eb3890b17b1789529b0c1
SHA1: c449f742cf88f1c56318b27d394b1be74771c6fa SHA256: d377749f6a475e69d68ae247999dfad4f6213bb7b835be023f4ff03407ce16c4 SSDeep: 768:NvmNDEni5pfpboK2du3fd8/lUCJuUhJK38tSgxNmiCs3/L6xIs:RBKpRboK2u3DUt08+1 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.afvn6kbS8JsNZy6W_IRM.mp4 | 50.12 KB |
MD5:
ae1b351bcc0464df06534248f11e27ea
SHA1: 57b03c04fcac486d4415df88c3ba2473621e9ae1 SHA256: cbbb2fb8e198d10db11a52c55edb2e3e2141a21969aa8305591be9d891aa5dc6 SSDeep: 1536:WgPzdR+6URwTXTT67bRf0cOVXA0OyaK545TuvUdF:Fv+RRWXTT67bRf0jq0Oyb54HdF |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.MkMwkg_ip2 n-V.docx | 80.73 KB |
MD5:
c2c9c30464703992617a0a737fd38e36
SHA1: efe968401d7ca1b9df8602b37b45b127539c6dcf SHA256: b166b0fcec6516833ee052835c0c5f406a3036028ad20fae21044edb29392bba SSDeep: 1536:G+5mi9AXvtvE14liEJOtdhw1uf97fsMKI1y51XVfmHkW0EQS/3zLoLMc32ixty9I:GEpytCEGdhw47fBA51kHsE/zLoP3ojE |
|
|
| C:\Users\5P5NRG~1\AppData\Local\Temp\autDAA5.tmp | 2.03 KB |
MD5:
6f38eaf07f4ab961211a2447cc157e56
SHA1: 69be308500f3dda7632ad9a71e3c1525cd90e75b SHA256: 451734cd68c81ce6a0bdf9fdf322222e318b2d105cd48c504e396bfe5f9e493b SSDeep: 48:1bEa9SJqdcf77EI79L+ssBswGq8mO9SHx3BcRUbmiRHvtG:1lSjfHFxL+ssBB1DHnc1GHvtG |
|
|
| C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | 10.62 KB |
MD5:
f130ad9aeab3e84b0177695e746d90a6
SHA1: 6853d01330cc65b91f71a915f0648d6dfc32662f SHA256: e5e4042299976512cd62ece8ea1c16c0a9c0f6580a7d7e3087f22fa6c5212775 SSDeep: 192:Ap2JUzcqH0lrA4cE39Zxhg7AdaE39Zxhxvs98U8adcUc6r+++E+LtLUq:Ap2JUcqH0lrA433F67Adt3FLs98U8D |
|
|
| C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | 280 bytes |
MD5:
8be57121a3ecae9c90cce4adf00f2454
SHA1: aca585c1b6409bc2475f011a436b319e42b356d8 SHA256: 35d7204f9582b63b47942a4df9a55b8825b6d0af295b641f6257c39f7dda5f5e SSDeep: 6:8o59eU27JRQNiPGeFeWMkfKn3Jkf+H1jhRiIgLe66HrA:8Uk7lPGcz6Zkf+VjhR1b/LA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.6qT95vcU.docx | 55.11 KB |
MD5:
e449830c3f4fb2493a52091d4347b92a
SHA1: e3fab5acf12d4c63fa07910462e18281c6ee0879 SHA256: f5464507c9460e54461b9f5615f099942ee70e4839229e403f1a9eb6d9c31efd SSDeep: 1536:05WPC8dae2BQFqNSHJiU5Nvzt8N+uCvY/w89RIrW:0+ab66W1NrtUtn/26 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.81-stuKA.mp4 | 54.84 KB |
MD5:
5d716df7533c31a966a0c9b29bd622a5
SHA1: 1730a771562caea0acb887589c9be6f882113c43 SHA256: 32f8d38bebb2fa9190183eee49214cabd359054f9b9d9321e459b453671e4b53 SSDeep: 1536:+GlbL4N8VGNxPDMVYcXuCiA7ZTYeTlLpgd+41t5C:XmmBNuCiA7ZTTTlvQG |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.Academics.pdf.exe | 895.27 KB |
MD5:
e78022bc428d53798f64eac9867de1b4
SHA1: c10ce358a85937888879fe4438d11826699677c8 SHA256: cb7c0fbe127c1efc94f6dc5b0622e7760d4edbf72ffa507a4ce0ee1ea0409a54 SSDeep: 24576:0z5L21MMtgXwaBeZE67s2jJnoddBbSCh+A326SZZ:3McU3mE6Q2NnorpvGrZZ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.bY-NIrDXo_nG.bmp | 49.72 KB |
MD5:
8f3f3040f1a45b3b80336f60d9bf8d7b
SHA1: 2dd75d7134056796a9b84dff77bcafa10145f837 SHA256: a3dbcac931745be63a7d1b9ef6a798f4ecbc7c45d2e213ba190b44e2a05f6608 SSDeep: 768:db8g/C5HhVJq8HAFMg7EwIXm0Z2js0klCt5YYKNABz91jwdPD9WLnR:dQZVJHH2Mg76202GCt+B2h1jM9W7R |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.desktop.ini | 288 bytes |
MD5:
ba41cfaa9aff58c3b40c7ac73b4d1cd4
SHA1: 691f19d9330522a47b16c832c6d6b51a3a2efc72 SHA256: 30fb6cb48d4689a02731dedf82483a58738ba4131e4be90b2a44bd1ab9fd6a0a SSDeep: 6:x/unJ6ZESn4iPU+HID8/KOv9C1pO+Q6M/N7P0lXXoU+IHn:x/YcZ74iPoQKG9CDO+eF7P0lXXoFyn |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.DrmlVcs.bmp | 86.42 KB |
MD5:
e96c7cb9d89872595cd9346e81b498dd
SHA1: 385431af4ee4b0cb6ec217fd4512e98847dcf603 SHA256: 5b620939b54e5f25ec0311ef8751a44a285cef8f37d4e997cc73b7160a77df79 SSDeep: 1536:qlLxGRGTs1BHb1feWbDA10RZBdleguRHVB1OpVQOq3rSilV:qrGj1BgWbE10RlleguR1GpVcSilV |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.FN4XiavIO4PR.bmp | 8.18 KB |
MD5:
bf5b0607f6f63072a9b75edf906d5a7e
SHA1: b8518215c83bac4add59622ea0ec012a26a4d450 SHA256: cfa4cc19bfbb9ac62f6d881eb5a5221c0a516903763f3638f827e9f6ed3fc64e SSDeep: 192:0j/SJuAufOUIDnIqdc3fSHR3SUezQMaw/z7Wh1qM00mGD4Ht:7JS2DDnIqG3fOR3Sbzd/zs1at |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.GhiVvZ14WbSoIVTo6M.odt | 49.23 KB |
MD5:
c8a5212f06c73daf8ea6d80345b23583
SHA1: 8888ff839e22ac6f6d6a8364f5e0f25049bc2bc9 SHA256: a3a124ac51d552b9939c866a2f4d73b7141d0a5d192f3462f4c4d10c6b382deb SSDeep: 1536:agXG0MfwUz5iFtwgDJx5oczRChHg6Gnex+d:DhUahdxOsg6neq |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.GyHm6iovQDw.m4a | 77.66 KB |
MD5:
3d924d7382eee836855bebd00e9569f6
SHA1: 9d3f6cb3df5a0db1ce55ca19c34f510cd90f2649 SHA256: 354436705511ed5df61cdac2ad6d7459d87b2785ff990536560565302802eeaf SSDeep: 1536:KD9+JEFfNtQJ81H+s1vOnH+jGdFMA/75dWR+zf+slywRRcALDGAGj:wsJEXtQAMnHVd/75dWRI3YQBO |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.lorGIZR7_Ai6fNrX6f.xlsx | 22.19 KB |
MD5:
1f1b571037d61119ba68ef751a306420
SHA1: 6285a0abb6f1f728fc955ff3d72706e0186b6342 SHA256: 670415a253aefc115a991989cc4e2391e8b2bcbe723bfa036de16d0f5570894b SSDeep: 384:7EOz4KYtddBiB8rI1IFwIMJbD0awgLETqN+aZDBvhBkdmOJku07GkG6jhdyThAhQ:7EOzKtddBzrDFw9J871aZDBsmSkh7Gkw |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.nJNF.png | 13.87 KB |
MD5:
dd0407d00b11fa2e2dcd481405a80c58
SHA1: b0772ead73d41660c31594cc36dcbbd6f3a0879b SHA256: 0003e5e323e52cfeb5ac3ca2c18c278f6161e318b781418f277a69d0cad43857 SSDeep: 192:sqKZ5vDV9SMEgtDntRUJjNY6oNVzKqf7rPnSZFdNvMREXICgd6vtdY4GKmS7Wge:AZ5LN14J6/rzKq3PnS7vvPGYmCWB |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.OPOBoXaM2P4A0m.m4a | 36.28 KB |
MD5:
6bde1461c7a7ecb2b990040723ad8564
SHA1: a0cf9f458ab713475a6d867aca3f00b806f5fe66 SHA256: bac5de182302347df57bf8924dd3c23d7ec6bbf93b7e4145f11e6987977ff6e0 SSDeep: 768:GATOw8RuqvW9qkESrpplI6QcH/ykgBWd39Q:GAThquQS7WpsqkE |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.QHREQz7Xz.jpg | 43.30 KB |
MD5:
f35cfab6857f5902154b3811672844be
SHA1: 2ae58d644e7da0e2bdc80f2588450ee36f4f9014 SHA256: b539016007059d7cd7d9617a30dc1584acf795128e6cb7c46f5829c59a5b0edd SSDeep: 768:ABMQF1worxO+S3r3o2Bmlg1TxxmWenOzgevTmJEqArBNBBN0d/0FltiG4gI+7rcC:ABZF1w+Hk3f1yWeniJ+/0D0MI+7Mij/t |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.QzBYTrrsKyNkrz7Qz2.swf | 94.18 KB |
MD5:
f74b45e2b26fbb52e3d05c33ce98aa31
SHA1: 44f04d4e468cc6c7545900dc3888bb6197b09d03 SHA256: c625284c211f8fcd10e8d718678d0c930636bd39b23507c5db9377d75450b361 SSDeep: 1536:HJPCkZ4NMh2zAU8HIR67vIchpCyMu0cfFPCM6fhSodm3zcG9gMooR5TRRG2To:HJPCsMM8zDwIR2vIchpR6c4M6ZSodSox |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.srS5tTxQY.mp3 | 39.80 KB |
MD5:
104193178b380ef3d91d3bd152d31277
SHA1: dd422f0349a4b996a1b263e39c8a58ee08988692 SHA256: fd9af6f954fd4decf5fd35c106e831593a2235c285dad07346abdd65d958bb1d SSDeep: 768:2ET1t8ct9rOVF+nvf84JUH4Iq8zKGcAYwco1B9q6hWXx5nXuzPewb91Fe/u:p1tPzeCvx5lmYwccXq6hWzezPewbIu |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.UCS72GVnNBUxEzx.mkv | 15.09 KB |
MD5:
e56f984baea4c01391e47b838e6d7465
SHA1: 3227b0c8f5738345cf5e0c420b1be94ce3c0b36a SHA256: 6f32679e97046d5d01c0dc5bd9ad3166f044e60960f893561c297bcecd22ab07 SSDeep: 384:xXfZNf/CRX+iCPP6BEBS5RnXdkUIV9y0ar8lFVA2:xBNf/CohPP6BFZyP+WB7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.wI0b0QZdP-KcsT.avi | 52.67 KB |
MD5:
910dc47d200c24616d02241d080cea95
SHA1: eabf99d29b0bd3d17f6d0aea49a658a805b78e2d SHA256: a001a6ac7840bc58b74bd916ebd5150dc6ac1146ca5cc6fb0af37cf598d53838 SSDeep: 768:E6pBIc87DgUb40Lw80DzYUemr8JBaWNtuNBE54DWAAP1ue96ukuK25697:3p1ub46kzYUHr8JBaIEBEWKzChuK997 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.yvFiHqzM6fmTt.flv | 47.68 KB |
MD5:
19d0f4506489a0b1f01b6c2f5d233765
SHA1: 18f0d05c9f551edaf27d0e34135ba54523b6743b SHA256: 188d6331df10e2047acf0c56ea345d0de73806af5e18c3aeec3898868209b781 SSDeep: 768:cOlePCRtt09TneL9KRtblMefP0DZOG5WRCFhimKmom97MkEtGA5AF0jfouDSe:Vldtt09T69Gtbtn0DZOEOmP2GAaWouN |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.5fNAF_eBT37aF.bmp | 53.99 KB |
MD5:
7e9e0873573ebffccc809a4a36673479
SHA1: 3886052711b70ed6b1bb50c769ab5dae64b2c810 SHA256: 1fde3e4b87bce64391df6c6a467147d317656bfd997b32634ecf192ee392d98a SSDeep: 1536:wQkYH1rKexKSF20ZZEom4zoo5M+WYMa/Cc//383IO:Rk0Rw07lm0oq5//s3j |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.7sqV8uLS.bmp | 21.30 KB |
MD5:
4c941275bb02869680d908ff0d5801e3
SHA1: 10b7b536f95f1e90ae4664a85bf8165c19d5b956 SHA256: 0a966186704212a33d48c10630570493e496cea1240a0c30b92ecee549bda86a SSDeep: 384:FOQrRS4WKq3EmITIxh79BdUOP9ozEh7+whgd8m7Z8Hp+yu3pgA:RS4WKEE3shPdZ3l+wS8m74+pgA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.bXPQ0g368kO FpGH2kMH.gif | 74.46 KB |
MD5:
92218c149763373aef392becc9e9087b
SHA1: eae570aaa1989ce5d0e6af80f2085ccd760c9591 SHA256: 72836af14de76a1b421e7506568884a139480549421f88b3500d99200dedc55d SSDeep: 1536:xoqZoEKWQUxeCw79vbJ2hOHC7etrwhDpSI1n9WmJga+y9aOm8ps:SeVeV+UWAeSokmJga+gNFs |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.co6M9Umeg.jpg | 34.66 KB |
MD5:
05e6c15bae56f7dbc72b9d7d66fab866
SHA1: b1427be258c74ed184e0b6d5a9ff36d02ff75d04 SHA256: 3016a81b8491c79a9dcd6b857736773bfb2208b1d613ba3f70760b94fc7cbdfd SSDeep: 768:0lfpGZDCRifUzi7Nq2LLs73xk8tVXLsH+Fd+CY5r+XYgI:/s6gVL8CYF+IgI |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.e-h1xk7cgYR.swf | 29.91 KB |
MD5:
6682e6dab35521f600bdd5ee078e6880
SHA1: 0810425c587fa1023962efc64735e2bf45dd146c SHA256: 633b04132c01e757c9e60d223033cf639d2333093ec5fabd4a94e2f768af49f5 SSDeep: 768:hNxwhkWrzV/Cwyt4EqwnesrYwjFVjdrG88mhu3DW:hNxw5ueDpwjZ7hMW |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.enrHxcENdtYHa.rtf | 4.98 KB |
MD5:
ea2dcd6f124e341bde50559117423d1c
SHA1: d6d345237fb97a696ea3169416aa07cc85a5da60 SHA256: a82621ac015cc7b284b7c1b2b09febe23fe4c68263a1c720d279c1a9b027771f SSDeep: 96:fZfU82S4qtuG7tJa7jR8Is/v6/Rp6spT5JP54nvhR2Xbt7HSATD9lmMg:fZKqt3Ja7la/v6ZpNJoJwbFyA33mX |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.fieUnO JbD.odp | 96.72 KB |
MD5:
0b22f5349ae123736f01bca8ee9af3e8
SHA1: bab6d2302d633a1acc2e351d15548a7075e5dd6a SHA256: 588ed6d880027819b67720785d336ffa7f0b513926bdfae53ff27a5f5285710e SSDeep: 1536:L6ZVbCZW18PAbpXVvauZKWlKp/4afCKKhp9QBwsrsBoqxuPE+lNWsD1rjL5tQdn:eZdojPylBqhfCKKp9QgBu9NWstjLGn |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.f_H3Kw_rw4T-WXKpM.m4a | 77.16 KB |
MD5:
ce446d9c22bdc080d33ab7636203395a
SHA1: ce08aafe5a92ea711db0ad6a77cf8293bc2954d2 SHA256: 6d5d2d932f57e060f8cc489f778ba7f452b3b6f132023548638d8040992fc442 SSDeep: 1536:M98nNKJjAZ08yU+79aO/xn4b16Om+L83QF07Kx6DXkRrmBK2Q+nWl1D3:MSNKhp79aOZQ16OpLOQFM9DURrOzWl17 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.gFulebPw7UZ.flv | 73.68 KB |
MD5:
a2f7d6799c0a263563ec4a3818a0e881
SHA1: 24c6989d3065df1ceea53c11695909e2acd872bc SHA256: 0ca30717664248be5af3df00a7b2814012931d5750398d2aec5809a21f7b5b71 SSDeep: 1536:fRLY5OGMZhaSOmOpsgZepH4xv4pCGveAOTDkVfUYqRfo+vVJOh:fRsZqSTeV4p4dG9UUYqRftVJe |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.GHNzGfsXtZO 6LRI5J.png | 48.67 KB |
MD5:
5902bbf7c02c7a6e18665ca85b33bf60
SHA1: 20f4db91f75caf32aaf386d59157c264c96468ae SHA256: bf76adfc18a49073120b7b9963afb45ebd4ea93574dad8ce478bd7fe587bc01d SSDeep: 768:l6S98iVYSgnNLJnI9eg4WYFKjbtj/ogoJhIR7ecV0u524Clek/ishNmJSgLfFnnf:UQJVAtikqFgJuR7ecVrVkek/iAgHFf |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.Go gw9icCK1.m4a | 68.87 KB |
MD5:
f89ee4891367ce35698ae2829e567c38
SHA1: 7c2e0597a302b941d098987da7d7bf31135e1d70 SHA256: 589df550b650924e787c51b54a5d3166fec84e57098eca708ebef76f142a3fb2 SSDeep: 1536:t9BAzrwWX1Yh6Le36fbYqXR2wUUPJXV0pkwHVf:4wsSh6KqfbYqXR2wapR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.Ie7x9Fbl.m4a | 90.20 KB |
MD5:
1f64b872fbdf13e49a363d09d0eeacf0
SHA1: 4e98e309c35150972edf64231678ad6fd8520c51 SHA256: b904f885b1fc60e895812b60db172768028cd310c7156d0fed46b733f8e0347e SSDeep: 1536:96qzo2hwOx3rmL/Pwd4J14Dqjq+wUeENAmWEb794YRDe6Vzmp/jh:9ZJ/3rmbodk1wqw+pWElE6Vy1jh |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.jfoRUvp.mkv | 14.23 KB |
MD5:
a63dbb135c3ef486ea195e8323d245a0
SHA1: e6600339a112ce59997826cb52079bd782c7327d SHA256: fef763759f298dc348a6563acbf6d1d169968d7f266462c9b9aa596a62fe92a2 SSDeep: 384:cSff5ikCrFrfKkJaNni48HNlN1tNUtt8PPie:vffEkEcaHN3Ctt8PPie |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.jOF28qdC.m4a | 76.42 KB |
MD5:
cc6eccd61f3ea19e96b571978bc75073
SHA1: b0767db7ccba43bbcdd947ebe6f601dffa6723f4 SHA256: 5a95b45eedba2a62c1cab02488dec161e4e3bc39010806a0a441762c108be3af SSDeep: 1536:7FlwhbVFvMIIGtede7e8LXcYj4RcNLD8RZfPxj3RjqL4tACPkVQNj:chbVDIosl8zlM6LD8RZxj3RRtAGcK |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.k3zAUT-8EHVGD9wmf.mp3 | 67.44 KB |
MD5:
843e0644f63d208999efded147118802
SHA1: b26f94dfc368596a4097ad67f084a60add872fbd SHA256: 8dcc5aba83b33ed4e87ca018fcd35e3802d41516284e11c0a4dcf332da8c4cb6 SSDeep: 1536:XJI8YQgfdlkcLbA5RdU++bK4JvyOdJbpvCV:XAbfdrbaR+0SjCV |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.ngBTzibcz-Ml b.gif | 45.48 KB |
MD5:
746c46b99e83e2761ee24f218457f114
SHA1: 754e3d5742fc357ab6255a702562c66aeddacbe4 SHA256: 523a671a3b6a967b6a4e681b4e13bbba542eee976649916f6b37198549c140db SSDeep: 768:kzSXhp0T4jn47Gw0R3RO5V6D0uQlmJ1zzf2J1bdZno0hApOZdVG1AJe7EOAH+k0N:k9Y4ihRhOfA1Ql85f2bdZnZApyGOJe7F |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.qN0j1jGF7bK.jpg | 93.04 KB |
MD5:
710fca135e01951cd58476a2a00df13b
SHA1: 0236646a2a7c032cc5603aec6a67ed679572a1bd SHA256: 23613c58286e9c58326309f07230c7b3ef04015e8efe67399ccd81fe7059542d SSDeep: 1536:tZgX9Yi8k0/QluKUWUnAw79l4WKPdUn6Otss8H27OBR7cR/PYl9SF+n/G8loiJJ9:jG9YU6QluEWTAVU6O+O7t/gQ+n/G8la4 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.qtQYu5s9c3vFJHOzQ.csv | 31.52 KB |
MD5:
88046a96eedc75fb249fd4bda3f56aa0
SHA1: 7c42d052cdd1acc94596865e4b61d4cf0cffcc1e SHA256: 1e123cdba90b1424b2de88e94713763ee67fcf071405a602318aa49184f0b130 SSDeep: 768:098enMPlcrmaEKHFwxyTJZhGkVFEFkBwY9S:CnMPCrfWylZbVFEFkwt |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.uKUOp3ady.png | 95.29 KB |
MD5:
566b67760f30c1a92226ba37861907a5
SHA1: d69501b6865d8294568655c833176a712842f3bf SHA256: 8ef41921fd4f20aef606322bf56808bf338168a0d5f94367798398160a4a972e SSDeep: 1536:/Acp9meaLq1k2i+IUIF+ImqUNr7Sq9q12Lj/TunDwe4f0wDchNMV5nVIPL3p6GD:oK9m76FYVKT1jrunDwPlcAzVSL5ND |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.USOrj0U79kg56B_MZLC3.gif | 72.63 KB |
MD5:
6f4d4eb71d77ef42aa44dfbca6998937
SHA1: e179a3f57adf159ddcb82bc52ca1e757503c6725 SHA256: de68f76d11c2439896db0fabb7f01223cfc0953ac105f84f0c797dcad6af020e SSDeep: 1536:J0aQRRZfNDbaCj71E4aPnlf1k0pca7HF2NFnxE6IjM+TT9J27bc2xsRi:J0FJjXaPnlf1k0pcaobnYT9J27b1KRi |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.yI2BOQ.jpg | 66.49 KB |
MD5:
6eff0bad4f5c45fa8b32548aee4a5b5d
SHA1: 845e51eff380eec455e376345f8e82be8c7f03f2 SHA256: 3e213096801d7d864cde449079f3382ed53722bf346f9d604a7d1bb7a46437ad SSDeep: 1536:o0cDOTeaQcjH7KmAw/iYxvJNL/nMchzKHm:olOfbjrRFJNblUm |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.ynNikGKB3oJVJW2VhiLE.ots | 60.07 KB |
MD5:
5029bb173615fc81665799c5562d316e
SHA1: 5e35cdb7d79aabe6e262382f3c7b0657a3f1316e SHA256: 716c443509d28a94ca99325227d31e55d924e1a32a30f73bde48e68162b26166 SSDeep: 1536:xlSqBh/rzpynvOfR9g5uA0TUIsJWoOBoDRUqkab:xwqBFpyvOfRW5u5TUI+WsUPab |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock._J3DS1U3FLV.mp3 | 9.04 KB |
MD5:
e34f5861dfeecce2b14dee3a8ed7582b
SHA1: 81b88d8f661f5805a9e3bdfe37b5acfa41252d30 SHA256: 5f346082311fbf452448940633b929cb98ca4616109b7f517ab61276b1c814d5 SSDeep: 192:WXRoMa+I91mNB7fvW/rYIKDONgVWfcXSOF/Zhbp4yz9FsIg3sKAWKooEEbb1:WXyMm+f+DYIyVMwVx79Q3kWn2b1 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.GDIPFONTCACHEV1.DAT | 106.28 KB |
MD5:
4cd01ffd82c8d492a55d99cc726a47a5
SHA1: 2f13079f18cca841dd4f1aee09a97085d4e88b95 SHA256: 5228369478d6369e11d3e97bc9127b465213fcc172c911412b8b59dfef5ca84f SSDeep: 3072:0zgt+4BO4UPQcymM+sh6fY3OnrC9Lzs3tc:xtxBOdQcyH+sMs0EHsu |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.IconCache.db | 1.15 MB |
MD5:
e56f7cb23d4ca1baa810bc9fedd65be1
SHA1: 26915bad140901c62719f58bb4e1099de7ce275e SHA256: b36d558770eb62286be0af783296855d629c54642974a6515041b45b43bb179c SSDeep: 24576:17WzmyVJhcmGrMu3W6+4Nt/MGrklBixOtDsMKWOb42GqGRD:1KzmyVnVjGTMG6zsMKdZGfD |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.HwKg28SMvdgN7pz7S.wav | 15.96 KB |
MD5:
b3afe68fce1c6ae887c667f46ac816b5
SHA1: 78c493b55421f03f8803e79e0de016c538a09767 SHA256: 8346b8e6b9451810283fc8875cc0508cab431ae585c6c62d568e8ae1e0002a5f SSDeep: 384:mJG8aOtPMvWnhvNJNyniGqzNWVb8vZLRgdjj9RM8ZtcO5j:mJGhOBMIKiRw/P9RMK5j |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.qjSu2Nf.wav | 43.98 KB |
MD5:
3df3465089f4029c81c9370ac155e6b8
SHA1: a0492a94a41819efe5e05a8da1ce5f79475de441 SHA256: 294e9a26451e85bb058f0420ca6564e480d0055548f558c79a1aa38c13367cb6 SSDeep: 768:6xXdyVP6Mw8XJnVYT9s2iV5PtbVFkYL4Q/4SPkHYyQjTfY6leLiVZ9F4:6xXdy9pqqnvkHI4Sh9fleL8C |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.Rk60-o366.m4a | 82.38 KB |
MD5:
f072ed16d8060e1949d6944aeee2df4b
SHA1: e24afcc8c578e72ec9a2b38f1c6798c53be4b769 SHA256: 7ad85051f21d865fa3bea1bb3c5a1a96a042e9b1dcd8d212fabdb820c2f739d5 SSDeep: 1536:VD68MhSqztCqpNsOsFQOZPv5Vz89ZhvQA+OX11OH3te3xKgyIqld5DV8oTae0k9J:haEq5CYNhsFQcv5t89ZhvQAleH3KCd5d |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.SI3T x_6.mp3 | 49.70 KB |
MD5:
a8112b022356ea25ba21d8d2aaf6d10f
SHA1: c5a70e4c00b2abdb85f927ce756fd62b5813a7c7 SHA256: 903df8211a403f9346b71ff43357f73b2faddacfb51c7ea413932b7d453a894c SSDeep: 768:DTayOUbCcrHLzCkKEHzlq8Uvey4MHeMhI4yXhy5fSdyEewyX5cSTHY6lyxqvuq7P:DbhHPDHRUoMNhI4qhvdlsDTHY91qL |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.T3QpSK22qbSdU8p8YAX.m4a | 58.18 KB |
MD5:
8fa4d6e32e81a8abd879f6f6723e7d5f
SHA1: 972fb03eb1c36e13b9248699918b91851c1fb812 SHA256: 0d8aeac2cf009adf8d348e6020ad208602cd47656c5754c568b4835011565bf4 SSDeep: 1536:YhqUHMx79FyG78vLDGtJlCRFSqD3JSWEWOJ9212Zb2lr:YhqU87PyGgvXGtfMQaJBiJgKb25 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.XeP-i8.m4a | 9.62 KB |
MD5:
53834d12dad8caabb3f2bb67b17b32a0
SHA1: b0cc6aad98cf6e0a163793aaa32744672d80f705 SHA256: 7a516c8a64bb54607777633c1a255a1b7022c384a38fd39e36a5f32f5ba1aa94 SSDeep: 192:AhWV6aUSklqHHz8czQy/JjL32o6aDR87bmQndjPh1jFrpePrkC:qWYjl8z8QjL32oDK9vzQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.-6 V-28Zs1i2mga0e.png | 61.16 KB |
MD5:
4eb409526642879f2e3581223ade9f32
SHA1: 25336f711a355a8454cf3b072ca1718f00629c71 SHA256: 042fcc7d0c3c9f3b7d106256a4387bb82ff9d81380cb29e1e7154ba1c8c568e7 SSDeep: 1536:GLjEJ2M+cAEnzgOaCfirniME9GDgJf4OzmFH4YWDa4Pf+:GL22M+cAkzgOaCfcv7gfNtPZO |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.FSvM9zg.png | 29.77 KB |
MD5:
7112d6b881f712e4e1a36aa10c75b38e
SHA1: c0b3b7051fc280fbed7ff08837d5e4e84b5fb8d9 SHA256: a9dbdd9139db30315cc5e7f957acf91e10d53332e7253d5a4f28a13e84dda251 SSDeep: 768:BVYp7eGyfkQO2P1tJlWmfrLfWbWr7P6WWhZY0as:XXZfkR2dsm/hPa |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.FWAReLHUsSkJL.bmp | 46.70 KB |
MD5:
620cd411d78249f54611469a51574658
SHA1: 23e64acc0f19064b534090e83409393691fffc06 SHA256: 2cb7cf23e195a71fc9a40fc4d90d8e0e2a847842c58affb49fe352f09e42d7a6 SSDeep: 768:l0jbvO34N+4Ue2nzawmHDWnkG1Rir61oroxyAgFg0qv5LUtliPLX16Xq7j6XbHLH:yvoU+4Ue2nzmqnkkRir6oroygntklmXi |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.JP0X848xky.gif | 26.34 KB |
MD5:
444d2bfa2aa53cbd881d68457dae3cb9
SHA1: cb40f179b3c5dcf79a291d4e29f0e1ddbeb3f540 SHA256: fe43b85e88e62dc51f5312e4c9ef6d3a376d9937e03eeeca106eb56433d5d5f5 SSDeep: 768:TsoNcEsMfFkEANt/IhHJf7WHV24Y0O8/poWTN7e1s0KN:jwMfF+Nt8FY2z0ZRoWTV9N |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.QrlF.gif | 96.87 KB |
MD5:
9f026ac832a33f15c699c7cf9715fd83
SHA1: a750b734a097477295350986d330d6550ce486a5 SHA256: b2308078ab9dfdb129a4dc16936b53c13545b63d613f66cbba6eb25eec817b81 SSDeep: 3072:voYSbQhWiGsv1CarYxC45z5oopuJ3y9N7Ik:wYSyWzcCac/5zVpuJWN7B |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.Ur-fU4s.jpg | 57.49 KB |
MD5:
ebd8c3b872891732d15e04367ea19681
SHA1: e566e53c80e0f586c6395e7cdad8e06a9aa40080 SHA256: 191df1182954b89f55f21018e7b53d43d378a37cea7662488b1197d061290b55 SSDeep: 1536:5udYqGJ34SNQRl19dpRiO5HL7dRxAVjXY:5u6qg4SNyHcOJL712rY |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.VLD3Nk1TIwkGNmyGPC.bmp | 3.29 KB |
MD5:
d9e7ad56520045a770d9d7ccdaee664c
SHA1: 93bdb4b46a2ee92b548da0925e7bb2c574c13e45 SHA256: f72ea0f6346551bb5358b04e0900268bde9f2c38f7e6f4d505105605c4c77362 SSDeep: 96:T0fkk8k2h9nCOcFKUmB6NjtzE8Wk4hUPB:Fk2vn1cPNjd3WLhU5 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.waKMSqrywnXqjmY3STm.bmp | 69.35 KB |
MD5:
fe61d383acf54ce5dd0021d9e4f2b8a5
SHA1: 58abf897b102f1554ca465399a895757fdf76852 SHA256: 598a9dc8fd10b43bf3bee1d2d7bba16b77145dbc3900cc39589f43e09ada64c1 SSDeep: 1536:qMoFhAvn7Lb0gc+6FOLpnHqkLC+bxFdjj0K0Vb5CDXXPEkjqRhXeViaBUA7P:qZFan7n0gP6FypHTLCIPqb5aLjqR5oZr |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.7qrN.mkv | 29.48 KB |
MD5:
17c5c0ad0e2de15be9f889a644aa01c2
SHA1: 84e02a4a82d47022d34011e44c6eed670e7646cb SHA256: 1da2acc227c150b4d56b21378f68d1462783fc4027e7eaca4f2b1a7fb47ab7cd SSDeep: 768:Cyh0rLSdrSnYfh/7KZWMRxAo2uC1WAYFpbRu6L:CLr+Z7KhbvAYFpdu2 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.desktop.ini | 512 bytes |
MD5:
ba8e16029d84e8959d9562cb2032d9bf
SHA1: b2953e85caaeca1257522b2efcbec4c0937b20da SHA256: e78630bba56447930624526c839eeb26fa8192df0f97ddd5115fbf630dc2eeb0 SSDeep: 12:x/YcZ74iPoQKG9ChqkxEWGx/rb0l4iLNnO91lo:xwA71FCAdf5rM/ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.eJwCkaX.avi | 78.97 KB |
MD5:
f8852d9a9b9ecbf3726d8b4e9b79d5be
SHA1: 2ba4421be7745472cd651b4512dbf457bfd9df49 SHA256: 99176079f1f4748d5a4cf649b1ca43663f70a0d12c5d8617d1d43b9980914de1 SSDeep: 1536:4s03JHEM5oQvCUTdPFXeKwnlMSWyAGN2OZw8Sm1tZFG5EAgacGB7cFN:VeJ9d9XklECRUm1tZYSlZGyFN |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.EzPWeTUYQ0o54TxyD5.mkv | 87.52 KB |
MD5:
71c96ef6dafb28558741d09be1f5c350
SHA1: d71960259ca08f0c1e5a6bd7f643f71b1217ed80 SHA256: ebcd113588829f04871ef5b02bb84737245728a17e5388d27a3dd0e3295ceafd SSDeep: 1536:2CTnZwPlXp7rTuNEXue6VDC2+p1obwnBkb27y0TpnGF/mTO7DYCPX8j:RTm9Xp7rTuuXuyDbbs27y6sV4kU |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.1fyOaNMvpe0HLFYMO.doc | 72.66 KB |
MD5:
ba32e1996b366d03c577fcaeaa92a6fe
SHA1: d29db97d87d9f9771d4b4a9bc374c97acd73bf91 SHA256: 66a878fbfe3b71f572bf6345e406a6101dcd4bf4fae74433d3d9cd65ab10d496 SSDeep: 1536:4Xbul6t9F7q50xea4jKgt8yu9LGxmxx6zrYu7pDZ8CoLYI8+GO:4XKEF7Hxe5uouQmxxIl7Sc/+GO |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.46_piKwe1cHySGVu21.docx | 30.53 KB |
MD5:
49d3a5e12983fda438c6ea01ef386908
SHA1: c0281cb1783644ab3ada2f0bdda301c0c50485c7 SHA256: f4d053aaaba9c69db2c7f5d31e5706dca6c7d019742d8f55244d2369729f1fcf SSDeep: 768:3gT68KzsHxsBL/gJNPc6BGJNpv46BPlvOGh4nkLXy0L1h9IcZJ:3gm89H54JN/7a50xIM |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.8vMS.docx | 63.41 KB |
MD5:
6b83e137d6cd2eedc65484eb98b5a7ba
SHA1: 9f36b95cfb2f9559e81d887f0f53bb221f7762c4 SHA256: a2f067c1395f51c7d3afba7d871c98368b560fdcb804443455269acd0bca62ce SSDeep: 1536:gXY3FOGzMXrAKPjm6AUiY08vbysb7NXUQ9RyEQHY3gluze:IY1Rzerrjm6AUiY3vdb7FbTyEQggUe |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.D3BEewSKP- XS.xlsx | 63.70 KB |
MD5:
ed4a93459cc54e9237c0ef3cb56ba8ef
SHA1: c6f3029a7ec71b148be7d54162550ce069847097 SHA256: 482837c21fd6b30cacb64ede69d8a4192eac756f2364b9375d4b559385327940 SSDeep: 1536:KF9WxxDGpzmjMZFF3lr/uvCnrQHc7A5oYrSVFUVF6Qc:KFmxCpzmjMZrl/uz8sLAVQc |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.desktop.ini | 408 bytes |
MD5:
7835655816219d921dffbdb312396000
SHA1: bee4392a2a21f1faff64510296ed6d29d5ba6e7a SHA256: 4ef42b28c2d34762c16b1b31beae549b7a01c891ecf402fe5fe84b79f12afce5 SSDeep: 6:x/unJ6ZESn4iPU+HID8/KOv9CuA4+2Nof9wWdQM4hW0Zi7DYVc8k:x/YcZ74iPoQKG9CuA4GlqG2k |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.dKfh5A-JQm_Dx.docx | 98.93 KB |
MD5:
d0a546b59dfc9d815effdc0a72239c08
SHA1: 2e1f9558ecde15b22b896f180e9222060161662e SHA256: 92f7d91464306b08529584b1dfafd5e722dacc065e2582ee0e7c39dae437159a SSDeep: 3072:4GNDV7UEgeFnxYEv8gov4n3opNnrcHACbZbVt4ESg:4GlV7FxCgogyEAC1Z |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.EJnozy8q_wA_6u.odt | 35.53 KB |
MD5:
1e93b96cb6628830971626e7f9afa2f9
SHA1: c2da27b420c9d56a55f39a685307de6f21d446b7 SHA256: 1e19880927b1c2e4cd0d3b3b54bdc4a974bc2a799a9784b04b2921bc9c358b78 SSDeep: 768:BYI2eC7N1y1qQKFX8vSjxcccKSF80z7m5+bWZ1Zj5qPmSFZK:BYIXCD1x0cchy0nbbW5NYVZK |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.G0mzKIgpl5aj2M-.pptx | 77.54 KB |
MD5:
e3f9523342a15295b57cb0145596ddc3
SHA1: e866913a824a20d264800e793ea19b0344fe08fb SHA256: c43b233715ba78adc975849cfd78c36b4d708e1d0a86162c2ab9c582ec3da552 SSDeep: 1536:D2LhYhGg519gGMVn0oRmYmvJQHwHirfADkj1dhqFe7THg3Oo:D2L+4zOoNH+8zg5 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.icIcTV1 eT9I1Qro.xlsx | 25.98 KB |
MD5:
527baa556b8ff7a94fb192242a236523
SHA1: d7d0514e0c8f05fee80e02eb86a7949c350b7c42 SHA256: cb0eabd882105361aa41e87a428ab61ad3d5a0c1a10ac97a29f39728e64205ff SSDeep: 768:GX6+1FBGSHsgflPuaQ3BJUpBpMbPGaqoF:GBj7bQ3BJUpcrSoF |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.IqPW.xlsx | 96.73 KB |
MD5:
0aba2dbc674be847710ed42bee7b269f
SHA1: 66207349044c98545a6fc08a08248f03adf53947 SHA256: ee21228c9b916edfe2210082c33792b2dd8f17869f5e90def882be2126c7291c SSDeep: 1536:D+W/Zs9bJKw9O4ItDSGrHjtoEhw7bx0GiQlkuOd8P6pogfJH+/+nCuNoTc3ob9Ti:D+MspJrJEtoHHFmrJH+CC1Qobhi |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.M4zK0AkB79QVLka.rtf | 84.73 KB |
MD5:
a3c8006902909e88a9dc0ef2cd620fba
SHA1: cb0a286f94514c99e0a1f2b975b36a94fb481a59 SHA256: 7362e40364fc970050d76d876c31c3560459e9f4368c63ec15f7ef3e3a411c76 SSDeep: 1536:feE4oEYxX7Oc9QEM1AKrqca4IABLa8qnK9ieOIkP3uDvEYPDi3qQpAtHf:GE41YJikPM1AKO4jBO1K9QP3uDv5Pe3S |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.MlLRhGX00a.pptx | 45.04 KB |
MD5:
d472160b6125bfb4c16acf1fd9d7b58f
SHA1: d0e02ff9d84a8f5ae05f4a2153765d54e3666c3c SHA256: 7d62753d0d2a0b0b3fc53355e8df8bc8ebf044863923bf4b79e0daa6eb288736 SSDeep: 768:ACrfgbiar1DxShKgmA6e0v8t7/qHEBJ+qpBp4uLBdQbifvRK17g7LpUmp45v8mtH:N8i8QhSnejV/qeRvOWd//uW45km/foJy |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.MzqysNw1q1np8jj.docx | 82.27 KB |
MD5:
5791ff4a0f11f38b43f2e99c14c8084b
SHA1: 93b8e583c3ab1117fd1e458ea4d7cef9ec17db13 SHA256: 0116545ba5e6d24c46d77cd5238a514351524ec8d12901dbe79ab1561669225a SSDeep: 1536:IRLvK9nEjKbTRlmcXsOFpeu18Y3dQfX42v8I3Ug6//nM7vGk+VSzU6/k:IfunAUIQDyv8ip6nMKk+Mop |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.OQOxXrKa.ods | 71.16 KB |
MD5:
3e4cb5233f34d13065143791d8b5faff
SHA1: 711c28bd00fd72e65df4ec46e56e27b2701fefe1 SHA256: ff30a1fcca08f9b9b03620f8d661eb290147a0e0fa0eab450623f0391046dcfe SSDeep: 1536:jZV4voxKt4dla3uz9DeCIrpf2I97L7rWNU7ad7LCf7zIqjLibo0R:VqvoxE4dbzgC82Ih7vaRC3ImLQR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.rq5tKC1of8p4r7HR.pps | 28.45 KB |
MD5:
cd5097d16ae0516349b7e08d900b2400
SHA1: b3316ed294c2b691dfe9016033fc05899d961c19 SHA256: 7dcc66b3b1d8a9db7d382a6f586f7b3e507eba818c32cd0dab35d8a3e2669cfd SSDeep: 768:k8k3qQOrYfqJExdzP0vB0hlYPVAadPWgnea0S:kfT5050hlYPVAaBFnea7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.ZeVUVJRj4YhmoN71.pptx | 93.22 KB |
MD5:
4208aec8d0a6b15513cf1d95bdbc0f53
SHA1: 65bd7e7f51565853068a0eb7bb6fac0ea6d0b6e8 SHA256: 14934bb3e9565ed9cc84d852c04da22098fe2f1416960c464daf8c2882acfb5f SSDeep: 1536:ZmQ+EZkHwfF/cMN3MMOPaCP4RZcsIF4DvCDoOyFJOONv3ptDrPDsaZvRrhB22g:ZmQJZ2wBcq8MdY4gsIFwJOOtDsaDqH |
|
|
| C:\Users\Public\Documents/Lock.desktop.ini | 280 bytes |
MD5:
ed32321288e596a743e12080885bd804
SHA1: bb98925e7c07132b23bb32b11978b6bda0b11bf5 SHA256: b5a21156abd7ed5f0c2b1a0a4ac458ca832e401707ed97361967d46e240045bc SSDeep: 6:x/unJ6ZESn4iPU+HID8/KOv9Cwd2oqbAeifTeWBUhUxcx:x/YcZ74iPoQKG9CwdS+eWehuA |
|
|
| C:\Users\Public\Pictures/Lock.desktop.ini | 384 bytes |
MD5:
ab6923299c092b4c0f3fcfbbe65b1621
SHA1: 72261916cc9544c36b6f9c50bd3c1ba12d1f058d SHA256: 25e6ceecdbf5de7a584bb272da67f20ddb8fba4f068a7b15ea05eab2bb60bd0f SSDeep: 6:x/unJ6ZESn4iPU+HID8/KOv9Cwd+Iy+DTybApfQ4a94tu7fu7Kesza865InVVdwA:x/YcZ74iPoQKG9Cwd+IPTcAp4P9p7fuo |
|
|
| C:\Users\Public\Videos/Lock.desktop.ini | 384 bytes |
MD5:
1266a4ab23e5f2bb48db47c0ad3a391c
SHA1: 8a3c979136b0432c9291d5dbe25cf5a9c1bc043b SHA256: 7ff02fe5fdd24624fb413f493ecb593606663dac00382a7a0e12303bd45a7ae9 SSDeep: 6:x/unJ6ZESn4iPU+HID8/KOv9CwdRgZ/6xDhyPlrt45UxnDmOY+FfzFqrQxhNeEof:x/YcZ74iPoQKG9CwdRgZ/qDhyAaiCzFs |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.KU9xovkL1lisorTK5X | 8 bytes |
MD5:
de6fdff1993c731e52e49d52a6e684d9
SHA1: 120d1ff8a24109eed24ac1a5697383d50bcc0f47 SHA256: 645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42 SSDeep: 3:ZFHn:ZFHn |
|
|
| C:\Users\5P5NRG~1\AppData\Local\Temp\wl.jpg | 112.95 KB |
MD5:
e9e9b175c7ea6ce5b03de535476ad780
SHA1: 155558dc80ec749cf20fe16747b4196c8c6aaff5 SHA256: 83310806a4c9013bc476c6f89d7a6d196ce5428541028e207cc23567c2019b3e SSDeep: 1536:xaJdny6+9C9UE1PmPBLT1YyUh2WyEwVDrWFUkeWuD3m9iZsIIIIIIkhZ+tKW5n7k:G+2L1PmJ02Wylxk05Wd5RlsHc5S |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.0AFNgyUK36kK5YHPO1.odp | 40.50 KB |
MD5:
2a1ffbc587820997a15f5d0a675c37d8
SHA1: 45e25d50862967fee63eb14f248ac0dbcf83be7d SHA256: 068c12899958a364c6693a1f16434e0eda168cec70542cf7a36f843b42b1bb12 SSDeep: 768:kYUQcafXaqWpJGgxbECHHHdg6zFilehhq4X1+FLh3dVElaCsUbBj7:n1XaqK0gbHy6+ehY4F+thtVEI4j7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.0wIFgl.pps | 53.71 KB |
MD5:
784668c4cef2344007480b872ea0dd50
SHA1: b2da6d4bb99dd21d92afc28413763d8478a7fd16 SHA256: 8447d4bc93eb6bdf0d5e68378e7228724cfc2d6e60bc11037970f62a09ba876a SSDeep: 1536:JGVv2JPA6bqRAjYoEOpOmRvtJh8PqhjH/L4mFbgNm:gGTgAso5ptzj10Nm |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.5EdvDyyb.xls | 2.38 KB |
MD5:
5d8980ebea13a870822e0568462d0377
SHA1: ab0c3e4ace0667abd1101c4a8ac9a306b897fc88 SHA256: 8f245697667765abc6a800999c22926fa70fd6a8e5a6d373650a276a5f9ef676 SSDeep: 48:nYU8JMNwJqR1r/Ai6Jx7mS20ZIAf6szl9NIm5TuL:YuNwS/+/mTjQTz3NL5TQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.A4XY 5YOfDJ7NlnC.bmp | 67.15 KB |
MD5:
7ddddf25cd815e668218e592defcd37a
SHA1: 656d13a3fe2f4ef4b3023d501bde4417511e32d6 SHA256: c76ffc30634afbb02a24360be72d4de5895b4f3639752480453f37b40e5dada4 SSDeep: 1536:2QwxSWXyvdY9YoBBEZey/BEPG/QAi6VNjLTmCeLtCIOPQd26xsWrey5:pwxSJQY1t/1Ri6VNjn3eAcVxsc5 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.d1NqFAAxwvSf3pfr2yZp.gif | 52.36 KB |
MD5:
ee38f94a113e55ede766804b0b3608c0
SHA1: 4e284b41c0f85af801524a11b397859b264cb7de SHA256: 5e47ef1068769758995c8aecaee0078733955583d82968368e32046e90ed19fd SSDeep: 1536:D45L7IPKTfVZQO5oeIoprIV49KhLA3qUxc:8sKTt/2RTV4MhLDP |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.jrgF.gif | 76.25 KB |
MD5:
96f3b455a3b682747668017c39574f7e
SHA1: 67ca79b2d268989b097dee3233034915efc03f3e SHA256: 84aebb654a2a2bd564cbf5a6b007037a53135cb57e37c1523523cde516e07011 SSDeep: 1536:g4pFCHu8tp3Lyecx0GLfr2ZEm7oFbrdo3NVw9LRlv62Mmfz4VsxRSsKt:gUFC9bLyeyxLfrC2brdo6RNMmfz42Svt |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.OPqP3gN.pps | 92.66 KB |
MD5:
1ba736ba800225fcf99bc9cb24f31a50
SHA1: bd4f89f9fa8cad6a71473b64192cddbc84122e87 SHA256: e8575a6752f2d03d05809a5cca7505655b0bb7e5ad9a6f04b6ca4da75a34c9d9 SSDeep: 1536:/G/vrchb+aNmAu9l7LOkRWeV6lDjCa5bF1drxMnJCQcWN1oL7dhce2AlsQsKfc6o:2Wb34P/OeICClbQzN1oLzTsQJ0+i |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.YItI7wiYOV-Y.xlsx | 23.37 KB |
MD5:
b3776775566bbc6783efa500b289c7d2
SHA1: 20721d15c9c687f75a933cb5f0d4f8c31d806d9a SHA256: 255b6b633f26e747e8ad88f8982c5b5ae380a98015ff72801ff62712b1741e14 SSDeep: 384:iFgDfCu3a9c2R9dapbodZFO0LheSKvAZe0EOhom/iGi0V4Fd1qois9AizmEYzQpo:iaDfCzcWdQbyphGqomM0V4FCRqAiRYzt |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.CoTbYkKe.wav | 7.86 KB |
MD5:
25fe250fab69ae9277b96c5dec45975a
SHA1: 066dd0f3489f9d85e0072b695fb36a21845e59e2 SHA256: b50ee4b1e8eb0180524a5d936eab11c27cdc188645d17960bf12d32ba36b6ac6 SSDeep: 192:gc0t32zc9jvflJRYYuwtKmXjKmZ+QHGnUatctcm5BUHKt:J0NLfl0Hw8adAOatctcm5Wqt |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.JdjU4gAsI 0_L.gif | 54.64 KB |
MD5:
89eca168ea19781d2a3863bbbaa54ea3
SHA1: 5b136110cffbe17579141027c24beed0d58ed742 SHA256: 26f62ad412dc751114293f5b28d98a04b62f320136b9d43429bd4742ff4532f6 SSDeep: 768:F48vZGdUybLxD0RxinLJr09W0/8QKjGo1nlKP9YgG5WcoTg9m6GcXnEwTwQAxJcb:ZvZ8LyOYo22S6ngvcph9juxJYrqC |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.OjU _gfFJ vK4z9.pptx | 90.86 KB |
MD5:
45fb50567be71dd485a8ceac2229b1b8
SHA1: 6acc251c2a7a109149d16aee753cb2f3b6ce97c1 SHA256: 4c2aea67445cd21d14a77510e8c029d29371c6fc57d7897ca6e40397c221a513 SSDeep: 1536:siQ9zTB/HI7Dj7zpITxBQON04nyaNXFAjZTnCbNQYdR6f/YWJ82cH4FXgSq:w9zTBvKDj7NIN7vn1zAxnCDR6tgH4FXa |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.UEbu8HvUsrKZg-ZGj.m4a | 60.75 KB |
MD5:
adc02fa804f529ffbfdfd4557c7bcf5f
SHA1: 8c7af6236f7b842dae995b85f94c262ca2b0d7bf SHA256: ed049eb4eff6ab7536e17073a129534448099002dc2b5d69231dc26fd8dce09d SSDeep: 1536:HVdQ4tHwEhXY4ERV4km+5XbsxTowQV0vtXnr+VU:HLQ4SEzERVjXbY0wQVwt3qVU |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.QeeT.m4a | 68.29 KB |
MD5:
aaf26809e8bc4204f0d50b0c5fba2a8f
SHA1: 024a6f592b1c9b39fbebcccba4d6e96cd0e7724f SHA256: 91847f15af199cbb522abea6a014373ecb6b1a151d85781870d5d213deb04417 SSDeep: 1536:UR0Kko3+69ZCGSVFNRPwOUWbyLwsrdEtxL0V:EDF+6ctwOUWbmwsZEA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.desktop.ini | 512 bytes |
MD5:
82d46e91be16a17eb99f24cac1768f01
SHA1: d1cd482829c5e89d764a36af5db3b23535b0d8f0 SHA256: cb4e93277081095bdbd95f8bd745a80700689bc25483259ae9d970a2c72f076e SSDeep: 12:x/YcZ74iPoQKG9CuF/+Pih/a63DCoDSr3xGFUZ4ppWpo4:xwA71FCi4iVn32oDskFUZQpW64 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.E3PCt.png | 31.45 KB |
MD5:
fcf8427787ad47bded2390fe236d88ac
SHA1: cfeabb568559341f285d04412dd8cfc9d1dac3a8 SHA256: 89d274bc71bf5768e812f5bed92f5fc341906dbf33e5ecb0460a16ed405fc5a8 SSDeep: 768:TY7M8evKvIH/U4ov5lwunb5D6+bi0ualocU3Y3BTsX/f:TN8UKvIH/olwgIadT8 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.SLYhvryE1GJ5.png | 11.07 KB |
MD5:
24db713d7f23d7106abc3dd7538a4ff9
SHA1: c75be17e421abb2e411d651e92df686a648776f4 SHA256: 890749c4bb2d528bca9b999b4a3e93930ffa96806ed0108160cce1e1a50a5543 SSDeep: 192:dsj2OVXMFkMfuXU2M9oPQcnnvDUxJO/9Dkw5lE9xFfS5tSCPwYVZXo7N1S:GD5MyrX5MCbUxs9Dkw56T1SSCDVZ4J1S |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.EseSTJL.avi | 31.89 KB |
MD5:
7aa41b7cb7aeb3f676db533c8001c9a8
SHA1: 7da2e536f4cf4e0b875e98ee7523e372870fea58 SHA256: 0a556b17c3709c211cc1f8d2d1ee97b6a691e8c11125c1056bf7a99aed399fa9 SSDeep: 768:fIp+9zM01zxIAnS4q+qgY/Yr8ICiWOFo0N5NWdKjknY3JGWK6:n9G/+aXI1WKjWduJJPK6 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.S8aFA8f.mkv | 92.99 KB |
MD5:
a13e219491fa5432f46243ef726fa342
SHA1: 3d484a598da1d73cd9e9fa8d90e1d75e9d3fc432 SHA256: 4ab288df53582da79e8385c12786a000190f3b013c693fa88ef42042fe27d640 SSDeep: 1536:A3GMI/Yj2Kgxgl02zlmElAn1G4a2H6NEXcw0LXpk/JI6FsSRyZkqzehqSYDJ2:1DKAgjwQY4F2aN4cw0LXCh1sSRQkqihz |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.2tDiT2As-QJTabaRcc L.pptx | 46.80 KB |
MD5:
96894c2ab2a657d30661de780a09e9aa
SHA1: 52077a4d4ea1755f560292ab6ac97218283eb8b0 SHA256: c8dff6ce5a0ae0650103b2aee7230a313c2aaa7c434318701b690594509e3b5e SSDeep: 768:PEjQwHydLwOlEN6+Ih/CAxWyZ90rFGWivsgKk2TEP6aKX5sQGhfWx9y1uSiKx3Jd:0QOyQtyvkO/sgRvKX5HmfW0iKF3 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.B1NB4QkFt.rtf | 54.04 KB |
MD5:
0aeb8315fd7ba6a960893e3e4ea1ca23
SHA1: 6542de0c3197be5c6597ad6c88bbbf469498a5e8 SHA256: 963ba413c79c6c92a4a69f2ffb71eb3dba49826f5cf45a1d888420d9261cfdad SSDeep: 1536:f+LKf7S9Z9UWs8ITPA1z81T4iRVIFpGwP4WLsg+ToXt9zag8ql:3fKU58If1RgYHq9mo |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.goQ5n58_cIUllMnUx.xlsx | 39.63 KB |
MD5:
9fe43612fc0906febdbe05b607bff02a
SHA1: d0e3b035a908138aa6800fa5b618c0e9d9dd0ff7 SHA256: 20a6902f1ce0f9d26e0b6fd286b14870676de4911667b0dd14cd41890deadc2d SSDeep: 768:IMJR2bwR/qNIu+szFUyK6nrYxEF+NEksLbBlJkBtfj2BlgXYJzoCIZBoT6X:LJsbs/g+mc6n0xLNTsRWtKm4IZBom |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.oh6dPV4.xlsx | 10.64 KB |
MD5:
92fabe737fe29b2f73a74228b90e1bbc
SHA1: 5681651ccbaa7f5a3ed6c1250aa5ef2c34923252 SHA256: e92b05691febe56b330ffdefa9f8850903a68ef4ef319fa8c616098e1289cd3b SSDeep: 192:DwaiLRFMTgw0kdlzo+WPnRD4s53b5QOcN86KvUMH6Lacsx2b767OqX1EOYJ/s:ErRFFkdl8p40bgN86KvUMH6xWSOYJk |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.XeFrXnKCfR10wVvY0.pptx | 17.23 KB |
MD5:
63feb2761f26312a7a00509ec31d6ac4
SHA1: d5bece58f7c9d84e0b2b53e4d083fd05caf61372 SHA256: 9bc6970c58258a0a238adfb4fc0e3238071559cbe275cf1af3ec501013439b50 SSDeep: 384:Q3of0Z4e3dRtXj/cBXhOjkFjoCcyv05YVKWBdXMGfDY:lfRetnUhmkldcWv7xfDY |
|
|
| C:\Users\5P5NRG~1\AppData\Local\Temp/8x8x8 | 0 bytes |
MD5:
d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 SSDeep: 3:: |
|
|
Host Behavior
COM (1)
| Operation | Class | Interface | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|---|
| Create | 00021401-0000-0000-C000-000000000046 | 000214F9-0000-0000-C000-000000000046 | cls_context = CLSCTX_INPROC_SERVER |
|
1 |
File (1493)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
3 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\autDAA5.tmp | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\autDAA5.tmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB22.tmp | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp/32.cab | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB43.tmp | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp/64.cab | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/0AFNgyUK36kK5YHPO1.odp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.0AFNgyUK36kK5YHPO1.odp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/0wIFgl.pps | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.0wIFgl.pps | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/5EdvDyyb.xls | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.5EdvDyyb.xls | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/6qT95vcU.docx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.6qT95vcU.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/81-stuKA.mp4 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.81-stuKA.mp4 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/A4XY 5YOfDJ7NlnC.bmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.A4XY 5YOfDJ7NlnC.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Academics.pdf.exe | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.Academics.pdf.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/bY-NIrDXo_nG.bmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.bY-NIrDXo_nG.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/d1NqFAAxwvSf3pfr2yZp.gif | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.d1NqFAAxwvSf3pfr2yZp.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/desktop.ini | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/DrmlVcs.bmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.DrmlVcs.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/eGIW Yzvh.gif | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.eGIW Yzvh.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/FN4XiavIO4PR.bmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.FN4XiavIO4PR.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/GhiVvZ14WbSoIVTo6M.odt | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.GhiVvZ14WbSoIVTo6M.odt | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/gJ2GDQDH7i.ots | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.gJ2GDQDH7i.ots | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/gXTZQTDkC2czFZpWnC.gif | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.gXTZQTDkC2czFZpWnC.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/GyHm6iovQDw.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.GyHm6iovQDw.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/jrgF.gif | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.jrgF.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/KU9xovkL1lisorTK5X | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.KU9xovkL1lisorTK5X | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/lorGIZR7_Ai6fNrX6f.xlsx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.lorGIZR7_Ai6fNrX6f.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/md6gSAuODLhq.avi | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.md6gSAuODLhq.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/nJNF.png | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.nJNF.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/OPOBoXaM2P4A0m.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.OPOBoXaM2P4A0m.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/OPqP3gN.pps | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.OPqP3gN.pps | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/QHREQz7Xz.jpg | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.QHREQz7Xz.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/QzBYTrrsKyNkrz7Qz2.swf | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.QzBYTrrsKyNkrz7Qz2.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/SFHBP1D1LBQEeR.wav | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.SFHBP1D1LBQEeR.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/srS5tTxQY.mp3 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.srS5tTxQY.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/UCS72GVnNBUxEzx.mkv | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.UCS72GVnNBUxEzx.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/wI0b0QZdP-KcsT.avi | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.wI0b0QZdP-KcsT.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/YItI7wiYOV-Y.xlsx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.YItI7wiYOV-Y.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/yvFiHqzM6fmTt.flv | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.yvFiHqzM6fmTt.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/5fNAF_eBT37aF.bmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.5fNAF_eBT37aF.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/7sqV8uLS.bmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.7sqV8uLS.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Adobe | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.Adobe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/AX5eJBJ82y3.jpg | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.AX5eJBJ82y3.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/bXPQ0g368kO FpGH2kMH.gif | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.bXPQ0g368kO FpGH2kMH.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/co6M9Umeg.jpg | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.co6M9Umeg.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/CoTbYkKe.wav | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.CoTbYkKe.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/CoWnh3Q5rTDnpXdJ.mp3 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.CoWnh3Q5rTDnpXdJ.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/dunBms1jB_.jpg | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.dunBms1jB_.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/e-h1xk7cgYR.swf | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.e-h1xk7cgYR.swf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/enrHxcENdtYHa.rtf | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.enrHxcENdtYHa.rtf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/fieUnO JbD.odp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.fieUnO JbD.odp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/f_H3Kw_rw4T-WXKpM.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.f_H3Kw_rw4T-WXKpM.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/gFulebPw7UZ.flv | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.gFulebPw7UZ.flv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/GHNzGfsXtZO 6LRI5J.png | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.GHNzGfsXtZO 6LRI5J.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Go gw9icCK1.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.Go gw9icCK1.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Identities | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.Identities | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Ie7x9Fbl.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.Ie7x9Fbl.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/JdjU4gAsI 0_L.gif | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.JdjU4gAsI 0_L.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/jfoRUvp.mkv | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.jfoRUvp.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/JLaCurEw.pdf | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.JLaCurEw.pdf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/jOF28qdC.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.jOF28qdC.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/k3zAUT-8EHVGD9wmf.mp3 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.k3zAUT-8EHVGD9wmf.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Macromedia | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.Macromedia | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Microsoft | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.Microsoft | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Mozilla | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.Mozilla | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/ngBTzibcz-Ml b.gif | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.ngBTzibcz-Ml b.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/OjU _gfFJ vK4z9.pptx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.OjU _gfFJ vK4z9.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/qN0j1jGF7bK.jpg | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.qN0j1jGF7bK.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/qtQYu5s9c3vFJHOzQ.csv | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.qtQYu5s9c3vFJHOzQ.csv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/UEbu8HvUsrKZg-ZGj.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.UEbu8HvUsrKZg-ZGj.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/uKUOp3ady.png | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.uKUOp3ady.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/USOrj0U79kg56B_MZLC3.gif | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.USOrj0U79kg56B_MZLC3.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/yI2BOQ.jpg | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.yI2BOQ.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/ynNikGKB3oJVJW2VhiLE.ots | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock.ynNikGKB3oJVJW2VhiLE.ots | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/_J3DS1U3FLV.mp3 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Lock._J3DS1U3FLV.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Adobe | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.Adobe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Application Data | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.Application Data | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Apps | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.Apps | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Deployment | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.Deployment | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/GDIPFONTCACHEV1.DAT | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.GDIPFONTCACHEV1.DAT | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Google | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.Google | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/History | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.History | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/IconCache.db | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.IconCache.db | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Microsoft | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.Microsoft | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Microsoft Help | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.Microsoft Help | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Mozilla | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.Mozilla | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Temp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.Temp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Temporary Internet Files | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.Temporary Internet Files | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/VirtualStore | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/Lock.VirtualStore | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\ditreDSOdEug3Tyrxp1 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.ditreDSOdEug3Tyrxp1 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\HwKg28SMvdgN7pz7S.wav | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.HwKg28SMvdgN7pz7S.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\LVDYQUpAZwEha.mp3 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.LVDYQUpAZwEha.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\QeeT.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.QeeT.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\qjSu2Nf.wav | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.qjSu2Nf.wav | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\Rk60-o366.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.Rk60-o366.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\SI3T x_6.mp3 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.SI3T x_6.mp3 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\T3QpSK22qbSdU8p8YAX.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.T3QpSK22qbSdU8p8YAX.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\VvGsoQYq1 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.VvGsoQYq1 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\xBQp6dTr52cBE6l-Un.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.xBQp6dTr52cBE6l-Un.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music\XeP-i8.m4a | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Music/Lock.XeP-i8.m4a | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/-6 V-28Zs1i2mga0e.png | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.-6 V-28Zs1i2mga0e.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/70BY_GgaY1.bmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.70BY_GgaY1.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/desktop.ini | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/E3PCt.png | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.E3PCt.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/FSvM9zg.png | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.FSvM9zg.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/FWAReLHUsSkJL.bmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.FWAReLHUsSkJL.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/itO8mb4FwKJbnFD | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.itO8mb4FwKJbnFD | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/JP0X848xky.gif | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.JP0X848xky.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/krvo L5sveZ W.png | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.krvo L5sveZ W.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/QrlF.gif | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.QrlF.gif | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/SLYhvryE1GJ5.png | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.SLYhvryE1GJ5.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Ur-fU4s.jpg | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.Ur-fU4s.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/VLD3Nk1TIwkGNmyGPC.bmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.VLD3Nk1TIwkGNmyGPC.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/waKMSqrywnXqjmY3STm.bmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.waKMSqrywnXqjmY3STm.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/4Qauyoz6.avi | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.4Qauyoz6.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/5WsMFJk0dr95l c | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.5WsMFJk0dr95l c | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/7qrN.mkv | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.7qrN.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/afvn6kbS8JsNZy6W_IRM.mp4 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.afvn6kbS8JsNZy6W_IRM.mp4 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/desktop.ini | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/eJwCkaX.avi | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.eJwCkaX.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/EseSTJL.avi | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.EseSTJL.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/EzPWeTUYQ0o54TxyD5.mkv | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.EzPWeTUYQ0o54TxyD5.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/o7xXPd8 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.o7xXPd8 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/S8aFA8f.mkv | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/Lock.S8aFA8f.mkv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/1fyOaNMvpe0HLFYMO.doc | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.1fyOaNMvpe0HLFYMO.doc | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/2tDiT2As-QJTabaRcc L.pptx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.2tDiT2As-QJTabaRcc L.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/46_piKwe1cHySGVu21.docx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.46_piKwe1cHySGVu21.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/52zSkSwJyavPCLOxO1y | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.52zSkSwJyavPCLOxO1y | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/8vMS.docx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.8vMS.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/B1NB4QkFt.rtf | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.B1NB4QkFt.rtf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/D3BEewSKP- XS.xlsx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.D3BEewSKP- XS.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/desktop.ini | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/dKfh5A-JQm_Dx.docx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.dKfh5A-JQm_Dx.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/EJnozy8q_wA_6u.odt | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.EJnozy8q_wA_6u.odt | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/G0mzKIgpl5aj2M-.pptx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.G0mzKIgpl5aj2M-.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/goQ5n58_cIUllMnUx.xlsx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.goQ5n58_cIUllMnUx.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/icIcTV1 eT9I1Qro.xlsx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.icIcTV1 eT9I1Qro.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/IqPW.xlsx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.IqPW.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Kji1x-v4FT0kOOxbY6 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.Kji1x-v4FT0kOOxbY6 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/M4zK0AkB79QVLka.rtf | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.M4zK0AkB79QVLka.rtf | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MkMwkg_ip2 n-V.docx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.MkMwkg_ip2 n-V.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MlLRhGX00a.pptx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.MlLRhGX00a.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/My Music | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.My Music | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/My Pictures | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.My Pictures | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/My Shapes | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.My Shapes | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/My Videos | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.My Videos | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MzqysNw1q1np8jj.docx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.MzqysNw1q1np8jj.docx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/oh6dPV4.xlsx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.oh6dPV4.xlsx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/OQOxXrKa.ods | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.OQOxXrKa.ods | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Outlook Files | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.Outlook Files | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/rq5tKC1of8p4r7HR.pps | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.rq5tKC1of8p4r7HR.pps | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/XeFrXnKCfR10wVvY0.pptx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.XeFrXnKCfR10wVvY0.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/ZeVUVJRj4YhmoN71.pptx | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.ZeVUVJRj4YhmoN71.pptx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Zq0bBrnPbhA3GBBLi8 | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/Lock.Zq0bBrnPbhA3GBBLi8 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Documents/desktop.ini | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Documents/Lock.desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Documents/My Music | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Documents/Lock.My Music | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Documents/My Pictures | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Documents/Lock.My Pictures | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Documents/My Videos | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Documents/Lock.My Videos | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Pictures/desktop.ini | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Pictures/Lock.desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Pictures/Sample Pictures | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Pictures/Lock.Sample Pictures | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Videos/desktop.ini | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Videos/Lock.desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Videos/Sample Videos | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\Public\Videos/Lock.Sample Videos | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp/8x8x8 | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\aut55C0.tmp | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\aut55C0.tmp | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\wl.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\wl.jpg | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create Temp File | C:\Users\5P5NRG~1\AppData\Local\Temp\autDAA5.tmp | path = C:\Users\5P5NRG~1\AppData\Local\Temp\, prefix = aut |
|
1 | |
| Create Temp File | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB22.tmp | path = C:\Users\5P5NRG~1\AppData\Local\Temp\, prefix = aut |
|
1 | |
| Create Temp File | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB43.tmp | path = C:\Users\5P5NRG~1\AppData\Local\Temp\, prefix = aut |
|
1 | |
| Create Temp File | C:\Users\5P5NRG~1\AppData\Local\Temp\aut55C0.tmp | path = C:\Users\5P5NRG~1\AppData\Local\Temp\, prefix = aut |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | type = file_type |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | type = file_type |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | type = file_type |
|
3 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\autDAA5.tmp | type = file_type |
|
2 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | type = file_type |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp/32.cab | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB22.tmp | type = file_type |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp/64.cab | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB43.tmp | type = file_type |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/ | type = file_attributes |
|
10 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0AFNgyUK36kK5YHPO1.odp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0AFNgyUK36kK5YHPO1.odp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wIFgl.pps | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wIFgl.pps | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5EdvDyyb.xls | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5EdvDyyb.xls | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6qT95vcU.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6qT95vcU.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\81-stuKA.mp4 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\81-stuKA.mp4 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\A4XY 5YOfDJ7NlnC.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\A4XY 5YOfDJ7NlnC.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | type = file_attributes |
|
3 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bY-NIrDXo_nG.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bY-NIrDXo_nG.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d1NqFAAxwvSf3pfr2yZp.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d1NqFAAxwvSf3pfr2yZp.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\DrmlVcs.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\DrmlVcs.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\eGIW Yzvh.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\eGIW Yzvh.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FN4XiavIO4PR.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FN4XiavIO4PR.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GhiVvZ14WbSoIVTo6M.odt | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GhiVvZ14WbSoIVTo6M.odt | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gJ2GDQDH7i.ots | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gJ2GDQDH7i.ots | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gXTZQTDkC2czFZpWnC.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gXTZQTDkC2czFZpWnC.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GyHm6iovQDw.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GyHm6iovQDw.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jrgF.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jrgF.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KU9xovkL1lisorTK5X | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\lorGIZR7_Ai6fNrX6f.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\lorGIZR7_Ai6fNrX6f.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\md6gSAuODLhq.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\md6gSAuODLhq.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nJNF.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nJNF.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OPOBoXaM2P4A0m.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OPOBoXaM2P4A0m.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OPqP3gN.pps | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OPqP3gN.pps | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QHREQz7Xz.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QHREQz7Xz.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QzBYTrrsKyNkrz7Qz2.swf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SFHBP1D1LBQEeR.wav | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SFHBP1D1LBQEeR.wav | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\srS5tTxQY.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UCS72GVnNBUxEzx.mkv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UCS72GVnNBUxEzx.mkv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wI0b0QZdP-KcsT.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wI0b0QZdP-KcsT.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YItI7wiYOV-Y.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YItI7wiYOV-Y.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\yvFiHqzM6fmTt.flv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\yvFiHqzM6fmTt.flv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/ | type = file_attributes |
|
18 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\5fNAF_eBT37aF.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\5fNAF_eBT37aF.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\7sqV8uLS.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\7sqV8uLS.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\AX5eJBJ82y3.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\AX5eJBJ82y3.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\bXPQ0g368kO FpGH2kMH.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\bXPQ0g368kO FpGH2kMH.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\co6M9Umeg.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\co6M9Umeg.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\CoTbYkKe.wav | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\CoTbYkKe.wav | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\CoWnh3Q5rTDnpXdJ.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\CoWnh3Q5rTDnpXdJ.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\dunBms1jB_.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\dunBms1jB_.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\e-h1xk7cgYR.swf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\e-h1xk7cgYR.swf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\enrHxcENdtYHa.rtf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\enrHxcENdtYHa.rtf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\fieUnO JbD.odp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\fieUnO JbD.odp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\f_H3Kw_rw4T-WXKpM.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\f_H3Kw_rw4T-WXKpM.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\gFulebPw7UZ.flv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\gFulebPw7UZ.flv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\GHNzGfsXtZO 6LRI5J.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\GHNzGfsXtZO 6LRI5J.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Go gw9icCK1.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Go gw9icCK1.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Identities | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Ie7x9Fbl.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Ie7x9Fbl.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\JdjU4gAsI 0_L.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\jfoRUvp.mkv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\jfoRUvp.mkv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\JLaCurEw.pdf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\JLaCurEw.pdf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\jOF28qdC.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\jOF28qdC.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\k3zAUT-8EHVGD9wmf.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\k3zAUT-8EHVGD9wmf.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Macromedia | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ngBTzibcz-Ml b.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ngBTzibcz-Ml b.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\OjU _gfFJ vK4z9.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\OjU _gfFJ vK4z9.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qN0j1jGF7bK.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qN0j1jGF7bK.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qtQYu5s9c3vFJHOzQ.csv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qtQYu5s9c3vFJHOzQ.csv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\UEbu8HvUsrKZg-ZGj.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\UEbu8HvUsrKZg-ZGj.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\uKUOp3ady.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\uKUOp3ady.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\USOrj0U79kg56B_MZLC3.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\USOrj0U79kg56B_MZLC3.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\yI2BOQ.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ynNikGKB3oJVJW2VhiLE.ots | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ynNikGKB3oJVJW2VhiLE.ots | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_J3DS1U3FLV.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_J3DS1U3FLV.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/ | type = file_attributes |
|
7 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Deployment | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\History | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\IconCache.db | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\IconCache.db | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft Help | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Mozilla | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temporary Internet Files | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\VirtualStore | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music/ | type = file_attributes |
|
5 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\ditreDSOdEug3Tyrxp1 | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\HwKg28SMvdgN7pz7S.wav | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\HwKg28SMvdgN7pz7S.wav | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\LVDYQUpAZwEha.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\LVDYQUpAZwEha.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\QeeT.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\QeeT.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\qjSu2Nf.wav | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\Rk60-o366.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\Rk60-o366.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\SI3T x_6.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\SI3T x_6.mp3 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\T3QpSK22qbSdU8p8YAX.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\T3QpSK22qbSdU8p8YAX.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\VvGsoQYq1 | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\xBQp6dTr52cBE6l-Un.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\xBQp6dTr52cBE6l-Un.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\XeP-i8.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Music\XeP-i8.m4a | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/ | type = file_attributes |
|
5 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\-6 V-28Zs1i2mga0e.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\-6 V-28Zs1i2mga0e.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\70BY_GgaY1.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\70BY_GgaY1.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\E3PCt.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\E3PCt.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\FSvM9zg.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\FSvM9zg.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\FWAReLHUsSkJL.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\FWAReLHUsSkJL.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\itO8mb4FwKJbnFD | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JP0X848xky.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\JP0X848xky.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\krvo L5sveZ W.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\krvo L5sveZ W.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QrlF.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QrlF.gif | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SLYhvryE1GJ5.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SLYhvryE1GJ5.png | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Ur-fU4s.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Ur-fU4s.jpg | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VLD3Nk1TIwkGNmyGPC.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VLD3Nk1TIwkGNmyGPC.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\waKMSqrywnXqjmY3STm.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\waKMSqrywnXqjmY3STm.bmp | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/ | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\4Qauyoz6.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\4Qauyoz6.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\5WsMFJk0dr95l c | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7qrN.mkv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7qrN.mkv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\afvn6kbS8JsNZy6W_IRM.mp4 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\afvn6kbS8JsNZy6W_IRM.mp4 | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\eJwCkaX.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\eJwCkaX.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EseSTJL.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EseSTJL.avi | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EzPWeTUYQ0o54TxyD5.mkv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\EzPWeTUYQ0o54TxyD5.mkv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\o7xXPd8 | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\S8aFA8f.mkv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Videos\S8aFA8f.mkv | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/ | type = file_attributes |
|
7 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1fyOaNMvpe0HLFYMO.doc | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1fyOaNMvpe0HLFYMO.doc | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2tDiT2As-QJTabaRcc L.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\2tDiT2As-QJTabaRcc L.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\46_piKwe1cHySGVu21.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\46_piKwe1cHySGVu21.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\52zSkSwJyavPCLOxO1y | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\8vMS.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\8vMS.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\B1NB4QkFt.rtf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\B1NB4QkFt.rtf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\D3BEewSKP- XS.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\D3BEewSKP- XS.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\dKfh5A-JQm_Dx.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\dKfh5A-JQm_Dx.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\EJnozy8q_wA_6u.odt | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\EJnozy8q_wA_6u.odt | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\G0mzKIgpl5aj2M-.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\G0mzKIgpl5aj2M-.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\goQ5n58_cIUllMnUx.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\goQ5n58_cIUllMnUx.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\icIcTV1 eT9I1Qro.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\icIcTV1 eT9I1Qro.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\IqPW.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\IqPW.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Kji1x-v4FT0kOOxbY6 | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\M4zK0AkB79QVLka.rtf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\M4zK0AkB79QVLka.rtf | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MkMwkg_ip2 n-V.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MkMwkg_ip2 n-V.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MlLRhGX00a.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MlLRhGX00a.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Music | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Pictures | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Videos | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MzqysNw1q1np8jj.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MzqysNw1q1np8jj.docx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\oh6dPV4.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\oh6dPV4.xlsx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OQOxXrKa.ods | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Outlook Files | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rq5tKC1of8p4r7HR.pps | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\rq5tKC1of8p4r7HR.pps | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XeFrXnKCfR10wVvY0.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XeFrXnKCfR10wVvY0.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZeVUVJRj4YhmoN71.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\ZeVUVJRj4YhmoN71.pptx | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Zq0bBrnPbhA3GBBLi8 | type = file_attributes |
|
2 | |
| Get Info | C:\Users\Public\Documents/ | type = file_attributes |
|
1 | |
| Get Info | C:\Users\Public\Documents\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\Public\Documents\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\Public\Documents\My Music | type = file_attributes |
|
2 | |
| Get Info | C:\Users\Public\Documents\My Pictures | type = file_attributes |
|
2 | |
| Get Info | C:\Users\Public\Documents\My Videos | type = file_attributes |
|
2 | |
| Get Info | C:\Users\Public\Pictures/ | type = file_attributes |
|
1 | |
| Get Info | C:\Users\Public\Pictures\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\Public\Pictures\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\Public\Pictures\Sample Pictures | type = file_attributes |
|
2 | |
| Get Info | C:\Users\Public\Videos/ | type = file_attributes |
|
2 | |
| Get Info | C:\Users\Public\Videos\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\Public\Videos\desktop.ini | type = file_attributes |
|
1 | |
| Get Info | C:\Users\Public\Videos\Sample Videos | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | type = file_type |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\aut55C0.tmp | type = file_type |
|
2 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\wl.jpg | type = file_type |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp/8x8x8 | type = file_attributes |
|
29 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/Microsoft Update.lnk | type = file_attributes |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\x.exe | type = file_attributes |
|
2 | |
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/Microsoft Update.lnk | type = file_attributes |
|
28 | |
| Open | STD_INPUT_HANDLE | - |
|
2 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 | |
| Copy | C:\Users\5P5NRG~1\AppData\Local\Temp/32.cab | source_filename = C:\Users\5P5NRG~1\AppData\Local\Temp\autDB22.tmp |
|
1 | |
| Copy | C:\Users\5P5NRG~1\AppData\Local\Temp/64.cab | source_filename = C:\Users\5P5NRG~1\AppData\Local\Temp\autDB43.tmp |
|
1 | |
| Copy | C:\Users\5P5NRG~1\AppData\Local\Temp\x.exe | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 65536, size_out = 65536 |
|
11 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 4096, size_out = 4096 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 512, size_out = 512 |
|
10 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 512, size_out = 8 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 65536, size_out = 65536 |
|
11 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 4096, size_out = 4096 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 512, size_out = 512 |
|
2 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 18432, size_out = 18432 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 65536, size_out = 65536 |
|
33 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 4096, size_out = 4096 |
|
5 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 512, size_out = 512 |
|
17 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 4096, size_out = 1735 |
|
1 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp\autDAA5.tmp | size = 4096, size_out = 2080 |
|
1 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp\autDAA5.tmp | size = 61440, size_out = 0 |
|
1 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | size = 65536, size_out = 10877 |
|
2 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 45056, size_out = 45056 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 49152, size_out = 49152 |
|
1 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/0AFNgyUK36kK5YHPO1.odp | size = 65536, size_out = 41464 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/0AFNgyUK36kK5YHPO1.odp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/0wIFgl.pps | size = 65536, size_out = 54992 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/0wIFgl.pps | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/5EdvDyyb.xls | size = 65536, size_out = 2428 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/5EdvDyyb.xls | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/6qT95vcU.docx | size = 65536, size_out = 56427 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/6qT95vcU.docx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/81-stuKA.mp4 | size = 65536, size_out = 56147 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/81-stuKA.mp4 | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/A4XY 5YOfDJ7NlnC.bmp | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/A4XY 5YOfDJ7NlnC.bmp | size = 65536, size_out = 3216 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/A4XY 5YOfDJ7NlnC.bmp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Academics.pdf.exe | size = 65536, size_out = 65536 |
|
13 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Academics.pdf.exe | size = 65536, size_out = 64781 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Academics.pdf.exe | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/bY-NIrDXo_nG.bmp | size = 65536, size_out = 50906 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/bY-NIrDXo_nG.bmp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/d1NqFAAxwvSf3pfr2yZp.gif | size = 65536, size_out = 53612 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/d1NqFAAxwvSf3pfr2yZp.gif | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/desktop.ini | size = 65536, size_out = 282 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/desktop.ini | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/DrmlVcs.bmp | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/DrmlVcs.bmp | size = 65536, size_out = 22954 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/DrmlVcs.bmp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/eGIW Yzvh.gif | size = 65536, size_out = 59684 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/eGIW Yzvh.gif | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/FN4XiavIO4PR.bmp | size = 65536, size_out = 8369 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/FN4XiavIO4PR.bmp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/GhiVvZ14WbSoIVTo6M.odt | size = 65536, size_out = 50407 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/GhiVvZ14WbSoIVTo6M.odt | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/gJ2GDQDH7i.ots | size = 65536, size_out = 2050 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/gJ2GDQDH7i.ots | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/gXTZQTDkC2czFZpWnC.gif | size = 65536, size_out = 23917 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/gXTZQTDkC2czFZpWnC.gif | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/GyHm6iovQDw.m4a | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/GyHm6iovQDw.m4a | size = 65536, size_out = 13984 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/GyHm6iovQDw.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/jrgF.gif | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/jrgF.gif | size = 65536, size_out = 12542 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/jrgF.gif | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/lorGIZR7_Ai6fNrX6f.xlsx | size = 65536, size_out = 22712 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/lorGIZR7_Ai6fNrX6f.xlsx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/md6gSAuODLhq.avi | size = 65536, size_out = 31435 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/md6gSAuODLhq.avi | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/nJNF.png | size = 65536, size_out = 14198 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/nJNF.png | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/OPOBoXaM2P4A0m.m4a | size = 65536, size_out = 37150 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/OPOBoXaM2P4A0m.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/OPqP3gN.pps | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/OPqP3gN.pps | size = 65536, size_out = 29344 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/OPqP3gN.pps | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/QHREQz7Xz.jpg | size = 65536, size_out = 44341 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/QHREQz7Xz.jpg | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/QzBYTrrsKyNkrz7Qz2.swf | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/QzBYTrrsKyNkrz7Qz2.swf | size = 65536, size_out = 30901 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/QzBYTrrsKyNkrz7Qz2.swf | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/SFHBP1D1LBQEeR.wav | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/SFHBP1D1LBQEeR.wav | size = 65536, size_out = 13333 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/SFHBP1D1LBQEeR.wav | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/srS5tTxQY.mp3 | size = 65536, size_out = 40756 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/srS5tTxQY.mp3 | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/UCS72GVnNBUxEzx.mkv | size = 65536, size_out = 15449 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/UCS72GVnNBUxEzx.mkv | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/wI0b0QZdP-KcsT.avi | size = 65536, size_out = 53935 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/wI0b0QZdP-KcsT.avi | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/YItI7wiYOV-Y.xlsx | size = 65536, size_out = 23925 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/YItI7wiYOV-Y.xlsx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/yvFiHqzM6fmTt.flv | size = 65536, size_out = 48818 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/yvFiHqzM6fmTt.flv | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/5fNAF_eBT37aF.bmp | size = 65536, size_out = 55285 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/5fNAF_eBT37aF.bmp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/7sqV8uLS.bmp | size = 65536, size_out = 21802 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/7sqV8uLS.bmp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/AX5eJBJ82y3.jpg | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/AX5eJBJ82y3.jpg | size = 65536, size_out = 19764 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/AX5eJBJ82y3.jpg | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/bXPQ0g368kO FpGH2kMH.gif | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/bXPQ0g368kO FpGH2kMH.gif | size = 65536, size_out = 10704 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/bXPQ0g368kO FpGH2kMH.gif | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/co6M9Umeg.jpg | size = 65536, size_out = 35492 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/co6M9Umeg.jpg | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/CoTbYkKe.wav | size = 65536, size_out = 8042 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/CoTbYkKe.wav | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/CoWnh3Q5rTDnpXdJ.mp3 | size = 65536, size_out = 5967 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/CoWnh3Q5rTDnpXdJ.mp3 | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/dunBms1jB_.jpg | size = 65536, size_out = 29461 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/dunBms1jB_.jpg | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/e-h1xk7cgYR.swf | size = 65536, size_out = 30631 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/e-h1xk7cgYR.swf | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/enrHxcENdtYHa.rtf | size = 65536, size_out = 5095 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/enrHxcENdtYHa.rtf | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/fieUnO JbD.odp | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/fieUnO JbD.odp | size = 65536, size_out = 33501 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/fieUnO JbD.odp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/f_H3Kw_rw4T-WXKpM.m4a | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/f_H3Kw_rw4T-WXKpM.m4a | size = 65536, size_out = 13475 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/f_H3Kw_rw4T-WXKpM.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/gFulebPw7UZ.flv | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/gFulebPw7UZ.flv | size = 65536, size_out = 9907 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/gFulebPw7UZ.flv | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/GHNzGfsXtZO 6LRI5J.png | size = 65536, size_out = 49835 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/GHNzGfsXtZO 6LRI5J.png | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Go gw9icCK1.m4a | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Go gw9icCK1.m4a | size = 65536, size_out = 4978 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Go gw9icCK1.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Ie7x9Fbl.m4a | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Ie7x9Fbl.m4a | size = 65536, size_out = 26819 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/Ie7x9Fbl.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/JdjU4gAsI 0_L.gif | size = 65536, size_out = 55946 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/JdjU4gAsI 0_L.gif | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/jfoRUvp.mkv | size = 65536, size_out = 14570 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/jfoRUvp.mkv | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/JLaCurEw.pdf | size = 65536, size_out = 6737 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/JLaCurEw.pdf | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/jOF28qdC.m4a | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/jOF28qdC.m4a | size = 65536, size_out = 12714 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/jOF28qdC.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/k3zAUT-8EHVGD9wmf.mp3 | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/k3zAUT-8EHVGD9wmf.mp3 | size = 65536, size_out = 3518 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/k3zAUT-8EHVGD9wmf.mp3 | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/ngBTzibcz-Ml b.gif | size = 65536, size_out = 46560 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/ngBTzibcz-Ml b.gif | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/OjU _gfFJ vK4z9.pptx | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/OjU _gfFJ vK4z9.pptx | size = 65536, size_out = 27500 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/OjU _gfFJ vK4z9.pptx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/qN0j1jGF7bK.jpg | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/qN0j1jGF7bK.jpg | size = 65536, size_out = 29734 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/qN0j1jGF7bK.jpg | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/qtQYu5s9c3vFJHOzQ.csv | size = 65536, size_out = 32276 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/qtQYu5s9c3vFJHOzQ.csv | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/UEbu8HvUsrKZg-ZGj.m4a | size = 65536, size_out = 62205 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/UEbu8HvUsrKZg-ZGj.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/uKUOp3ady.png | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/uKUOp3ady.png | size = 65536, size_out = 32037 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/uKUOp3ady.png | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/USOrj0U79kg56B_MZLC3.gif | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/USOrj0U79kg56B_MZLC3.gif | size = 65536, size_out = 8835 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/USOrj0U79kg56B_MZLC3.gif | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/yI2BOQ.jpg | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/yI2BOQ.jpg | size = 65536, size_out = 2550 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/yI2BOQ.jpg | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/ynNikGKB3oJVJW2VhiLE.ots | size = 65536, size_out = 61508 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/ynNikGKB3oJVJW2VhiLE.ots | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/_J3DS1U3FLV.mp3 | size = 65536, size_out = 9255 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Roaming/_J3DS1U3FLV.mp3 | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/GDIPFONTCACHEV1.DAT | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/GDIPFONTCACHEV1.DAT | size = 65536, size_out = 43288 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/GDIPFONTCACHEV1.DAT | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/IconCache.db | size = 65536, size_out = 65536 |
|
18 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/IconCache.db | size = 65536, size_out = 26485 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz/AppData/Local/IconCache.db | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini | size = 65536, size_out = 504 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\HwKg28SMvdgN7pz7S.wav | size = 65536, size_out = 16339 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\HwKg28SMvdgN7pz7S.wav | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\LVDYQUpAZwEha.mp3 | size = 65536, size_out = 41643 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\LVDYQUpAZwEha.mp3 | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\QeeT.m4a | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\QeeT.m4a | size = 65536, size_out = 4386 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\QeeT.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\qjSu2Nf.wav | size = 65536, size_out = 45035 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\qjSu2Nf.wav | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\Rk60-o366.m4a | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\Rk60-o366.m4a | size = 65536, size_out = 18816 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\Rk60-o366.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\SI3T x_6.mp3 | size = 65536, size_out = 50888 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\SI3T x_6.mp3 | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\T3QpSK22qbSdU8p8YAX.m4a | size = 65536, size_out = 59569 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\T3QpSK22qbSdU8p8YAX.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\xBQp6dTr52cBE6l-Un.m4a | size = 65536, size_out = 5872 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\xBQp6dTr52cBE6l-Un.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\XeP-i8.m4a | size = 65536, size_out = 9851 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Music\XeP-i8.m4a | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/-6 V-28Zs1i2mga0e.png | size = 65536, size_out = 62628 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/-6 V-28Zs1i2mga0e.png | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/70BY_GgaY1.bmp | size = 65536, size_out = 19460 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/70BY_GgaY1.bmp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/desktop.ini | size = 65536, size_out = 504 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/desktop.ini | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/E3PCt.png | size = 65536, size_out = 32197 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/E3PCt.png | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/FSvM9zg.png | size = 65536, size_out = 30482 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/FSvM9zg.png | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/FWAReLHUsSkJL.bmp | size = 65536, size_out = 47819 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/FWAReLHUsSkJL.bmp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/JP0X848xky.gif | size = 65536, size_out = 26971 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/JP0X848xky.gif | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/krvo L5sveZ W.png | size = 65536, size_out = 38073 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/krvo L5sveZ W.png | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/QrlF.gif | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/QrlF.gif | size = 65536, size_out = 33652 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/QrlF.gif | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/SLYhvryE1GJ5.png | size = 65536, size_out = 11328 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/SLYhvryE1GJ5.png | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Ur-fU4s.jpg | size = 65536, size_out = 58865 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Ur-fU4s.jpg | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/VLD3Nk1TIwkGNmyGPC.bmp | size = 65536, size_out = 3365 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/VLD3Nk1TIwkGNmyGPC.bmp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/waKMSqrywnXqjmY3STm.bmp | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/waKMSqrywnXqjmY3STm.bmp | size = 65536, size_out = 5477 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/waKMSqrywnXqjmY3STm.bmp | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/4Qauyoz6.avi | size = 65536, size_out = 42667 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/4Qauyoz6.avi | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/7qrN.mkv | size = 65536, size_out = 30190 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/7qrN.mkv | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/afvn6kbS8JsNZy6W_IRM.mp4 | size = 65536, size_out = 51323 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/afvn6kbS8JsNZy6W_IRM.mp4 | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/desktop.ini | size = 65536, size_out = 504 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/desktop.ini | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/eJwCkaX.avi | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/eJwCkaX.avi | size = 65536, size_out = 15321 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/eJwCkaX.avi | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/EseSTJL.avi | size = 65536, size_out = 32655 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/EseSTJL.avi | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/EzPWeTUYQ0o54TxyD5.mkv | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/EzPWeTUYQ0o54TxyD5.mkv | size = 65536, size_out = 24084 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/EzPWeTUYQ0o54TxyD5.mkv | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/S8aFA8f.mkv | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/S8aFA8f.mkv | size = 65536, size_out = 29687 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Videos/S8aFA8f.mkv | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/1fyOaNMvpe0HLFYMO.doc | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/1fyOaNMvpe0HLFYMO.doc | size = 65536, size_out = 8858 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/1fyOaNMvpe0HLFYMO.doc | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/2tDiT2As-QJTabaRcc L.pptx | size = 65536, size_out = 47925 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/2tDiT2As-QJTabaRcc L.pptx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/46_piKwe1cHySGVu21.docx | size = 65536, size_out = 31258 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/46_piKwe1cHySGVu21.docx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/8vMS.docx | size = 65536, size_out = 64920 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/8vMS.docx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/B1NB4QkFt.rtf | size = 65536, size_out = 55335 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/B1NB4QkFt.rtf | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/D3BEewSKP- XS.xlsx | size = 65536, size_out = 65231 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/D3BEewSKP- XS.xlsx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/desktop.ini | size = 65536, size_out = 402 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/desktop.ini | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/dKfh5A-JQm_Dx.docx | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/dKfh5A-JQm_Dx.docx | size = 65536, size_out = 35761 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/dKfh5A-JQm_Dx.docx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/EJnozy8q_wA_6u.odt | size = 65536, size_out = 36382 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/EJnozy8q_wA_6u.odt | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/G0mzKIgpl5aj2M-.pptx | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/G0mzKIgpl5aj2M-.pptx | size = 65536, size_out = 13862 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/G0mzKIgpl5aj2M-.pptx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/goQ5n58_cIUllMnUx.xlsx | size = 65536, size_out = 40580 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/goQ5n58_cIUllMnUx.xlsx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/icIcTV1 eT9I1Qro.xlsx | size = 65536, size_out = 26601 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/icIcTV1 eT9I1Qro.xlsx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/IqPW.xlsx | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/IqPW.xlsx | size = 65536, size_out = 33505 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/IqPW.xlsx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/M4zK0AkB79QVLka.rtf | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/M4zK0AkB79QVLka.rtf | size = 65536, size_out = 21231 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/M4zK0AkB79QVLka.rtf | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MkMwkg_ip2 n-V.docx | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MkMwkg_ip2 n-V.docx | size = 65536, size_out = 17124 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MkMwkg_ip2 n-V.docx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MlLRhGX00a.pptx | size = 65536, size_out = 46116 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MlLRhGX00a.pptx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MzqysNw1q1np8jj.docx | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MzqysNw1q1np8jj.docx | size = 65536, size_out = 18696 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/MzqysNw1q1np8jj.docx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/oh6dPV4.xlsx | size = 65536, size_out = 10895 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/oh6dPV4.xlsx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/OQOxXrKa.ods | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/OQOxXrKa.ods | size = 65536, size_out = 7334 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/OQOxXrKa.ods | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/rq5tKC1of8p4r7HR.pps | size = 65536, size_out = 29121 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/rq5tKC1of8p4r7HR.pps | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/XeFrXnKCfR10wVvY0.pptx | size = 65536, size_out = 17642 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/XeFrXnKCfR10wVvY0.pptx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/ZeVUVJRj4YhmoN71.pptx | size = 65536, size_out = 65536 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/ZeVUVJRj4YhmoN71.pptx | size = 65536, size_out = 29913 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Documents/ZeVUVJRj4YhmoN71.pptx | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\Public\Documents/desktop.ini | size = 65536, size_out = 278 |
|
1 | |
| Read | C:\Users\Public\Documents/desktop.ini | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\Public\Pictures/desktop.ini | size = 65536, size_out = 380 |
|
1 | |
| Read | C:\Users\Public\Pictures/desktop.ini | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\Public\Videos/desktop.ini | size = 65536, size_out = 380 |
|
1 | |
| Read | C:\Users\Public\Videos/desktop.ini | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp/8x8x8 | size = 65536, size_out = 0 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 65536, size_out = 65536 |
|
11 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 4096, size_out = 4096 |
|
3 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 512, size_out = 512 |
|
7 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 61440, size_out = 61440 |
|
1 | |
| Read | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | size = 40960, size_out = 40960 |
|
1 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp\aut55C0.tmp | size = 4096, size_out = 4096 |
|
2 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp\aut55C0.tmp | size = 61440, size_out = 61440 |
|
1 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp\aut55C0.tmp | size = 61440, size_out = 39882 |
|
1 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp\aut55C0.tmp | size = 20480, size_out = 0 |
|
1 | |
| Write | C:\Users\5P5NRG~1\AppData\Local\Temp\autDAA5.tmp | size = 2080 |
|
1 | |
| Write | C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | size = 8192 |
|
1 | |
| Write | C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | size = 2685 |
|
1 | |
| Write | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB22.tmp | size = 45056 |
|
1 | |
| Write | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB22.tmp | size = 3823 |
|
1 | |
| Write | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB43.tmp | size = 49152 |
|
1 | |
| Write | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB43.tmp | size = 1949 |
|
1 | |
| Write | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | size = 280 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.d1NqFAAxwvSf3pfr2yZp.gif | size = 53616 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.desktop.ini | size = 288 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.jrgF.gif | size = 78080 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.OPOBoXaM2P4A0m.m4a | size = 37152 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop/Lock.SFHBP1D1LBQEeR.wav | size = 78872 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Pictures/Lock.Ur-fU4s.jpg | size = 58872 |
|
1 | |
| Write | C:\Users\5P5NRG~1\AppData\Local\Temp/8x8x8 | size = 0 |
|
1 | |
| Delete | C:\Users\5P5NRG~1\AppData\Local\Temp\autDAA5.tmp | - |
|
1 | |
| Delete | C:\Users\5P5NRG~1\AppData\Local\Temp\rngoajj | - |
|
1 | |
| Delete | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB22.tmp | - |
|
1 | |
| Delete | C:\Users\5P5NRG~1\AppData\Local\Temp\autDB43.tmp | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0AFNgyUK36kK5YHPO1.odp | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0wIFgl.pps | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\5EdvDyyb.xls | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\6qT95vcU.docx | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\81-stuKA.mp4 | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\A4XY 5YOfDJ7NlnC.bmp | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bY-NIrDXo_nG.bmp | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d1NqFAAxwvSf3pfr2yZp.gif | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\desktop.ini | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\DrmlVcs.bmp | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\eGIW Yzvh.gif | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FN4XiavIO4PR.bmp | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GhiVvZ14WbSoIVTo6M.odt | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gJ2GDQDH7i.ots | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\gXTZQTDkC2czFZpWnC.gif | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\GyHm6iovQDw.m4a | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\jrgF.gif | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KU9xovkL1lisorTK5X\6XZNXdmaE.mkv | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KU9xovkL1lisorTK5X\beHl29K.png | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KU9xovkL1lisorTK5X\ltw3NOHA-IS3VO805PDB.mp3 | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KU9xovkL1lisorTK5X\MqJJNCaJeg 6LuKEw7_E.bmp | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KU9xovkL1lisorTK5X\rvZq-S63e7o1A.pps | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KU9xovkL1lisorTK5X\SOnMTtgkgNdRf.avi | - |
|
1 | |
| Delete | 0 | - |
|
33 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\lorGIZR7_Ai6fNrX6f.xlsx | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\md6gSAuODLhq.avi | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nJNF.png | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OPOBoXaM2P4A0m.m4a | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OPqP3gN.pps | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QHREQz7Xz.jpg | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\QzBYTrrsKyNkrz7Qz2.swf | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SFHBP1D1LBQEeR.wav | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\srS5tTxQY.mp3 | - |
|
1 | |
| Delete | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\GHNzGfsXtZO 6LRI5J.png | - |
|
1 | |
|
For performance reasons, the remaining 179 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (61)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create Key | HKEY_CURRENT_USER\Control Panel\Desktop | - |
|
1 | |
| Create Key | HKEY_CURRENT_USER\Control Panel\Desktop | - |
|
28 | |
| Open Key | HKEY_CURRENT_USER\Control Panel\Mouse | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\AutoIt v3\AutoIt | - |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Control Panel\Mouse | value_name = SwapMouseButtons, data = 48 |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Control Panel\Desktop | value_name = Wallpaper, data = C:\Users\5P5NRG~1\AppData\Local\Temp\wl.jpg, size = 88, type = REG_SZ |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Control Panel\Desktop | value_name = Wallpaper, data = C:\Users\5P5NRG~1\AppData\Local\Temp\wl.jpg, size = 88, type = REG_SZ |
|
28 |
Process (7730)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\system32\cmd.exe | os_pid = 0xb24, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE |
|
1 | |
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | show_window = SW_SHOWNORMAL |
|
1 | |
| Enumerate Processes | - | - |
|
7574 | |
| Enumerate Processes | - | - |
|
154 |
Module (728)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | kernel32.dll | base_address = 0x76c20000 |
|
4 | |
| Load | uxtheme.dll | base_address = 0x745d0000 |
|
1 | |
| Load | ntdll.dll | base_address = 0x77130000 |
|
1 | |
| Load | Advapi32.dll | base_address = 0x74d40000 |
|
156 | |
| Load | user32.dll | base_address = 0x74f40000 |
|
29 | |
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x76c20000 |
|
2 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\academics.pdf.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Academics.pdf.exe, size = 260 |
|
3 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x76c34f2b |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x76c31252 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x76c34208 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x76c3359f |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = IsWow64Process, address_out = 0x76c3195e |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetNativeSystemInfo, address_out = 0x76c410b5 |
|
1 | |
| Get Address | c:\windows\syswow64\uxtheme.dll | function = IsThemeActive, address_out = 0x745f6f36 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = ZwSetInformationProcess, address_out = 0x7714fb18 |
|
1 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CryptAcquireContext, address_out = 0x0 |
|
109 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CryptAcquireContextA, address_out = 0x74d491dd |
|
109 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CryptDeriveKey, address_out = 0x74d83188 |
|
48 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CryptDestroyHash, address_out = 0x74d4df66 |
|
104 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CryptEncrypt, address_out = 0x74d6779b |
|
101 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CryptHashData, address_out = 0x74d4df36 |
|
10 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CryptDestroyKey, address_out = 0x74d4c51a |
|
3 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CryptCreateHash, address_out = 0x74d4df4e |
|
5 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CryptReleaseContext, address_out = 0x74d4e124 |
|
7 | |
| Get Address | c:\windows\syswow64\user32.dll | function = SystemParametersInfoW, address_out = 0x74f590d3 |
|
28 |
Window (2)
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | AutoIt v3 | class_name = AutoIt v3, wndproc_parameter = 0 |
|
1 | |
| Create | - | class_name = edit, wndproc_parameter = 0 |
|
1 |
System (2254)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Sleep | duration = 750 milliseconds (0.750 seconds) |
|
121 | |
| Sleep | duration = 10 milliseconds (0.010 seconds) |
|
2055 | |
| Get Time | type = System Time, time = 1627-02-24 05:52:33 (UTC) |
|
59 | |
| Get Time | type = Ticks, time = 186514 |
|
1 | |
| Get Time | type = Performance Ctr, time = 23347657579 |
|
1 | |
| Get Time | type = System Time, time = 2019-05-13 22:00:16 (UTC) |
|
14 | |
| Get Info | type = Operating System |
|
1 | |
| Get Info | type = Hardware Information |
|
1 | |
| Get Info | type = Windows Directory, result_out = C:\Windows |
|
1 |
Environment (323)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\Windows\system32\cmd.exe |
|
1 | |
| Get Environment String | name = USERPROFILE, result_out = C:\Users\5p5NrGJn0jS HALPmcxz |
|
321 |
Debug (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Check for Presence | c:\users\5p5nrgjn0js halpmcxz\desktop\academics.pdf.exe | - |
|
1 |
Process #2: cmd.exe
57
0
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | C:\Windows\system32\cmd.exe /c wusa C:\Users\5P5NRG~1\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ & exit |
| Initial Working Directory | C:\Users\5P5NRG~1\AppData\Local\Temp\ |
| Monitor | Start Time: 00:02:13, Reason: Child Process |
| Unmonitor | End Time: 00:02:23, Reason: Self Terminated |
| Monitor Duration | 00:00:09 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb24 |
| Parent PID | 0xb0c (c:\users\5p5nrgjn0js halpmcxz\desktop\academics.pdf.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
B28
|
Host Behavior
File (7)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp | type = file_attributes |
|
2 | |
| Open | STD_OUTPUT_HANDLE | - |
|
3 | |
| Open | STD_INPUT_HANDLE | - |
|
2 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 24, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\system32\wusa.exe | os_pid = 0xb3c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 |
Module (8)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x4ab50000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x76e30000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\system32\cmd.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x76e46d40 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x76e423d0 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x76e38290 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x76e417e0 |
|
1 |
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 1627-02-24 05:52:35 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 188745 |
|
1 | |
| Get Time | type = Performance Ctr, time = 23766354130 |
|
1 |
Environment (19)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
7 | |
| Get Environment String | name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ |
|
2 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
2 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\Windows\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Users\5P5NRG~1\AppData\Local\Temp |
|
1 | |
| Set Environment String | name = COPYCMD |
|
1 | |
| Set Environment String | name = =ExitCode, value = 00000000 |
|
1 | |
| Set Environment String | name = =ExitCodeAscii |
|
1 |
Process #3: wusa.exe
0
0
| Information | Value |
|---|---|
| ID | #3 |
| File Name | c:\windows\system32\wusa.exe |
| Command Line | wusa C:\Users\5P5NRG~1\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ |
| Initial Working Directory | C:\Users\5P5NRG~1\AppData\Local\Temp\ |
| Monitor | Start Time: 00:02:18, Reason: Child Process |
| Unmonitor | End Time: 00:02:23, Reason: Self Terminated |
| Monitor Duration | 00:00:05 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb3c |
| Parent PID | 0xb24 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
B40
0x
B4C
0x
B50
|
Process #4: wscript.exe
121
0
| Information | Value |
|---|---|
| ID | #4 |
| File Name | c:\windows\system32\wscript.exe |
| Command Line | "C:\Windows\System32\WScript.exe" "C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:02:24, Reason: Child Process |
| Unmonitor | End Time: 00:02:38, Reason: Self Terminated |
| Monitor Duration | 00:00:13 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb60 |
| Parent PID | 0xb0c (c:\users\5p5nrgjn0js halpmcxz\desktop\academics.pdf.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
B64
0x
B68
0x
B6C
0x
B70
0x
B74
0x
B78
0x
B7C
0x
B80
|
Host Behavior
COM (4)
| Operation | Class | Interface | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|---|
| Create | B54F3741-5B07-11CF-A4B0-00AA004A55E8 | 00000000-0000-0000-C000-000000000046 | cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER |
|
1 | |
| Create | 6C736DB1-BD94-11D0-8A23-00AA00B58E10 | 6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8 | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| Create | 06290BD1-48AA-11D2-8432-006008C3FBFC | E4D1C9B0-46E8-11D4-A2A6-00104BD35090 | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| Create | Wscript.Shell | IClassFactory | cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER |
|
1 |
File (4)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | desired_access = GENERIC_READ, file_attributes = FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | type = size |
|
1 | |
| Get Info | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | type = size |
|
1 | |
| Read | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | size = 280, size_out = 280 |
|
1 |
Registry (27)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | - |
|
1 | |
| Create Key | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | - |
|
1 | |
| Open Key | HKEY_CLASSES_ROOT\.vbs | - |
|
1 | |
| Open Key | HKEY_CLASSES_ROOT\VBSFile\ScriptEngine | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = IgnoreUserSettings, data = 103, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | value_name = Enabled, data = 103, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = Enabled, data = 103, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = IgnoreUserSettings, data = 0, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | value_name = LogSecuritySuccesses, data = 0, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = LogSecuritySuccesses, data = 0, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = IgnoreUserSettings, data = 0, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | value_name = TrustPolicy, data = 112, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | value_name = UseWINSAFER, data = 0, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = TrustPolicy, data = 112, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = UseWINSAFER, data = 1, type = REG_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = Timeout, data = 112, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings | value_name = DisplayLogo, data = 1, type = REG_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | value_name = Timeout, data = 112, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings | value_name = DisplayLogo, data = 49, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CLASSES_ROOT\.vbs | data = VBSFile, type = REG_SZ |
|
1 | |
| Read Value | HKEY_CLASSES_ROOT\VBSFile\ScriptEngine | data = VBScript, type = REG_SZ |
|
1 |
Process (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\System32\migwiz\migwiz.exe | show_window = SW_HIDE |
|
1 |
Module (21)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | kernel32.dll | base_address = 0x76e30000 |
|
1 | |
| Load | ole32.dll | base_address = 0x7fefe2b0000 |
|
1 | |
| Load | C:\Windows\system32\advapi32.dll | base_address = 0x7fefdbf0000 |
|
1 | |
| Load | shell32.dll | base_address = 0x7fefe4c0000 |
|
1 | |
| Get Handle | c:\windows\system32\wscript.exe | base_address = 0xff290000 |
|
3 | |
| Get Handle | c:\windows\system32\ole32.dll | base_address = 0x7fefe2b0000 |
|
1 | |
| Get Filename | c:\windows\system32\wscript.exe | process_name = c:\windows\system32\wscript.exe, file_name_orig = C:\Windows\System32\WScript.exe, size = 261 |
|
1 | |
| Get Filename | - | process_name = c:\windows\system32\wscript.exe, file_name_orig = C:\Windows\System32\WScript.exe, size = 261 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = HeapSetInformation, address_out = 0x76e4c4a0 |
|
1 | |
| Get Address | c:\windows\system32\ole32.dll | function = CoCreateInstance, address_out = 0x7fefe2d7490 |
|
1 | |
| Get Address | c:\windows\system32\advapi32.dll | function = SaferIdentifyLevel, address_out = 0x7fefdc0e470 |
|
1 | |
| Get Address | c:\windows\system32\advapi32.dll | function = SaferComputeTokenFromLevel, address_out = 0x7fefdc0f9b0 |
|
1 | |
| Get Address | c:\windows\system32\advapi32.dll | function = SaferCloseLevel, address_out = 0x7fefdc0f660 |
|
1 | |
| Get Address | c:\windows\system32\ole32.dll | function = CLSIDFromProgIDEx, address_out = 0x7fefe2ca4c4 |
|
1 | |
| Get Address | c:\windows\system32\ole32.dll | function = CoGetClassObject, address_out = 0x7fefe2e2e18 |
|
1 | |
| Get Address | c:\windows\system32\wscript.exe | function = 1, address_out = 0xff29d7f8 |
|
1 | |
| Get Address | c:\windows\system32\shell32.dll | function = ShellExecuteExW, address_out = 0x7fefe4e7c70 |
|
1 | |
| Create Mapping | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | filename = C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs, protection = PAGE_READONLY, maximum_size = 280 |
|
1 | |
| Map | C:\Users\5P5NRG~1\AppData\Local\Temp\888.vbs | process_name = c:\windows\system32\wscript.exe, desired_access = FILE_MAP_READ |
|
1 |
Window (1)
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | - | class_name = WSH-Timer, wndproc_parameter = 3234288 |
|
1 |
System (27)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Sleep | duration = -1 (infinite) |
|
2 | |
| Get Time | type = System Time, time = 1627-02-24 05:52:41 (UTC) |
|
2 | |
| Get Time | type = Ticks, time = 195001 |
|
1 | |
| Get Time | type = Performance Ctr, time = 24707480401 |
|
1 | |
| Get Time | type = Ticks, time = 195204 |
|
1 | |
| Get Time | type = Performance Ctr, time = 25008724990 |
|
1 | |
| Get Time | type = Ticks, time = 195219 |
|
1 | |
| Get Time | type = System Time, time = 1627-02-24 05:52:42 (UTC) |
|
3 | |
| Get Time | type = Ticks, time = 195469 |
|
1 | |
| Get Time | type = Performance Ctr, time = 25566177823 |
|
1 | |
| Get Time | type = Ticks, time = 195484 |
|
1 | |
| Get Time | type = Performance Ctr, time = 25598659096 |
|
1 | |
| Get Time | type = Ticks, time = 195625 |
|
1 | |
| Get Time | type = Performance Ctr, time = 25717672593 |
|
1 | |
| Get Info | type = Operating System |
|
5 | |
| Get Info | type = Operating System |
|
1 | |
| Get Info | type = System Directory, result_out = ó |
|
1 | |
| Get Info | type = System Directory, result_out = C:\Windows\system32 |
|
1 | |
| Get Info | type = Hardware Information |
|
1 |
Process #5: migwiz.exe
17
0
| Information | Value |
|---|---|
| ID | #5 |
| File Name | c:\windows\system32\migwiz\migwiz.exe |
| Command Line | "C:\Windows\System32\migwiz\migwiz.exe" C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:02:36, Reason: Child Process |
| Unmonitor | End Time: 00:03:02, Reason: Self Terminated |
| Monitor Duration | 00:00:26 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb84 |
| Parent PID | 0xb60 (c:\windows\system32\wscript.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
B88
|
Host Behavior
Module (5)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | MSVCRT.DLL | base_address = 0x7fefdad0000 |
|
1 | |
| Load | C:\Windows\system32\MFC42LOC.DLL | base_address = 0x0 |
|
1 | |
| Get Handle | c:\windows\system32\msvcrt.dll | base_address = 0x7fefdad0000 |
|
1 | |
| Get Filename | - | process_name = c:\windows\system32\migwiz\migwiz.exe, file_name_orig = C:\Windows\system32\MFC42u.dll, size = 260 |
|
1 | |
| Get Filename | - | process_name = c:\windows\system32\migwiz\migwiz.exe, file_name_orig = C:\Windows\System32\migwiz\migwiz.exe, size = 260 |
|
1 |
System (12)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Cursor | x_out = 227, y_out = 59 |
|
1 | |
| Get Cursor | x_out = 335, y_out = 31 |
|
1 | |
| Get Time | type = System Time, time = 1627-02-24 05:52:47 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 200414 |
|
1 | |
| Register Hook | hookproc_address = 0x7fef2abcc6c |
|
1 | |
| Get Info | type = Operating System |
|
6 | |
| Get Info | type = System Directory, result_out = C:\Windows\system32 |
|
1 |
Process #6: cmd.exe
59
0
| Information | Value |
|---|---|
| ID | #6 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:02:59, Reason: Child Process |
| Unmonitor | End Time: 00:03:01, Reason: Self Terminated |
| Monitor Duration | 00:00:02 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xbbc |
| Parent PID | 0xb84 (c:\windows\system32\migwiz\migwiz.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
BC0
|
Host Behavior
File (10)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop | type = file_attributes |
|
2 | |
| Open | STD_OUTPUT_HANDLE | - |
|
5 | |
| Open | STD_INPUT_HANDLE | - |
|
3 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 24, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\System32\reg.exe | os_pid = 0xbd4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 |
Module (8)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x4aad0000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x76e30000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\Windows\System32\cmd.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x76e46d40 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x76e423d0 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x76e38290 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x76e417e0 |
|
1 |
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-05-13 21:59:08 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 216607 |
|
1 | |
| Get Time | type = Performance Ctr, time = 28099471739 |
|
1 |
Environment (18)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
7 | |
| Get Environment String | name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ |
|
1 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
2 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\Windows\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop |
|
1 | |
| Set Environment String | name = COPYCMD |
|
1 | |
| Set Environment String | name = =ExitCode, value = 00000000 |
|
1 | |
| Set Environment String | name = =ExitCodeAscii |
|
1 |
Process #7: reg.exe
51
0
| Information | Value |
|---|---|
| ID | #7 |
| File Name | c:\windows\system32\reg.exe |
| Command Line | C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:02:59, Reason: Child Process |
| Unmonitor | End Time: 00:03:01, Reason: Self Terminated |
| Monitor Duration | 00:00:01 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xbd4 |
| Parent PID | 0xbbc (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
BD8
|
Host Behavior
File (5)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
3 | |
| Write | STD_OUTPUT_HANDLE | size = 39 |
|
1 |
Registry (4)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create Key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | value_name = EnableLUA |
|
1 | |
| Write Value | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | value_name = EnableLUA, data = 0, size = 4, type = REG_DWORD_LITTLE_ENDIAN |
|
1 |
Module (1)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\system32\reg.exe | base_address = 0xffdd0000 |
|
1 |
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-05-13 21:59:09 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 216856 |
|
1 | |
| Get Time | type = Performance Ctr, time = 28186515207 |
|
1 |
