Dynamic Analysis Report |
Classification: Keylogger, Spyware, Downloader |
dba40065b6efc6ae10e26ba608817ff04bdbc976e07016d78d0b4a63492e3ae4 (SHA256)
educat.exe
Created at 2018-11-06 11:23:00
Notifications (2/3)
The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.
The operating system was rebooted during the analysis.
Virtual Machine Information
Name | win10_64 |
Description | - |
Architecture | x86 64-bit |
Operating System | Windows 10 Threshold 1 |
Kernel Version | 10.0.10240.16384 (c68ee22f-dcf6-4778-95c5-4a862be16567) |
System Information
Computer Name | LHNIWSJ |
User Domain | LHNIWSJ |
User Name | CIiHmnxMn6Ps |
User Profile | C:\Users\CIiHmnxMn6Ps |
Temp Directory | C:\Users\CIIHMN~1\AppData\Local\Temp |
System Root | C:\Windows |
Sample Directory | C:\Users\CIiHmnxMn6Ps\Desktop |
Software Information
Adobe Acrobat Reader Version | 18.009.20050 |
Microsoft Office | 2016 |
Microsoft Office Version | 16.0.10228.20134 |
Internet Explorer Version | 11.0.10240.16384 |
Chrome Version | 58.0.3029.110 |
Firefox Version | 53.0.3 |
Flash Version | 25.0.0.148 |
Java Version | 8.0.1310.11 |
Microsoft Project Version | 16.0.10228.20134 |
Microsoft Visio Version | 16.0.10228.20134 |
Randomly Created Artifacts
This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.
Filename | PID | GUI |
---|---|---|
C:\Program Files (x86)\Adobe\immediatecustomerrecommendation.exe | #424 | |
C:\Program Files (x86)\Google\essentials.exe | #880 | |
C:\Program Files (x86)\Internet Explorer\uni_likely_strap.exe | #2284 | |
C:\Program Files (x86)\MSBuild\isolated-latinas.exe | #1520 | |
C:\Program Files (x86)\Microsoft.NET\jul.exe | #1480 | |
C:\Program Files (x86)\Mozilla Maintenance Service\markets.exe | #2688 | |
C:\Program Files (x86)\Windows Photo Viewer\movie.exe | #1472 | |
C:\Program Files (x86)\Windows Photo Viewer\sponsoredreservoir.exe | #1972 | |
C:\Program Files (x86)\Windows Portable Devices\indian.exe | #1960 | |
C:\Program Files (x86)\Windows Portable Devices\mad.exe | #1932 | |
C:\Program Files (x86)\WindowsPowerShell\downloaded.exe | #1956 | |
C:\Program Files (x86)\WindowsPowerShell\skiing-layer.exe | #1560 | |
C:\Program Files\Internet Explorer\sitemap_replication_special.exe | #1924 | |
C:\Program Files\Uninstall Information\relating-endangered.exe | #240 | |
C:\Program Files\Uninstall Information\takes-textbooks.exe | #1072 | |
C:\Program Files\Windows Journal\proportionbrochuresenjoying.exe | #1052 | |
C:\Program Files\Windows Media Player\relatively-privacy-ro.exe | #2856 | |
C:\Program Files\Windows NT\amsterdam_trade_riders.exe | #2188 | |
C:\Program Files\Windows NT\conversations_obituaries.exe | #592 | |
C:\Program Files\Windows Photo Viewer\deliverreason.exe | #3052 | |
C:\Program Files\Windows Photo Viewer\floors_individually.exe | #2336 |
Filename |
---|
C:\Users\CIIHMN~1\AppData\Local\Temp\--X LC5aIxklE5YRHLD.gif |
C:\Users\CIIHMN~1\AppData\Local\Temp\8jvtOB.mp4 |
C:\Users\CIIHMN~1\AppData\Local\Temp\CN-Cv.swf |
C:\Users\CIIHMN~1\AppData\Local\Temp\DBo iWlIGJ.wav |
C:\Users\CIIHMN~1\AppData\Local\Temp\DKJNOG.swf |
C:\Users\CIIHMN~1\AppData\Local\Temp\Hn73vbw54NElCNinUkZ.jpg |
C:\Users\CIIHMN~1\AppData\Local\Temp\K4Ahvr8W.avi |
C:\Users\CIIHMN~1\AppData\Local\Temp\KHQLieWLIccK.gif |
C:\Users\CIIHMN~1\AppData\Local\Temp\LQ-qaA9X DnE4wx.mp3 |
C:\Users\CIIHMN~1\AppData\Local\Temp\QVDxWdJDZK.png |
C:\Users\CIIHMN~1\AppData\Local\Temp\QoZm73-KkTYDjOfeL_vM.swf |
C:\Users\CIIHMN~1\AppData\Local\Temp\RYPxBFf-iOrGPOVfwG.mp3 |
C:\Users\CIIHMN~1\AppData\Local\Temp\RaikE-PfrLa.rtf |
C:\Users\CIIHMN~1\AppData\Local\Temp\SXNpQlUBhZi.m4a |
C:\Users\CIIHMN~1\AppData\Local\Temp\TlBKDdLrXqzMuhrip.gif |
C:\Users\CIIHMN~1\AppData\Local\Temp\UJR1rp7en3v0pl2.mp4 |
C:\Users\CIIHMN~1\AppData\Local\Temp\XAwZrW5WkJdk6cK.png |
C:\Users\CIIHMN~1\AppData\Local\Temp\__2DHQnpp_IDBnl.mkv |
C:\Users\CIIHMN~1\AppData\Local\Temp\_gBRjxTIrgzZQm2Hs_Mk.mp3 |
C:\Users\CIIHMN~1\AppData\Local\Temp\_vhJTmQALhIxv1PLUA.png |
C:\Users\CIIHMN~1\AppData\Local\Temp\fjHv04rj.mp3 |
C:\Users\CIIHMN~1\AppData\Local\Temp\gor8d-F_SeVAC.ppt |
C:\Users\CIIHMN~1\AppData\Local\Temp\i9pGCN4RZizUFn.bmp |
C:\Users\CIIHMN~1\AppData\Local\Temp\iUodPdaQzmm3HlMRUm4Z.png |
C:\Users\CIIHMN~1\AppData\Local\Temp\j2orNgPCZKdmM6D6u6f.odp |
C:\Users\CIIHMN~1\AppData\Local\Temp\nZFm 21QvnAX4Yp682FB.png |
C:\Users\CIIHMN~1\AppData\Local\Temp\nvYgKK4TIJ7eA.bmp |
C:\Users\CIIHMN~1\AppData\Local\Temp\pBtc36qiPfkl.gif |
C:\Users\CIIHMN~1\AppData\Local\Temp\v0ffX4rLZ8G9MsUqn.mp4 |
C:\Users\CIIHMN~1\AppData\Local\Temp\vwqoe9Qu-hbo4Rt51.flv |
C:\Users\CIIHMN~1\AppData\Local\Temp\x8b dKBKwlI5Hib.jpg |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1CHzw2Rx2S_zW_tQ.mkv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1o2T0sbYBt _ogxAgQ.ods |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3OJxxNMW9VSj345koant.jpg |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\4xHiScMFN.bmp |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\B-502EY5C9UH.wav |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\C48bUUv yj.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\DWnlEGvc2f7UXCtx_.bmp |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\FhGeOaOQMWabsmGgFl.wav |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\GoG6DuMvfigVwZ5HN.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Gsylrs03CL3GLNS7.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\H8OzFZYizyKnodY.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\IGJ3NBnqssg16hi SSM.avi |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\KZfC90mB7_N-.odt |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\OXyJ05by_o8b.ppt |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\PHhd.gif |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\PXbiH9YgQBkGltJ8z.wav |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\PhWSXmP1Wm.wav |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Q4qIm6svZGWy.flv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RVLgYr4s9y-.jpg |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\St fvzUP4rdpSb04xA6x.odp |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\UB9tkW9O.flv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\UE6THBGjpY_8gY8vG.swf |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Vs-NDuVEbvTmK.rtf |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\_g5YCDzmaG.bmp |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\_wni1TzdLgrvtEwe2.doc |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\_yQNru_weo.mkv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\aArNAcQ.mkv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\bGwYD.ods |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\f0BwoIlf9Ne0W.ots |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\hgg0.swf |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\kvV5eFc.pdf |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\pIviRLCh8VA.wav |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ppbprB.ots |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\v8FjJ3V3TSdho.png |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\y7-MQ-tUG3UAv.wav |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ydDImiJA.rtf |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\yjULLgB_zB7hpMpFV.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\-YvWj1fwStG.wav |
C:\Users\CIiHmnxMn6Ps\Desktop\3i_Obgb9P_hr_Np.mp4 |
C:\Users\CIiHmnxMn6Ps\Desktop\4foMts_FCmUFOTLB9 X.png |
C:\Users\CIiHmnxMn6Ps\Desktop\5RiP.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\68QPxo2pG.wav |
C:\Users\CIiHmnxMn6Ps\Desktop\7iKnrdP.mkv |
C:\Users\CIiHmnxMn6Ps\Desktop\BpYvjYL7RayaX2v3.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\Bs_mCLD9aPchKXV.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\Dl2ia8NFN.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\Fq0rKHVnuC_Vqe.mp4 |
C:\Users\CIiHmnxMn6Ps\Desktop\G1irVvT3nVin6rLY.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\JRGEWfVVGi.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\LYdsrkS.xlsx |
C:\Users\CIiHmnxMn6Ps\Desktop\M-r GKp.flv |
C:\Users\CIiHmnxMn6Ps\Desktop\MM1CsMQ.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\MqGI6YETiM.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\OClEnyZo.doc |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6 |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\-D879mVI4tn4ERy9.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\-avYJVSyd.swf |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\2pt_egWwI5bcmRQxSJ.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\JoAaSmPE.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\M-UtVjvvkG9g7iWkck3D.mkv |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\RJVQXUj.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\dJm5U.flv |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\gEAO0X3Vaayl6OX.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\ivJPWQpD.csv |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\lER0tfAaF46gu.xlsx |
C:\Users\CIiHmnxMn6Ps\Desktop\SeDeEKBYpNG1Tgv6\sTKyUWMJNnJYxS05.ods |
C:\Users\CIiHmnxMn6Ps\Desktop\TJDwLZfKzJ2n6hhX.png |
C:\Users\CIiHmnxMn6Ps\Desktop\VIyzvZmQU1iY_LN Pe.png |
C:\Users\CIiHmnxMn6Ps\Desktop\VMvKW.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\W5QD0_Oa rf.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\YOy.wav |
C:\Users\CIiHmnxMn6Ps\Desktop\aHOxPLOMQoS.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\bR5Vrcgr-wSSm.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\dfUDxltDGPa.csv |
C:\Users\CIiHmnxMn6Ps\Desktop\eT6_tpj5iSZjn11jY.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\hDmr4jKN6RKxZHOkwaVB.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\lK4QgLiQfwDPagfh4.mp4 |
C:\Users\CIiHmnxMn6Ps\Desktop\qId2I-jlNJAuFp9 MNS.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\th6dCz IGMk.ots |
C:\Users\CIiHmnxMn6Ps\Desktop\uNrMIqEj03AQbwb.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\yK 7Q33HVsQ8QvBi7gL.png |
C:\Users\CIiHmnxMn6Ps\Desktop\zQ5a.swf |
C:\Users\CIiHmnxMn6Ps\Documents\1tOTnsvy4N.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\3uH8.docx |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1 |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\6qZ6qHJny0JO4qAx6K5 |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\6qZ6qHJny0JO4qAx6K5\-2QmIk.odt |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\6qZ6qHJny0JO4qAx6K5\DSLU6yvN6wS_Ab.pdf |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\6qZ6qHJny0JO4qAx6K5\JMx7n.odt |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\6qZ6qHJny0JO4qAx6K5\RyyMCz.ppt |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\6qZ6qHJny0JO4qAx6K5\S Bmh.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\6qZ6qHJny0JO4qAx6K5\U0PxwOQirmvMH7QoyU.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\6qZ6qHJny0JO4qAx6K5\WZfTyE5gh.xls |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\CJwXY.ots |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\GEBlaKkv8.ppt |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\e1C9lWyLZOGM.pdf |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\jUb1NBvd5p2nJdeoQU.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\lbyCC_TVldY1lup.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\EHP8OfZ1\tzCEhn3W_ME9i4Cm6ZF.csv |
C:\Users\CIiHmnxMn6Ps\Documents\EOWKqr W4T.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\IHMPmeuqX0BC0QyQQ_.docx |
C:\Users\CIiHmnxMn6Ps\Documents\Jleegv.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\L_IU_-.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\N9cRjDXngs nx2L2Ch.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\PmdSRcllqNQ5o.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\RRkZSizQ NwhVbG4kl0.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\Vx2NdQYZCCEE6j.docx |
C:\Users\CIiHmnxMn6Ps\Documents\c4F5RcKP.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\dRY3OU-6tN.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\djgIca.docx |
C:\Users\CIiHmnxMn6Ps\Documents\gFAKFLS |
C:\Users\CIiHmnxMn6Ps\Documents\gFAKFLS\2kqeyeb4tK7WWT6.ods |
C:\Users\CIiHmnxMn6Ps\Documents\gFAKFLS\5yPyRBza14jgwbZ.doc |
C:\Users\CIiHmnxMn6Ps\Documents\gFAKFLS\BYWvjV7cz1rY.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\gFAKFLS\Ib2VKoPUPX6.odp |
C:\Users\CIiHmnxMn6Ps\Documents\gFAKFLS\YFfXS7hk.docx |
C:\Users\CIiHmnxMn6Ps\Documents\gt8m_1doCtxXq2yN.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\iqHoutTQgt5t.docx |
C:\Users\CIiHmnxMn6Ps\Documents\jhDHPtyDdiRab.docx |
C:\Users\CIiHmnxMn6Ps\Documents\kdBm82K1Pd-W09-w.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\knDdzxmL5ZAnL0.odt |
C:\Users\CIiHmnxMn6Ps\Documents\nWUvcLO_Yz.csv |
C:\Users\CIiHmnxMn6Ps\Documents\pbnJ4kjIVcGhC95IFN.docx |
C:\Users\CIiHmnxMn6Ps\Documents\rEWywO8ZBUvR X.pdf |
C:\Users\CIiHmnxMn6Ps\Documents\t8Yf PNsNP.ots |
C:\Users\CIiHmnxMn6Ps\Documents\yezi i.pptx |
C:\Users\CIiHmnxMn6Ps\Music\OCh3ljiFm7Shyx1j.wav |
C:\Users\CIiHmnxMn6Ps\Music\Xu5qqnDlxeB9rT6DJi.wav |
C:\Users\CIiHmnxMn6Ps\Music\fYwA |
C:\Users\CIiHmnxMn6Ps\Music\fYwA\31MeeXfoCH.wav |
C:\Users\CIiHmnxMn6Ps\Music\fYwA\4Ryvuj33dWK.m4a |
C:\Users\CIiHmnxMn6Ps\Music\fYwA\4u3E1axJ6c8acKig.wav |
C:\Users\CIiHmnxMn6Ps\Music\fYwA\9jb_WX7EkqofH.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\fYwA\JQhndPoqv |
C:\Users\CIiHmnxMn6Ps\Music\fYwA\JQhndPoqv\Pu67gos35V2vQa-8ChU.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\fYwA\JQhndPoqv\W_CwX ps7s.m4a |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth\4bMnW0pkdROcZqCZbZ7Z |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth\4bMnW0pkdROcZqCZbZ7Z\4Lo02O.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth\4bMnW0pkdROcZqCZbZ7Z\M4pMWx5-LbO3.wav |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth\4bMnW0pkdROcZqCZbZ7Z\bLUxsQ_a49SzxXWbO.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth\4bMnW0pkdROcZqCZbZ7Z\l2RoB1IC.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth\HaX_d_ 1jQfXqqY |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth\HaX_d_ 1jQfXqqY\V37oxh.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth\HaX_d_ 1jQfXqqY\m7JQ3Ed.wav |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth\ksj0BdD4l MGq9v.m4a |
C:\Users\CIiHmnxMn6Ps\Music\gIRgw_8WSrkcQth\nzm4mtqlR7rAgY9I.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\j45BCLwtQjl5-BOh |
C:\Users\CIiHmnxMn6Ps\Music\j45BCLwtQjl5-BOh\3y9-0UXlRJ9O5.m4a |
C:\Users\CIiHmnxMn6Ps\Music\j45BCLwtQjl5-BOh\RdZxw3 CJM3qeI0e8.wav |
C:\Users\CIiHmnxMn6Ps\Music\j45BCLwtQjl5-BOh\qREoZTEI7pU.m4a |
C:\Users\CIiHmnxMn6Ps\Music\lsKq OiO.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\mZ98kGUTD |
C:\Users\CIiHmnxMn6Ps\Music\mZ98kGUTD\5RZ6XL8mGvv.wav |
C:\Users\CIiHmnxMn6Ps\Music\mZ98kGUTD\Guoje |
C:\Users\CIiHmnxMn6Ps\Music\mZ98kGUTD\Guoje\DTcAnX9I.wav |
C:\Users\CIiHmnxMn6Ps\Music\mZ98kGUTD\Guoje\NdZHl0.m4a |
C:\Users\CIiHmnxMn6Ps\Music\mZ98kGUTD\Guoje\ccJVgOe.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\mZ98kGUTD\Guoje\rTL6kfcI 7XmLgUBik9.m4a |
C:\Users\CIiHmnxMn6Ps\Music\mZ98kGUTD\Guoje\xnqz3X5jRP.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\mZ98kGUTD\u8xQiUg7PUp9.m4a |
C:\Users\CIiHmnxMn6Ps\Music\mZ98kGUTD\zBMIzDQop.m4a |
C:\Users\CIiHmnxMn6Ps\Pictures\2F3N8mDO2tq527fPl.png |
C:\Users\CIiHmnxMn6Ps\Pictures\KTo Pb |
C:\Users\CIiHmnxMn6Ps\Pictures\KTo Pb\ZimYctXS_CgR9x |
C:\Users\CIiHmnxMn6Ps\Pictures\KTo Pb\ZimYctXS_CgR9x\2QyF7ZuqsP96 |
C:\Users\CIiHmnxMn6Ps\Pictures\KTo Pb\ZimYctXS_CgR9x\2QyF7ZuqsP96\4VKimT_AWF.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\KTo Pb\ZimYctXS_CgR9x\2QyF7ZuqsP96\E7YF7qG7_.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\KTo Pb\ZimYctXS_CgR9x\2QyF7ZuqsP96\dX07oo.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\KTo Pb\ZimYctXS_CgR9x\2QyF7ZuqsP96\jeXpUbtydia9VMUmj.png |
C:\Users\CIiHmnxMn6Ps\Pictures\KTo Pb\ZimYctXS_CgR9x\2QyF7ZuqsP96\u6EWQaZyK XZn-zpzOr.png |
C:\Users\CIiHmnxMn6Ps\Pictures\KTo Pb\ZimYctXS_CgR9x\9wMyOuV5.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\MDla.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\XOcW4v00SOnQ.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\_9p-2skQvOTn |
C:\Users\CIiHmnxMn6Ps\Pictures\_9p-2skQvOTn\DUXYL3Vq N.png |
C:\Users\CIiHmnxMn6Ps\Pictures\_9p-2skQvOTn\EspZs1_cRrR093PF2.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\_9p-2skQvOTn\n0A-RQxD.png |
C:\Users\CIiHmnxMn6Ps\Pictures\aR7ZgL13zpAepDagB8.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\OAjcCjsyNIOMMhZ.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\WzdNQ46VJ |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\WzdNQ46VJ\ZAr3 |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\WzdNQ46VJ\ZAr3\rSa0I.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\WzdNQ46VJ\ZAr3\yOxqWD.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\WzdNQ46VJ\o0KMGy |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\WzdNQ46VJ\o0KMGy\_UfEOHhx.png |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\WzdNQ46VJ\otS_Cdg1cysOXsec7D |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\WzdNQ46VJ\otS_Cdg1cysOXsec7D\zv3rvCPSqZ0UXIY0vXnb.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\d0dTL3cOlMSMaD.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\exdkwGoCVt.png |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\fudOZ8 |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\fudOZ8\-bzgm01AIKA.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\fudOZ8\6duzYmb8BUhG_gKo.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\fudOZ8\A6veaSoLvC tChN.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\lm4RU9H\fudOZ8\kYaH ojlA2tFe.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\uBQCcpff4o5DF3swip.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\yS0lkX2JGPw67Vr9hd.png |
C:\Users\CIiHmnxMn6Ps\Videos\--xgOi |
C:\Users\CIiHmnxMn6Ps\Videos\--xgOi\CtGnHOISV0oU-lHOC.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\--xgOi\EBODPL.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\--xgOi\KkD9S5nNGV58oU4KIlL.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\--xgOi\QDhkKCHXA.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\--xgOi\uGgDRZcw4rUbnlNmL.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8 |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\4MjeLfzkO.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\51XsjOR JGvaK zf w.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\GnwopAi47E6FemMiGy |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\GnwopAi47E6FemMiGy\KlQ69l1Q171.flv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\GnwopAi47E6FemMiGy\h77kTAsSlkuhY49.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\GnwopAi47E6FemMiGy\hxJmy.flv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\Rr_r0iV.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\ZelbMh.flv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\a2EjztsFfYh.swf |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6 |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\6sItUQxFwWkAW.flv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\IKN9pA.swf |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\IoF_OIIZChkqMDG.swf |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\YC5_irFPl_W5-15g7.flv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\c2dcgqS2MKH10.avi |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\emAbWKd-xX.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\oz523GRD9SdN4s.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\vnas |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\vnas\8293WcCbLbskQUhZj.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\vnas\MrDeH SEc6aB.swf |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\vnas\PCb8QMczb5BIw1L.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\hMbV6\vnas\uGcJyvjgm.flv |
C:\Users\CIiHmnxMn6Ps\Videos\5is_ZZyj8\wcSSkypYfMYA1VuOkg.avi |
C:\Users\CIiHmnxMn6Ps\Videos\nIuCI8ltzEsrpCI_ |
C:\Users\CIiHmnxMn6Ps\Videos\nIuCI8ltzEsrpCI_\EWSfDUPnp15EMUaKrN.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\nIuCI8ltzEsrpCI_\GQH6yeB.swf |
C:\Users\CIiHmnxMn6Ps\Videos\nIuCI8ltzEsrpCI_\P7PIah XsqxcLtrZ_xlb.flv |