d878a7c8...3ba3

Virtual Machine Information

Name	win7_64_sp1-mso2016
Description	-
Architecture	x86 64-bit
Operating System	Windows 7
Kernel Version	6.1.7601.17514 (3844dbb9-2017-4967-be7a-a4a2c20430fa)
Network Scheme Name	def
Network Config Name	def

System Information

Computer Name	YKYD69Q
User Domain	YKYD69Q
User Name	aETAdzjz
User Profile	C:\Users\aETAdzjz
Temp Directory	C:\Users\aETAdzjz\AppData\Local\Temp
System Root	C:\Windows
Sample Directory	C:\Users\aETAdzjz\Desktop

Software Information

Adobe Acrobat Reader Version	10.0.0
Microsoft Office	2016
Microsoft Office Version	16.0.8431.2079
Internet Explorer Version	8.0.7601.17514
Chrome Version	59.0.3071.115
Firefox Version	25.0
Flash Version	11.2.202.233
Java Version	7.0.710.14
Microsoft Project Version	16.0.8431.2079
Microsoft Visio Version	16.0.8431.2079

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (21)

Filename	PID	GUI
C:\Program Files (x86)\Common Files\europe.exe	#2124
C:\Program Files (x86)\Internet Explorer\authentication.exe	#1072
C:\Program Files (x86)\Mozilla Maintenance Service\mining.exe	#712
C:\Program Files (x86)\Mozilla Maintenance Service\normal-calendar.exe	#2092
C:\Program Files (x86)\Mozilla Maintenance Service\norway.exe	#2040
C:\Program Files (x86)\Mozilla Maintenance Service\taxi_symptoms_experienced.exe	#1304
C:\Program Files (x86)\Uninstall Information\linkedconsultants.exe	#1496
C:\Program Files (x86)\Windows Defender\marion legislation gzip.exe	#1844
C:\Program Files (x86)\Windows Mail\preview_prison.exe	#288
C:\Program Files\Common Files\min-final.exe	#2076
C:\Program Files\DVD Maker\colorks.exe	#144
C:\Program Files\Internet Explorer\di believe informative.exe	#2032
C:\Program Files\Internet Explorer\weblog.exe	#1036
C:\Program Files\MSBuild\licenses-proposal.exe	#2144
C:\Program Files\Uninstall Information\entries.exe	#628
C:\Program Files\Windows Defender\threshold_anthony.exe	#1804
C:\Program Files\Windows Media Player\frpi.exe	#1660
C:\Program Files\Windows Media Player\suitreuterslikelihood.exe	#2060
C:\Program Files\Windows Portable Devices\weather-unnecessary-pens.exe	#1204
C:\Program Files\Windows Sidebar\driveshiking.exe	#2108
C:\Program Files\Windows Sidebar\sci.exe	#848

Files (238)

Filename
C:\Users\aETAdzjz\AppData\Local\Temp\-HxM6.xlsx
C:\Users\aETAdzjz\AppData\Local\Temp\2r6hSu dKs.jpg
C:\Users\aETAdzjz\AppData\Local\Temp\3zFxQDcxpZZlJ.rtf
C:\Users\aETAdzjz\AppData\Local\Temp\4X6mA9PaeqnQ.swf
C:\Users\aETAdzjz\AppData\Local\Temp\7lhN48pUuoeFU.jpg
C:\Users\aETAdzjz\AppData\Local\Temp\EyzrsOZ0.bmp
C:\Users\aETAdzjz\AppData\Local\Temp\GucjV6MEbZIy1wU.ods
C:\Users\aETAdzjz\AppData\Local\Temp\HUr1geoRZVkb.mp3
C:\Users\aETAdzjz\AppData\Local\Temp\KpEJZVGc PiA k5jHt.mp3
C:\Users\aETAdzjz\AppData\Local\Temp\M2ctVMEQJlMIYlO.bmp
C:\Users\aETAdzjz\AppData\Local\Temp\NCLy2RqGTI09K.m4a
C:\Users\aETAdzjz\AppData\Local\Temp\O2mxFxmt.bmp
C:\Users\aETAdzjz\AppData\Local\Temp\PJBQS7GJ-7I wvDXSVo.jpg
C:\Users\aETAdzjz\AppData\Local\Temp\Pv9jXS7jSU476k.png
C:\Users\aETAdzjz\AppData\Local\Temp\RdR-.wav
C:\Users\aETAdzjz\AppData\Local\Temp\SOe0k6B1USxh_5SiCgi.jpg
C:\Users\aETAdzjz\AppData\Local\Temp\VC2nDrHVcp4xCSu.jpg
C:\Users\aETAdzjz\AppData\Local\Temp\WHCis-N5I61EJR.flv
C:\Users\aETAdzjz\AppData\Local\Temp\Z4e6J.mp3
C:\Users\aETAdzjz\AppData\Local\Temp\ZJlDl.mp3
C:\Users\aETAdzjz\AppData\Local\Temp\e3k4Iin7SZ nNnTOr.png
C:\Users\aETAdzjz\AppData\Local\Temp\eezfG_3JZkr.bmp
C:\Users\aETAdzjz\AppData\Local\Temp\fp1oFwvY.doc
C:\Users\aETAdzjz\AppData\Local\Temp\ht2M6e.avi
C:\Users\aETAdzjz\AppData\Local\Temp\i O E_9wSJ6 Dp9p1w.swf
C:\Users\aETAdzjz\AppData\Local\Temp\iExjymp0Dbc.swf
C:\Users\aETAdzjz\AppData\Local\Temp\jc-EHU-zYx.xls
C:\Users\aETAdzjz\AppData\Local\Temp\u1IfBN1_xRdYv9IQUh.swf
C:\Users\aETAdzjz\AppData\Local\Temp\xdVz4EK U zTJIAiOEu.ods
C:\Users\aETAdzjz\AppData\Roaming\1N2uKXEjs8DF.mp3
C:\Users\aETAdzjz\AppData\Roaming\54eaSf1Kr2VG Ih5JN.m4a
C:\Users\aETAdzjz\AppData\Roaming\5pZ4WbP0L.xls
C:\Users\aETAdzjz\AppData\Roaming\7Ld_eDfOf.flv
C:\Users\aETAdzjz\AppData\Roaming\7m4fH-a9HaRNGJ.bmp
C:\Users\aETAdzjz\AppData\Roaming\8ZAv5lGA 1OrXeYROAa.pdf
C:\Users\aETAdzjz\AppData\Roaming\B4AKi9Ooz9ZozcW3.wav
C:\Users\aETAdzjz\AppData\Roaming\INHjbk0V0Xy0.avi
C:\Users\aETAdzjz\AppData\Roaming\Log2S9Pb286hidE0zWh.flv
C:\Users\aETAdzjz\AppData\Roaming\PUMXe.docx
C:\Users\aETAdzjz\AppData\Roaming\Png8kk_vY4_1M.xls
C:\Users\aETAdzjz\AppData\Roaming\ScZ0RGhTp1.mp3
C:\Users\aETAdzjz\AppData\Roaming\Z_jghQ6ww 00D6FQSvC.mkv
C:\Users\aETAdzjz\AppData\Roaming\Zi0AWavfgwaMpwp.mkv
C:\Users\aETAdzjz\AppData\Roaming\_cdHMmkWa6CFPlCB7Y.wav
C:\Users\aETAdzjz\AppData\Roaming\a2FOt3Xv8JdbbX.mp3
C:\Users\aETAdzjz\AppData\Roaming\cJN7x_RlY.png
C:\Users\aETAdzjz\AppData\Roaming\e6FOPq hd.png
C:\Users\aETAdzjz\AppData\Roaming\fqD93XjRFfCqQO.m4a
C:\Users\aETAdzjz\AppData\Roaming\gH1V0A8xMg.wav
C:\Users\aETAdzjz\AppData\Roaming\i5 L85HWPAMQz4WL6AsY.png
C:\Users\aETAdzjz\AppData\Roaming\jNprVsalsMj9xkcZ8.jpg
C:\Users\aETAdzjz\AppData\Roaming\kgX.mp4
C:\Users\aETAdzjz\AppData\Roaming\pDv8fYNlr3x7l K.wav
C:\Users\aETAdzjz\AppData\Roaming\ptEGZG.mkv
C:\Users\aETAdzjz\AppData\Roaming\qnWmaDpQXXpxN4L.mkv
C:\Users\aETAdzjz\AppData\Roaming\xIR4_0ik.jpg
C:\Users\aETAdzjz\AppData\Roaming\xxZZU1L7mCJk.flv
C:\Users\aETAdzjz\Desktop\174HvAhvyqO-8Bq4WnK.wav
C:\Users\aETAdzjz\Desktop\1E Rs6GPgn2.mkv
C:\Users\aETAdzjz\Desktop\2eAnsBHF8qaWxigjgxS.avi
C:\Users\aETAdzjz\Desktop\8fJrujftE0 cfX.gif
C:\Users\aETAdzjz\Desktop\HkChQi99o0F19Cs3DNT.mkv
C:\Users\aETAdzjz\Desktop\LMMBl38qhof
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\7DOeXQRM47 ZZ9Wjq.avi
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\7EAOYH
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\7EAOYH\t4HcJRX8elifIGcnHZ.mp3
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\IJTDZfDf
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\IJTDZfDf\9IeSH4L8V1d.swf
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\IJTDZfDf\K1X5Dj1PYJ4
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\IJTDZfDf\_tj2Bgd275gkBwPAy.odp
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\IJTDZfDf\nDf-NejwBfQDOgSP.avi
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\Na nIm7FDMx1Zp8z.doc
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\c-Fg3c2.jpg
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\oRaJ_Ek6zf l8B.swf
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\qkAXNv1QSITAUBc8hV
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\qkAXNv1QSITAUBc8hV\4IrO2aGzJ.bmp
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\uhAyImE727BO9TPu.png
C:\Users\aETAdzjz\Desktop\LMMBl38qhof\yJI_d5A.odt
C:\Users\aETAdzjz\Desktop\N_Lch7uYxyAFc1jTeLx.pptx
C:\Users\aETAdzjz\Desktop\V_6sYxM.wav
C:\Users\aETAdzjz\Desktop\_hnKTda4L8ckW-XX.swf
C:\Users\aETAdzjz\Desktop\a5KEd-M9hc13.flv
C:\Users\aETAdzjz\Desktop\ailzaCctpzbBZpoyYT5.csv
C:\Users\aETAdzjz\Desktop\bluYv-aj72t5qH.png
C:\Users\aETAdzjz\Desktop\bxVen0xF0.mp3
C:\Users\aETAdzjz\Desktop\cKT3czl.gif
C:\Users\aETAdzjz\Desktop\gjvDRohDaam80.m4a
C:\Users\aETAdzjz\Desktop\iVNJ-E.bmp
C:\Users\aETAdzjz\Desktop\mpylj6.mp4
C:\Users\aETAdzjz\Desktop\p92lBxi8m4bjGlp.mp4
C:\Users\aETAdzjz\Desktop\rXLyq2.bmp
C:\Users\aETAdzjz\Desktop\sIgL92rs-5iifif.avi
C:\Users\aETAdzjz\Desktop\uIuMNAp1Je-z0ut39Fy.png
C:\Users\aETAdzjz\Desktop\wIBfWWMf.png
C:\Users\aETAdzjz\Desktop\x1Cs7IHkgtNcU.doc
C:\Users\aETAdzjz\Documents\0Kjmkf13P.xlsx
C:\Users\aETAdzjz\Documents\3Vxxqu.docx
C:\Users\aETAdzjz\Documents\6 nPkgnZxdW.xls
C:\Users\aETAdzjz\Documents\A1tniolsfUKFXw3.xlsx
C:\Users\aETAdzjz\Documents\D EjAzdQxM4n.pptx
C:\Users\aETAdzjz\Documents\DTBOvHvVBndAMuyS.pptx
C:\Users\aETAdzjz\Documents\HlCYbV.docx
C:\Users\aETAdzjz\Documents\IrUd.pdf
C:\Users\aETAdzjz\Documents\MvwFZff_6o.pps
C:\Users\aETAdzjz\Documents\MxMtLTHbtLleh0Mav-P.xlsx
C:\Users\aETAdzjz\Documents\Q7nhptnmwDCTORmZWto.docx
C:\Users\aETAdzjz\Documents\TGT5_YCJWXDt.pptx
C:\Users\aETAdzjz\Documents\UVzdRNyIiLH.xlsx
C:\Users\aETAdzjz\Documents\XLPOA.xlsx
C:\Users\aETAdzjz\Documents\Z17zORwMb3kJlO.docx
C:\Users\aETAdzjz\Documents\ZeKs
C:\Users\aETAdzjz\Documents\ZeKs\0trs0OE UAf5KUpkSIg.pps
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0T-2UC-czichT3NZ.rtf
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\DwS18YEiFhtBzK_0.pdf
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\EIimmAdZn rXOWFIEx.ppt
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\M3hQ1Vn9yptoHX.xlsx
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\PtmBJ5mJq63Z7mlcZ.rtf
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\T-W2KzH9T.ppt
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\UB ZSI g0gXZfw06.odt
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\bfFicSHcJpWZHP.ots
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\p6nUh9pIKf80cL.rtf
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\sa73ctMb8vpUFn.doc
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\uJqb3h.csv
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\xnBNfNSfiN4PH0lTpo0
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\xnBNfNSfiN4PH0lTpo0\OkI37-.pptx
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\0_RcE_-\xnBNfNSfiN4PH0lTpo0\s4Ovpmy.ods
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\2kwWU_AbhCjzSc.ods
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\4Derl AICer4HHf4A86v.xlsx
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\5UW_Gqin.csv
C:\Users\aETAdzjz\Documents\ZeKs\7oE- -U9N93HM\uAmJ2S.doc
C:\Users\aETAdzjz\Documents\ZeKs\PvQK2mg9u nr f4lSDc4.ppt
C:\Users\aETAdzjz\Documents\ZeKs\RNJQt56EVc
C:\Users\aETAdzjz\Documents\ZeKs\RNJQt56EVc\D2a1s-ACGfPpYaWaw.csv
C:\Users\aETAdzjz\Documents\ZeKs\RNJQt56EVc\cD5V-SeQoc cjo7zO.doc
C:\Users\aETAdzjz\Documents\ZeKs\RNJQt56EVc\v6uY8gmgcVU.rtf
C:\Users\aETAdzjz\Documents\ZeKs\U6LhlSflo.pptx
C:\Users\aETAdzjz\Documents\ZeKs\VGZn.xls
C:\Users\aETAdzjz\Documents\ZeKs\dojtAC6zB1H bO_LbDW.odp
C:\Users\aETAdzjz\Documents\ZeKs\vHB1C3FA.odt
C:\Users\aETAdzjz\Documents\dlMPNiJL0Fh1ZMu.docx
C:\Users\aETAdzjz\Documents\ebpHi7UzFd0kjhH R.pptx
C:\Users\aETAdzjz\Documents\vTBt146.pptx
C:\Users\aETAdzjz\Music\0jkFVcPwmHYdr9vU.m4a
C:\Users\aETAdzjz\Music\Hi9nx
C:\Users\aETAdzjz\Music\Hi9nx\C1_u14KneHBqNvVKdGV.m4a
C:\Users\aETAdzjz\Music\Hi9nx\V Uy9Me odDhC.mp3
C:\Users\aETAdzjz\Music\Hi9nx\Wgiy2lcNUtRAcCn.mp3
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k\7lzTKKsJi.m4a
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k\SI3zwIKcr3XiK.m4a
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k\Tkuc4e8Wa4.m4a
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k\cBg3fqQHYPYOCXLPI.wav
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k\gE_K_xIaBHXOBljvYybA.mp3
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k\glcq.mp3
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k\gnYq.wav
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k\jm9qjjF_0cEJdnO2.mp3
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k\lTWkpzekSBlCPNih4xzk.mp3
C:\Users\aETAdzjz\Music\Hi9nx\kSY8eIr8wtZp0k\lhgD.m4a
C:\Users\aETAdzjz\Music\Hi9nx\vy7bhcJJt7HSX.wav
C:\Users\aETAdzjz\Music\IIfhF 7aLgpmKc
C:\Users\aETAdzjz\Music\IIfhF 7aLgpmKc\HAcGA76e52cwHxh8hk.m4a
C:\Users\aETAdzjz\Music\IIfhF 7aLgpmKc\MmH59SK765qMnhoN70ZP.m4a
C:\Users\aETAdzjz\Music\WtM2fx
C:\Users\aETAdzjz\Music\WtM2fx\1vdaM.m4a
C:\Users\aETAdzjz\Music\WtM2fx\ATX1Ie3LiNWsRgogXT.m4a
C:\Users\aETAdzjz\Music\WtM2fx\Q YdA.m4a
C:\Users\aETAdzjz\Music\WtM2fx\S7-2hyIn.wav
C:\Users\aETAdzjz\Music\WtM2fx\Z6qCPQq-80YRc-PtN0x-.wav
C:\Users\aETAdzjz\Music\WtM2fx\fOz8ka.m4a
C:\Users\aETAdzjz\Music\WtM2fx\jkTnkG7Kw4dJtoJfedD.m4a
C:\Users\aETAdzjz\Music\WtM2fx\oLkoK.wav
C:\Users\aETAdzjz\Music\WtM2fx\przLD RPy75T.mp3
C:\Users\aETAdzjz\Music\WtM2fx\w_AwfWwLvIUe.m4a
C:\Users\aETAdzjz\Music\duhszn.m4a
C:\Users\aETAdzjz\Music\iEwkbORm2pfUJfYGEMc.wav
C:\Users\aETAdzjz\Music\nd4mKbFwkY11IBV7f.m4a
C:\Users\aETAdzjz\Pictures\HQjAHF0 wIN.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV
C:\Users\aETAdzjz\Pictures\dXR1WV\2EYQriA-oGerU.gif
C:\Users\aETAdzjz\Pictures\dXR1WV\2FSr6yQlzon.png
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\JoFQ5S UILrI7x.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\eFqL5hK_qvtY6b.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\lg9L27A2toL75w.gif
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\5F0p eb-8OuG-p-.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\VtjXe3ZAup m.gif
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\a54VDVT7u664o.jpg
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\gYzjWP.png
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\lkeMreU4gMM9w.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\wqzv5qDa-86eZ2ORMt
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\wqzv5qDa-86eZ2ORMt\4vZaZ.jpg
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\wqzv5qDa-86eZ2ORMt\87 Ceto-ldrd.jpg
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\wqzv5qDa-86eZ2ORMt\HTuHLIlPUiB88vln.jpg
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\wqzv5qDa-86eZ2ORMt\IjVYoaAQ6.png
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\wqzv5qDa-86eZ2ORMt\Jfhmp0Ar.png
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\wqzv5qDa-86eZ2ORMt\MOOkeY.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV\4xrgY\xu-eNNGUw5T-Xl\wqzv5qDa-86eZ2ORMt\n3blwLJFGuI8i7XCIG.gif
C:\Users\aETAdzjz\Pictures\dXR1WV\Gu1wXHOqcjt.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV\Ka rXm2uq7.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV\QMq-HX7jFfRu9Lu1Dd.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV\_m12zX.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV\dP4flShg.bmp
C:\Users\aETAdzjz\Pictures\dXR1WV\i2qgjLoJrtEUvg.gif
C:\Users\aETAdzjz\Pictures\dXR1WV\oHMXQ38RBzZmX.png
C:\Users\aETAdzjz\Pictures\dXR1WV\ri3a.bmp
C:\Users\aETAdzjz\Pictures\llEzOi.bmp
C:\Users\aETAdzjz\Pictures\yt6pKFYN1kAET27.jpg
C:\Users\aETAdzjz\Videos\54plnG9L.mp4
C:\Users\aETAdzjz\Videos\6hd46uFl88dr-VL6H3r9.avi
C:\Users\aETAdzjz\Videos\7911fTfYM4mX2TVYZ.flv
C:\Users\aETAdzjz\Videos\EYcoVxhlgv4Gqm-AA6p.mkv
C:\Users\aETAdzjz\Videos\H9P9hdTujCQ.mkv
C:\Users\aETAdzjz\Videos\TrMwQx5YdmlF.mp4
C:\Users\aETAdzjz\Videos\WYYq0PDii.avi
C:\Users\aETAdzjz\Videos\WglKuW-XiC3G.swf
C:\Users\aETAdzjz\Videos\WrZ4-ZD.avi
C:\Users\aETAdzjz\Videos\ZsSTtIwiTJ8eDO0sQ 9.mp4
C:\Users\aETAdzjz\Videos\avKesJnM.swf
C:\Users\aETAdzjz\Videos\pzPzJH0.swf
C:\Users\aETAdzjz\Videos\tv69RzODWbz
C:\Users\aETAdzjz\Videos\tv69RzODWbz\-fJxEWaYQaI.swf
C:\Users\aETAdzjz\Videos\tv69RzODWbz\0kogNhkLB6EGrAb.swf
C:\Users\aETAdzjz\Videos\tv69RzODWbz\2MR7qPxOP.flv
C:\Users\aETAdzjz\Videos\tv69RzODWbz\3LVg8B0sfcl WL.swf
C:\Users\aETAdzjz\Videos\tv69RzODWbz\FI9wX8QYEAB.swf
C:\Users\aETAdzjz\Videos\tv69RzODWbz\ICF0IEM IhZiFlJy8XI.avi
C:\Users\aETAdzjz\Videos\tv69RzODWbz\L5PNspkVQ.mkv
C:\Users\aETAdzjz\Videos\tv69RzODWbz\NXsbg9K5Y.flv
C:\Users\aETAdzjz\Videos\tv69RzODWbz\PpXjn2XU7Asf2rJvp1.swf
C:\Users\aETAdzjz\Videos\tv69RzODWbz\TOvs X.mkv
C:\Users\aETAdzjz\Videos\tv69RzODWbz\VSqhPzEjq.swf
C:\Users\aETAdzjz\Videos\tv69RzODWbz\ynJYfoUGb5P1I.swf
C:\Users\aETAdzjz\Videos\vt5ZJiiJ.swf
C:\Users\aETAdzjz\Videos\xsMj_xTdMzMc_.flv
C:\Users\aETAdzjz\Videos\zNfOvJaANUNRELTBi.avi

Virtual Machine Information

System Information

Software Information

Randomly Created Artifacts

Before

After