ee5ebb71...e7ef | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 91/100
Target: win7_64_sp1 | exe
Classification: Trojan, Dropper, Ransomware

ee5ebb71405d500052076c8e1885555de9414454839e9c26a2746b1cc97fe7ef (SHA256)

KryptoTrojaner.exe

Windows Exe (x86-32)

Created at 2018-07-01 18:25:00

...
Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x964 Analysis Target High (Elevated) kryptotrojaner.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe" -
#2 0xa44 Child Process High (Elevated) templanran.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\TempLanRan.exe" #1
#3 0xa4c Child Process High (Elevated) temprunsom.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temprunsom.exe" #1
#4 0xa58 Child Process High (Elevated) notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt #1

Behavior Information - Grouped by Category

Process #1: kryptotrojaner.exe
134 0
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\kryptotrojaner.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:31, Reason: Analysis Target
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:02:04
OS Process Information
»
Information Value
PID 0x964
Parent PID 0x564 (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 968
0x 974
0x 978
0x 97C
0x A34
0x A38
0x A3C
0x A40
0x A54
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory Readable True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False -
private_0x00000000000c0000 0x000c0000 0x000c0fff Private Memory Readable, Writable True False False -
pagefile_0x00000000000d0000 0x000d0000 0x000d0fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000000e0000 0x000e0000 0x000e2fff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x00000000000f0000 0x000f0000 0x000f0fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000100000 0x00100000 0x0011ffff Private Memory - True False False -
private_0x0000000000120000 0x00120000 0x0012ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000130000 0x00130000 0x00130fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000140000 0x00140000 0x001bffff Private Memory Readable, Writable True False False -
l_intl.nls 0x001c0000 0x001c2fff Memory Mapped File Readable False False False -
pagefile_0x00000000001d0000 0x001d0000 0x001d0fff Pagefile Backed Memory Readable True False False -
private_0x00000000001e0000 0x001e0000 0x001effff Private Memory Readable, Writable True False False -
private_0x00000000001f0000 0x001f0000 0x002effff Private Memory Readable, Writable True False False -
private_0x00000000002f0000 0x002f0000 0x003effff Private Memory Readable, Writable True False False -
private_0x00000000003f0000 0x003f0000 0x004effff Private Memory Readable, Writable True False False -
rpcss.dll 0x004f0000 0x0056cfff Memory Mapped File Readable False False False -
private_0x00000000004f0000 0x004f0000 0x004fffff Private Memory Readable, Writable True False False -
windowsshell.manifest 0x004f0000 0x004f0fff Memory Mapped File Readable False False False -
pagefile_0x00000000004f0000 0x004f0000 0x004f1fff Pagefile Backed Memory Readable True False False -
private_0x0000000000500000 0x00500000 0x0050ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000500000 0x00500000 0x00501fff Pagefile Backed Memory Readable True False False -
sorttbls.nlp 0x00510000 0x00514fff Memory Mapped File Readable False False False -
sortkey.nlp 0x00520000 0x00560fff Memory Mapped File Readable False False False -
private_0x0000000000570000 0x00570000 0x0057ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000580000 0x00580000 0x00580fff Pagefile Backed Memory Readable True False False -
private_0x0000000000580000 0x00580000 0x0058ffff Private Memory Readable, Writable True False False -
private_0x0000000000590000 0x00590000 0x0060ffff Private Memory Readable, Writable, Executable True False False -
pagefile_0x0000000000610000 0x00610000 0x00797fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000007a0000 0x007a0000 0x00920fff Pagefile Backed Memory Readable True False False -
mscorrc.dll 0x00930000 0x00983fff Memory Mapped File Readable True False False -
private_0x0000000000990000 0x00990000 0x0099ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000990000 0x00990000 0x00990fff Pagefile Backed Memory Readable True False False -
private_0x00000000009a0000 0x009a0000 0x00a1ffff Private Memory Readable, Writable, Executable True False False -
pagefile_0x0000000000a20000 0x00a20000 0x00afefff Pagefile Backed Memory Readable True False False -
private_0x0000000000b00000 0x00b00000 0x00b0ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000b00000 0x00b00000 0x00b00fff Pagefile Backed Memory Readable True False False -
private_0x0000000000b10000 0x00b10000 0x00b1ffff Private Memory Readable, Writable True False False -
private_0x0000000000b20000 0x00b20000 0x00c1ffff Private Memory Readable, Writable True False False -
private_0x0000000000c20000 0x00c20000 0x00d20fff Private Memory Readable, Writable True False False -
pagefile_0x0000000000d30000 0x00d30000 0x00d40fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000d50000 0x00d50000 0x00d5ffff Private Memory Readable, Writable True False False -
cversions.1.db 0x00d50000 0x00d53fff Memory Mapped File Readable True False False -
pagefile_0x0000000000d60000 0x00d60000 0x00d61fff Pagefile Backed Memory Readable True False False -
private_0x0000000000d70000 0x00d70000 0x00d7ffff Private Memory Readable, Writable True False False -
private_0x0000000000d80000 0x00d80000 0x00dbffff Private Memory Readable, Writable True False False -
gdipfontcachev1.dat 0x00dc0000 0x00ddafff Memory Mapped File Readable, Writable True True False
...
{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db 0x00dc0000 0x00ddefff Memory Mapped File Readable True False False -
private_0x0000000000de0000 0x00de0000 0x00edffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x00ee0000 0x011aefff Memory Mapped File Readable False False False -
private_0x00000000011b0000 0x011b0000 0x012affff Private Memory Readable, Writable True False False -
private_0x00000000012b0000 0x012b0000 0x012fffff Private Memory Readable, Writable True False False -
private_0x00000000012b0000 0x012b0000 0x012bffff Private Memory Readable, Writable True False False -
pagefile_0x00000000012c0000 0x012c0000 0x012e2fff Pagefile Backed Memory Readable, Writable True False False -
private_0x00000000012f0000 0x012f0000 0x012fffff Private Memory Readable, Writable True False False -
kryptotrojaner.exe 0x01330000 0x0136bfff Memory Mapped File Readable, Writable, Executable True True False
...
pagefile_0x0000000001370000 0x01370000 0x0276ffff Pagefile Backed Memory Readable True False False -
private_0x0000000002770000 0x02770000 0x1a76ffff Private Memory Readable, Writable True False False -
private_0x000000001a770000 0x1a770000 0x1ae3ffff Private Memory Readable, Writable True False False -
private_0x000000001ae50000 0x1ae50000 0x1af4ffff Private Memory Readable, Writable True False False -
private_0x000000001af50000 0x1af50000 0x1b16ffff Private Memory Readable, Writable True False False -
private_0x000000001af50000 0x1af50000 0x1b04ffff Private Memory Readable, Writable True False False -
micross.ttf 0x1b050000 0x1b0effff Memory Mapped File Readable False False False -
segoeui.ttf 0x1b050000 0x1b0cefff Memory Mapped File Readable False False False -
private_0x000000001b0f0000 0x1b0f0000 0x1b16ffff Private Memory Readable, Writable True False False -
private_0x000000001b1d0000 0x1b1d0000 0x1b2cffff Private Memory Readable, Writable True False False -
private_0x000000001b300000 0x1b300000 0x1b3fffff Private Memory Readable, Writable True False False -
tahoma.ttf 0x1b400000 0x1b4aafff Memory Mapped File Readable False False False -
msjh.ttf 0x1b400000 0x1c8a8fff Memory Mapped File Readable False False False -
msyh.ttf 0x1b400000 0x1c8c2fff Memory Mapped File Readable False False False -
malgun.ttf 0x1b400000 0x1b822fff Memory Mapped File Readable False False False -
private_0x000000001b410000 0x1b410000 0x1b41ffff Private Memory Readable, Writable True False False -
private_0x000000001b420000 0x1b420000 0x1b42ffff Private Memory Readable, Writable True False False -
private_0x000000001b430000 0x1b430000 0x1b43ffff Private Memory Readable, Writable True False False -
private_0x000000001b450000 0x1b450000 0x1b45ffff Private Memory Readable, Writable True False False -
private_0x000000001b530000 0x1b530000 0x1b72ffff Private Memory Readable, Writable True False False -
private_0x000000001b7d0000 0x1b7d0000 0x1b7dffff Private Memory Readable, Writable True False False -
private_0x000000001b830000 0x1b830000 0x1ba2ffff Private Memory Readable, Writable True False False -
private_0x000000001ba30000 0x1ba30000 0x1bc2ffff Private Memory Readable, Writable True False False -
private_0x000000001ba30000 0x1ba30000 0x1bb2ffff Private Memory Readable, Writable True False False -
private_0x000000001bbb0000 0x1bbb0000 0x1bc2ffff Private Memory Readable, Writable True False False -
msvcr80.dll 0x757b0000 0x75878fff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x77a30000 0x77b4efff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x77b50000 0x77c49fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77c50000 0x77df8fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
culture.dll 0x642ff4a0000 0x642ff4a9fff Memory Mapped File Readable, Writable, Executable True False False -
system.runtime.remoting.ni.dll 0x7fef0a10000 0x7fef0b0cfff Memory Mapped File Readable, Writable, Executable True False False -
system.windows.forms.ni.dll 0x7fef0b10000 0x7fef1ba5fff Memory Mapped File Readable, Writable, Executable True False False -
system.drawing.ni.dll 0x7fef1bb0000 0x7fef1de6fff Memory Mapped File Readable, Writable, Executable True False False -
mscorjit.dll 0x7fef1df0000 0x7fef1f73fff Memory Mapped File Readable, Writable, Executable True False False -
system.ni.dll 0x7fef1f80000 0x7fef29a2fff Memory Mapped File Readable, Writable, Executable True False False -
mscorlib.ni.dll 0x7fef29b0000 0x7fef388bfff Memory Mapped File Readable, Writable, Executable True False False -
mscorwks.dll 0x7fef3890000 0x7fef422cfff Memory Mapped File Readable, Writable, Executable True False False -
microsoft.visualbasic.ni.dll 0x7fef4370000 0x7fef457cfff Memory Mapped File Readable, Writable, Executable True False False -
mscoreei.dll 0x7fef4580000 0x7fef4618fff Memory Mapped File Readable, Writable, Executable True False False -
mscoree.dll 0x7fef82a0000 0x7fef830efff Memory Mapped File Readable, Writable, Executable True False False -
dwmapi.dll 0x7fefc090000 0x7fefc0a7fff Memory Mapped File Readable, Writable, Executable False False False -
gdiplus.dll 0x7fefc2a0000 0x7fefc4b4fff Memory Mapped File Readable, Writable, Executable False False False -
uxtheme.dll 0x7fefc4c0000 0x7fefc515fff Memory Mapped File Readable, Writable, Executable False False False -
propsys.dll 0x7fefc520000 0x7fefc64bfff Memory Mapped File Readable, Writable, Executable False False False -
comctl32.dll 0x7fefc670000 0x7fefc863fff Memory Mapped File Readable, Writable, Executable False False False -
ntmarta.dll 0x7fefcb60000 0x7fefcb8cfff Memory Mapped File Readable, Writable, Executable False False False -
version.dll 0x7fefcd60000 0x7fefcd6bfff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x7fefda90000 0x7fefda9efff Memory Mapped File Readable, Writable, Executable False False False -
profapi.dll 0x7fefdba0000 0x7fefdbaefff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x7fefde60000 0x7fefdecafff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x7fefdf70000 0x7fefe172fff Memory Mapped File Readable, Writable, Executable False False False -
shell32.dll 0x7fefe180000 0x7fefef07fff Memory Mapped File Readable, Writable, Executable False False False -
clbcatq.dll 0x7fefef10000 0x7fefefa8fff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x7fefefb0000 0x7feff0dcfff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x7feff210000 0x7feff2aefff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x7feff2b0000 0x7feff38afff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x7feff390000 0x7feff3aefff Memory Mapped File Readable, Writable, Executable False False False -
lpk.dll 0x7feff3b0000 0x7feff3bdfff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x7feff3c0000 0x7feff3edfff Memory Mapped File Readable, Writable, Executable False False False -
wldap32.dll 0x7feff730000 0x7feff781fff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x7feff910000 0x7feff976fff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x7feff980000 0x7feff9f0fff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x7feffa00000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x7feffb10000 0x7feffbe6fff Memory Mapped File Readable, Writable, Executable False False False -
usp10.dll 0x7feffe90000 0x7fefff58fff Memory Mapped File Readable, Writable, Executable False False False -
apisetschema.dll 0x7fefff70000 0x7fefff70fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x000007ff00030000 0x7ff00030000 0x7ff0003ffff Private Memory - True False False -
private_0x000007ff00040000 0x7ff00040000 0x7ff0004ffff Private Memory - True False False -
private_0x000007ff00050000 0x7ff00050000 0x7ff000effff Private Memory - True False False -
private_0x000007ff000f0000 0x7ff000f0000 0x7ff000fffff Private Memory - True False False -
private_0x000007ff00100000 0x7ff00100000 0x7ff0016ffff Private Memory - True False False -
private_0x000007ff00170000 0x7ff00170000 0x7ff0017ffff Private Memory - True False False -
private_0x000007ff00180000 0x7ff00180000 0x7ff001bffff Private Memory - True False False -
private_0x000007ff001c0000 0x7ff001c0000 0x7ff001cffff Private Memory - True False False -
private_0x000007ff001d0000 0x7ff001d0000 0x7ff001dffff Private Memory - True False False -
private_0x000007ff001e0000 0x7ff001e0000 0x7ff001effff Private Memory - True False False -
private_0x000007ff001f0000 0x7ff001f0000 0x7ff001fffff Private Memory - True False False -
private_0x000007fffff10000 0x7fffff10000 0x7fffff1ffff Private Memory Readable, Writable, Executable True False False -
private_0x000007fffff20000 0x7fffff20000 0x7fffffaffff Private Memory Readable, Writable, Executable True False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False -
private_0x000007fffffd5000 0x7fffffd5000 0x7fffffd6fff Private Memory Readable, Writable True False False -
private_0x000007fffffd7000 0x7fffffd7000 0x7fffffd8fff Private Memory Readable, Writable True False False -
private_0x000007fffffd9000 0x7fffffd9000 0x7fffffd9fff Private Memory Readable, Writable True False False -
private_0x000007fffffda000 0x7fffffda000 0x7fffffdbfff Private Memory Readable, Writable True False False -
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory Readable, Writable True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdffff Private Memory Readable, Writable True False False -
For performance reasons, the remaining 52 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
»
Filename File Size Hash Values YARA Match Actions
c:\users\5p5nrgjn0js halpmcxz\appdata\local\templanran.exe 29.00 KB MD5: 3061a661ff7b83f0e30952d06ee22ab9
SHA1: a11f06af9e3686751d6df821f0deb3068b0295f7
SHA256: 654f2cd5292c9a25567238840a0e6215e7e8ef87367d676b5eb25ddb71b03e4a 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temprunsom.exe 95.50 KB MD5: f11b9f67c1433c073599a27fc1ade14f
SHA1: f7d9bd50dfaa2a422e95f003cbd9de498c651a2a
SHA256: 38d8bcf1693be2705b2a5ba647c5371bc56ac2cbacc44e739aae33c282e1f583 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\@___readme___@.txt 1.65 KB MD5: f87c016123c15f7cc3b4c97e536700ef
SHA1: 0e1a9bc3d17bb350b4f2f138a8b0b97f4097f84a
SHA256: d4196e02e780632b134538a753282e2aa6eb7b1ddb4ac1a12ed860f53fcd53f1 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\@___readme___@.txt 1.65 KB MD5: 9213fb1b65565f8d5ca5857293d9dc52
SHA1: 10f33ba3f38f06b200f779358b3ed00ec8ce9b99
SHA256: cd67aa52d41b9f0189a76cb2a8256934075fa26df69886d9765d83fcdfa6674f 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
c:\users\5p5nrgjn0js halpmcxz\appdata\local\gdipfontcachev1.dat 106.27 KB MD5: 92e128dcb152d05f07faf5da64bd1c91
SHA1: 2174814ca563fc2b9679fffbf1b40bdf3ac9abec
SHA256: 11437a99f5f9c0a6df09c64abc8828ad3ecd8cf4fa601340ded86b8945edff43 		False
...
Host Behavior
File (42)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\TempLanRan.exe desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temprunsom.exe desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\cerberos\Desktop\INSTRUCTIONS.html desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.config desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.config type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp type = file_attributes True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\TempLanRan.exe type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temprunsom.exe type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt type = file_type True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorlib.dll type = file_attributes True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config type = file_type True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe type = file_attributes True 2
Fn
Get Info C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll type = file_attributes True 1
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll type = file_attributes True 1
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll type = file_attributes True 1
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll type = file_attributes True 1
Fn
Get Info C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Read C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config size = 4096, size_out = 4096 True 6
Fn
Data
Read C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config size = 4096, size_out = 554 True 1
Fn
Data
Read C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config size = 4096, size_out = 0 True 1
Fn
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\TempLanRan.exe size = 29696 True 1
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temprunsom.exe size = 97792 True 1
Fn
Data
Write C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt size = 1686 True 1
Fn
Data
Registry (3)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework value_name = DbgJITDebugLaunchSetting, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework value_name = DbgManagedDebugger, type = REG_NONE False 1
Fn
Process (3)
»
Operation Process Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\TempLanRan.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temprunsom.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt show_window = SW_SHOWNORMAL True 1
Fn
Module (18)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\user32.dll base_address = 0x77b50000 True 1
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\desktop\kryptotrojaner.exe base_address = 0x1330000 True 15
Fn
Get Filename c:\users\5p5nrgjn0js halpmcxz\desktop\kryptotrojaner.exe process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\kryptotrojaner.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe, size = 2048 True 1
Fn
Get Address c:\windows\system32\user32.dll function = DefWindowProcW, address_out = 0x77c7b0ac True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Window (12)
»
Operation Window Name Additional Information Success Count Logfile
Create - class_name = WindowsForms10.Window.8.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Create - class_name = WindowsForms10.Window.8.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Create .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0 class_name = .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0, wndproc_parameter = 0 True 1
Fn
Create - class_name = WindowsForms10.EDIT.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Create WindowsFormsParkingWindow class_name = WindowsForms10.Window.8.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Create - class_name = WindowsForms10.STATIC.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Create Microsoft .NET Framework class_name = WindowsForms10.Window.8.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Create - class_name = WindowsForms10.Window.8.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Create &Details class_name = WindowsForms10.BUTTON.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Create &Continue class_name = WindowsForms10.BUTTON.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Create &Quit class_name = WindowsForms10.BUTTON.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Create See the end of this message for details on invoking just-in-time (JIT) debugging instead of this dialog box. ************** Exception Text ************** System.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\Users\cerberos\Desktop\INSTRUCTIONS.html'. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize) at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding) at System.IO.File.WriteAllText(String path, String contents, Encoding encoding) at get.ranran.html() at get.ranran.Form1_Load(Object sender, EventArgs e) at System.EventHandler.Invoke(Object sender, EventArgs e) at System.Windows.Forms.Form.OnLoad(EventArgs e) at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible) at System.Windows.Forms.Control.CreateControl() at System.Windows.Forms.Control.WmShowWindow(Message& m) at System.Windows.Forms.Control.WndProc(Message& m) at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m) at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam) ************** Loaded Assemblies ************** mscorlib Assembly Version: 2.0.0.0 Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400) CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v2.0.50727/mscorlib.dll ---------------------------------------- get Assembly Version: 1.0.0.0 Win32 Version: 1.0.0.0 CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe ---------------------------------------- Microsoft.VisualBasic Assembly Version: 8.0.0.0 Win32 Version: 8.0.50727.5420 (Win7SP1.050727-5400) CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll ---------------------------------------- System Assembly Version: 2.0.0.0 Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400) CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll ---------------------------------------- System.Windows.Forms Assembly Version: 2.0.0.0 Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400) CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll ---------------------------------------- System.Drawing Assembly Version: 2.0.0.0 Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400) CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll ---------------------------------------- System.Runtime.Remoting Assembly Version: 2.0.0.0 Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400) CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll ---------------------------------------- 9ee08ca6-3f27-4b57-b8d0-4985d08ba511 Assembly Version: 1.0.0.0 Win32 Version: 1.0.0.0 CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe ---------------------------------------- ************** JIT Debugging ************** To enable just-in-time (JIT) debugging, the .config file for this application or computer (machine.config) must have the jitDebugging value set in the system.windows.forms section. The application must also be compiled with debugging enabled. For example: <configuration> <system.windows.forms jitDebugging="true" /> </configuration> When JIT debugging is enabled, any unhandled exception will be sent to the JIT debugger registered on the computer rather than be handled by this dialog box. class_name = WindowsForms10.EDIT.app.0.33c0d9d, wndproc_parameter = 0 True 1
Fn
Keyboard (26)
»
Operation Additional Information Success Count Logfile
Get Info type = KB_LOCALE_ID, os_tid = 0, result_out = 67699721 True 6
Fn
Read virtual_key_code = VK_LBUTTON, result_out = 0 True 1
Fn
Read virtual_key_code = VK_RBUTTON, result_out = 0 True 4
Fn
Read virtual_key_code = VK_MBUTTON, result_out = 0 True 4
Fn
Read virtual_key_code = VK_XBUTTON1, result_out = 0 True 4
Fn
Read virtual_key_code = VK_XBUTTON2, result_out = 0 True 4
Fn
Read virtual_key_code = VK_LBUTTON, result_out = 18446744073709551489 True 3
Fn
System (9)
»
Operation Additional Information Success Count Logfile
Get Cursor x_out = 591, y_out = 123 True 5
Fn
Get Info type = Operating System True 4
Fn
Process #2: templanran.exe
19 0
»
Information Value
ID #2
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\templanran.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\TempLanRan.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:02, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:33
OS Process Information
»
Information Value
PID 0xa44
Parent PID 0x964 (c:\users\5p5nrgjn0js halpmcxz\desktop\kryptotrojaner.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A48
0x A90
0x A98
0x A9C
0x AA0
0x AA4
0x AA8
0x AAC
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory Readable, Writable True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000070000 0x00070000 0x00070fff Pagefile Backed Memory Readable True False False -
private_0x0000000000080000 0x00080000 0x000fffff Private Memory Readable, Writable True False False -
locale.nls 0x00100000 0x00166fff Memory Mapped File Readable False False False -
pagefile_0x0000000000170000 0x00170000 0x00170fff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x0000000000180000 0x00180000 0x00180fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000190000 0x00190000 0x001cffff Private Memory Readable, Writable True False False -
private_0x00000000001d0000 0x001d0000 0x001dffff Private Memory - True False False -
private_0x00000000001e0000 0x001e0000 0x002dffff Private Memory Readable, Writable True False False -
private_0x00000000002e0000 0x002e0000 0x002effff Private Memory - True False False -
private_0x00000000002f0000 0x002f0000 0x002fffff Private Memory - True False False -
private_0x0000000000300000 0x00300000 0x0033ffff Private Memory Readable, Writable, Executable True False False -
private_0x0000000000340000 0x00340000 0x0034ffff Private Memory - True False False -
private_0x0000000000350000 0x00350000 0x0035ffff Private Memory - True False False -
private_0x0000000000360000 0x00360000 0x0036ffff Private Memory - True False False -
private_0x0000000000370000 0x00370000 0x0037ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000380000 0x00380000 0x00380fff Pagefile Backed Memory Readable, Writable True False False -
l_intl.nls 0x00390000 0x00392fff Memory Mapped File Readable False False False -
templanran.exe 0x003a0000 0x003adfff Memory Mapped File Readable, Writable, Executable True True False
...
pagefile_0x00000000003b0000 0x003b0000 0x003b0fff Pagefile Backed Memory Readable True False False -
private_0x00000000003c0000 0x003c0000 0x004bffff Private Memory Readable, Writable True False False -
private_0x00000000004c0000 0x004c0000 0x004cffff Private Memory Readable, Writable True False False -
private_0x00000000004d0000 0x004d0000 0x004dffff Private Memory - True False False -
private_0x00000000004e0000 0x004e0000 0x0051ffff Private Memory Readable, Writable True False False -
private_0x0000000000540000 0x00540000 0x0054ffff Private Memory Readable, Writable True False False -
rsaenh.dll 0x00550000 0x0058bfff Memory Mapped File Readable False False False -
private_0x0000000000590000 0x00590000 0x0059ffff Private Memory Readable, Writable True False False -
pagefile_0x00000000005a0000 0x005a0000 0x00727fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000730000 0x00730000 0x008b0fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000008c0000 0x008c0000 0x01cbffff Pagefile Backed Memory Readable True False False -
private_0x0000000001cc0000 0x01cc0000 0x01d5ffff Private Memory Readable, Writable True False False -
private_0x0000000001da0000 0x01da0000 0x01ddffff Private Memory Readable, Writable True False False -
private_0x0000000001e10000 0x01e10000 0x01e4ffff Private Memory Readable, Writable, Executable True False False -
private_0x0000000001e50000 0x01e50000 0x01f3ffff Private Memory Readable, Writable True False False -
private_0x0000000001f50000 0x01f50000 0x0204ffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x02050000 0x0231efff Memory Mapped File Readable False False False -
private_0x0000000002320000 0x02320000 0x0431ffff Private Memory Readable, Writable True False False -
private_0x0000000004320000 0x04320000 0x0435ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000004360000 0x04360000 0x0443efff Pagefile Backed Memory Readable True False False -
private_0x0000000004490000 0x04490000 0x044cffff Private Memory Readable, Writable True False False -
private_0x00000000044d0000 0x044d0000 0x045cffff Private Memory Readable, Writable True False False -
private_0x0000000004620000 0x04620000 0x0465ffff Private Memory Readable, Writable True False False -
private_0x00000000046e0000 0x046e0000 0x047dffff Private Memory Readable, Writable True False False -
private_0x00000000048c0000 0x048c0000 0x049bffff Private Memory Readable, Writable True False False -
private_0x0000000004a00000 0x04a00000 0x04afffff Private Memory Readable, Writable True False False -
system.ni.dll 0x730d0000 0x7386bfff Memory Mapped File Readable, Writable, Executable True False False -
mscorlib.ni.dll 0x73870000 0x74367fff Memory Mapped File Readable, Writable, Executable True False False -
rsaenh.dll 0x74ca0000 0x74cdafff Memory Mapped File Readable, Writable, Executable False False False -
cryptsp.dll 0x74ce0000 0x74cf5fff Memory Mapped File Readable, Writable, Executable False False False -
mscorwks.dll 0x74d00000 0x752aafff Memory Mapped File Readable, Writable, Executable True False False -
uxtheme.dll 0x752d0000 0x7534ffff Memory Mapped File Readable, Writable, Executable False False False -
wow64cpu.dll 0x75360000 0x75367fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x75370000 0x753cbfff Memory Mapped File Readable, Writable, Executable False False False -
wow64.dll 0x753d0000 0x7540efff Memory Mapped File Readable, Writable, Executable False False False -
rpcrtremote.dll 0x75410000 0x7541dfff Memory Mapped File Readable, Writable, Executable False False False -
microsoft.visualbasic.ni.dll 0x75420000 0x755bafff Memory Mapped File Readable, Writable, Executable True False False -
mscorjit.dll 0x755c0000 0x7561afff Memory Mapped File Readable, Writable, Executable True False False -
profapi.dll 0x75620000 0x7562afff Memory Mapped File Readable, Writable, Executable False False False -
msvcr80.dll 0x75630000 0x756cafff Memory Mapped File Readable, Writable, Executable False False False -
version.dll 0x756d0000 0x756d8fff Memory Mapped File Readable, Writable, Executable False False False -
mscoreei.dll 0x756e0000 0x75757fff Memory Mapped File Readable, Writable, Executable True False False -
mscoree.dll 0x75760000 0x757a9fff Memory Mapped File Readable, Writable, Executable True False False -
cryptbase.dll 0x75980000 0x7598bfff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x75990000 0x759effff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x75a30000 0x75a48fff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x75bb0000 0x75bf5fff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x75fd0000 0x760dffff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x760e0000 0x7617ffff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x76180000 0x761d6fff Memory Mapped File Readable, Writable, Executable False False False -
lpk.dll 0x763c0000 0x763c9fff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x763e0000 0x764dffff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x76670000 0x7671bfff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x76720000 0x767ebfff Memory Mapped File Readable, Writable, Executable False False False -
shell32.dll 0x76920000 0x77569fff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x77570000 0x775cffff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x775d0000 0x776bffff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x776c0000 0x7781bfff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x77820000 0x778affff Memory Mapped File Readable, Writable, Executable False False False -
usp10.dll 0x77990000 0x77a2cfff Memory Mapped File Readable, Writable, Executable False False False -
private_0x0000000077a30000 0x77a30000 0x77b4efff Private Memory Readable, Writable, Executable True False False -
private_0x0000000077b50000 0x77b50000 0x77c49fff Private Memory Readable, Writable, Executable True False False -
ntdll.dll 0x77c50000 0x77df8fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77e30000 0x77faffff Memory Mapped File Readable, Writable, Executable False False False -
private_0x000000007efa7000 0x7efa7000 0x7efa9fff Private Memory Readable, Writable True False False -
private_0x000000007efaa000 0x7efaa000 0x7efacfff Private Memory Readable, Writable True False False -
private_0x000000007efad000 0x7efad000 0x7efaffff Private Memory Readable, Writable True False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False -
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False -
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False -
Host Behavior
File (16)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows type = file_attributes True 16
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Info type = Operating System True 3
Fn
Process #3: temprunsom.exe
1607 0
»
Information Value
ID #3
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\local\temprunsom.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temprunsom.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:03, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:32
OS Process Information
»
Information Value
PID 0xa4c
Parent PID 0x964 (c:\users\5p5nrgjn0js halpmcxz\desktop\kryptotrojaner.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A50
0x A8C
0x A94
0x AE4
0x B24
0x B28
0x B2C
0x B30
0x B34
0x B38
0x B64
0x B68
0x B84
0x 5C4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000020000 0x00020000 0x00020fff Private Memory Readable, Writable True False False -
private_0x0000000000030000 0x00030000 0x00031fff Private Memory Readable, Writable True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory Readable, Writable True False False -
apisetschema.dll 0x00040000 0x00040fff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x0000000000050000 0x00050000 0x00053fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000060000 0x00060000 0x00060fff Pagefile Backed Memory Readable True False False -
private_0x0000000000070000 0x00070000 0x000affff Private Memory Readable, Writable, Executable True False False -
private_0x00000000000b0000 0x000b0000 0x0012ffff Private Memory Readable, Writable True False False -
locale.nls 0x00130000 0x00196fff Memory Mapped File Readable False False False -
pagefile_0x00000000001a0000 0x001a0000 0x001a0fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000001b0000 0x001b0000 0x001b0fff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x00000000001c0000 0x001c0000 0x001c0fff Pagefile Backed Memory Readable, Writable True False False -
private_0x00000000001d0000 0x001d0000 0x0020ffff Private Memory Readable, Writable True False False -
private_0x0000000000210000 0x00210000 0x0021ffff Private Memory - True False False -
private_0x0000000000220000 0x00220000 0x0022ffff Private Memory - True False False -
private_0x0000000000230000 0x00230000 0x0023ffff Private Memory - True False False -
private_0x0000000000240000 0x00240000 0x0024ffff Private Memory - True False False -
private_0x0000000000250000 0x00250000 0x0025ffff Private Memory - True False False -
private_0x0000000000260000 0x00260000 0x0026ffff Private Memory - True False False -
pagefile_0x0000000000270000 0x00270000 0x00270fff Pagefile Backed Memory Readable, Writable True False False -
l_intl.nls 0x00280000 0x00282fff Memory Mapped File Readable False False False -
pagefile_0x0000000000290000 0x00290000 0x00290fff Pagefile Backed Memory Readable True False False -
private_0x00000000002a0000 0x002a0000 0x0039ffff Private Memory Readable, Writable True False False -
private_0x00000000003a0000 0x003a0000 0x003affff Private Memory Readable, Writable True False False -
private_0x00000000003b0000 0x003b0000 0x003bffff Private Memory - True False False -
private_0x00000000003c0000 0x003c0000 0x003cffff Private Memory - True False False -
pagefile_0x00000000003d0000 0x003d0000 0x003d1fff Pagefile Backed Memory Readable True False False -
private_0x00000000003e0000 0x003e0000 0x004dffff Private Memory Readable, Writable True False False -
pagefile_0x00000000004e0000 0x004e0000 0x00667fff Pagefile Backed Memory Readable True False False -
sorttbls.nlp 0x00670000 0x00674fff Memory Mapped File Readable False False False -
pagefile_0x0000000000680000 0x00680000 0x00680fff Pagefile Backed Memory Readable True False False -
private_0x0000000000680000 0x00680000 0x0068ffff Private Memory Readable, Writable True False False -
private_0x0000000000690000 0x00690000 0x0069ffff Private Memory Readable, Writable True False False -
private_0x00000000006a0000 0x006a0000 0x006affff Private Memory Readable, Writable True False False -
private_0x00000000006b0000 0x006b0000 0x006bffff Private Memory Readable, Writable True False False -
pagefile_0x00000000006c0000 0x006c0000 0x00840fff Pagefile Backed Memory Readable True False False -
private_0x0000000000850000 0x00850000 0x008effff Private Memory Readable, Writable True False False -
private_0x00000000008f0000 0x008f0000 0x0090ffff Private Memory Readable, Writable True False False -
private_0x0000000000910000 0x00910000 0x00910fff Private Memory Readable, Writable True False False -
private_0x0000000000920000 0x00920000 0x0095ffff Private Memory Readable, Writable, Executable True False False -
private_0x0000000000960000 0x00960000 0x009affff Private Memory Readable, Writable True False False -
private_0x0000000000960000 0x00960000 0x00960fff Private Memory Readable, Writable True False False -
private_0x0000000000970000 0x00970000 0x009affff Private Memory Readable, Writable True False False -
sortkey.nlp 0x009b0000 0x009f0fff Memory Mapped File Readable False False False -
private_0x0000000000a00000 0x00a00000 0x00a0ffff Private Memory - True False False -
private_0x0000000000a10000 0x00a10000 0x00a4ffff Private Memory Readable, Writable True False False -
private_0x0000000000a50000 0x00a50000 0x00a5ffff Private Memory Readable, Writable True False False -
mscorrc.dll 0x00a60000 0x00ab3fff Memory Mapped File Readable True False False -
pagefile_0x0000000000ac0000 0x00ac0000 0x00ac0fff Pagefile Backed Memory Readable True False False -
private_0x0000000000ad0000 0x00ad0000 0x00b0ffff Private Memory Readable, Writable True False False -
gdipfontcachev1.dat 0x00b10000 0x00b2afff Memory Mapped File Readable, Writable True True False
...
private_0x0000000000b10000 0x00b10000 0x00b4ffff Private Memory Readable, Writable True False False -
private_0x0000000000b50000 0x00b50000 0x00c4ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000c50000 0x00c50000 0x00c50fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000c60000 0x00c60000 0x00c66fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000c70000 0x00c70000 0x00c71fff Pagefile Backed Memory Readable, Writable True False False -
temprunsom.exe 0x00c80000 0x00c9ffff Memory Mapped File Readable, Writable, Executable True True False
...
pagefile_0x0000000000ca0000 0x00ca0000 0x0209ffff Pagefile Backed Memory Readable True False False -
img.jpg 0x020b0000 0x020bffff Memory Mapped File Readable True True False
...
private_0x00000000020c0000 0x020c0000 0x021bffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x021c0000 0x0248efff Memory Mapped File Readable False False False -
private_0x0000000002490000 0x02490000 0x0448ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000004490000 0x04490000 0x0456efff Pagefile Backed Memory Readable True False False -
tahoma.ttf 0x04570000 0x0461afff Memory Mapped File Readable False False False -
micross.ttf 0x04570000 0x0460ffff Memory Mapped File Readable False False False -
segoeui.ttf 0x04570000 0x045eefff Memory Mapped File Readable False False False -
rsaenh.dll 0x04570000 0x045abfff Memory Mapped File Readable False False False -
private_0x0000000004570000 0x04570000 0x045effff Private Memory Readable, Writable True False False -
private_0x0000000004640000 0x04640000 0x0467ffff Private Memory Readable, Writable True False False -
private_0x0000000004680000 0x04680000 0x0477ffff Private Memory Readable, Writable True False False -
private_0x00000000047c0000 0x047c0000 0x048bffff Private Memory Readable, Writable True False False -
private_0x00000000048c0000 0x048c0000 0x04abefff Private Memory Readable, Writable True False False -
msjh.ttf 0x04ac0000 0x05f68fff Memory Mapped File Readable False False False -
msyh.ttf 0x04ac0000 0x05f82fff Memory Mapped File Readable False False False -
malgun.ttf 0x04ac0000 0x04ee2fff Memory Mapped File Readable False False False -
private_0x0000000004ac0000 0x04ac0000 0x04cbffff Private Memory Readable, Writable True False False -
private_0x0000000004cc0000 0x04cc0000 0x04d2ffff Private Memory Readable, Writable True False False -
private_0x0000000004d30000 0x04d30000 0x04ddffff Private Memory Readable, Writable True False False -
private_0x0000000004de0000 0x04de0000 0x04e9ffff Private Memory Readable, Writable True False False -
private_0x0000000004ea0000 0x04ea0000 0x04f8ffff Private Memory Readable, Writable True False False -
private_0x0000000004f90000 0x04f90000 0x050affff Private Memory Readable, Writable True False False -
kernelbase.dll.mui 0x04f90000 0x0504ffff Memory Mapped File Readable, Writable False False False -
private_0x0000000005070000 0x05070000 0x050affff Private Memory Readable, Writable True False False -
private_0x00000000050b0000 0x050b0000 0x054affff Private Memory Readable, Writable True False False -
culture.dll 0x60340000 0x60347fff Memory Mapped File Readable, Writable, Executable True False False -
system.windows.forms.dll 0x71b50000 0x7201dfff Memory Mapped File Readable, Writable, Executable False False False -
msxml6.dll 0x72390000 0x724e7fff Memory Mapped File Readable, Writable, Executable False False False -
system.windows.forms.ni.dll 0x724f0000 0x730cdfff Memory Mapped File Readable, Writable, Executable True False False -
system.ni.dll 0x730d0000 0x7386bfff Memory Mapped File Readable, Writable, Executable True False False -
mscorlib.ni.dll 0x73870000 0x74367fff Memory Mapped File Readable, Writable, Executable True False False -
windowscodecsext.dll 0x74740000 0x74772fff Memory Mapped File Readable, Writable, Executable False False False -
bcrypt.dll 0x74780000 0x74796fff Memory Mapped File Readable, Writable, Executable False False False -
shfolder.dll 0x747a0000 0x747a4fff Memory Mapped File Readable, Writable, Executable False False False -
windowscodecs.dll 0x747b0000 0x748aafff Memory Mapped File Readable, Writable, Executable False False False -
gdiplus.dll 0x748b0000 0x74a3ffff Memory Mapped File Readable, Writable, Executable False False False -
system.runtime.remoting.ni.dll 0x74a40000 0x74b00fff Memory Mapped File Readable, Writable, Executable True False False -
system.drawing.ni.dll 0x74b10000 0x74c97fff Memory Mapped File Readable, Writable, Executable True False False -
rsaenh.dll 0x74ca0000 0x74cdafff Memory Mapped File Readable, Writable, Executable False False False -
cryptsp.dll 0x74ce0000 0x74cf5fff Memory Mapped File Readable, Writable, Executable False False False -
mscorwks.dll 0x74d00000 0x752aafff Memory Mapped File Readable, Writable, Executable True False False -
dwmapi.dll 0x752b0000 0x752c2fff Memory Mapped File Readable, Writable, Executable False False False -
uxtheme.dll 0x752d0000 0x7534ffff Memory Mapped File Readable, Writable, Executable False False False -
wow64cpu.dll 0x75360000 0x75367fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x75370000 0x753cbfff Memory Mapped File Readable, Writable, Executable False False False -
wow64.dll 0x753d0000 0x7540efff Memory Mapped File Readable, Writable, Executable False False False -
microsoft.visualbasic.ni.dll 0x75420000 0x755bafff Memory Mapped File Readable, Writable, Executable True False False -
mscorjit.dll 0x755c0000 0x7561afff Memory Mapped File Readable, Writable, Executable True False False -
profapi.dll 0x75620000 0x7562afff Memory Mapped File Readable, Writable, Executable False False False -
msvcr80.dll 0x75630000 0x756cafff Memory Mapped File Readable, Writable, Executable False False False -
version.dll 0x756d0000 0x756d8fff Memory Mapped File Readable, Writable, Executable False False False -
mscoreei.dll 0x756e0000 0x75757fff Memory Mapped File Readable, Writable, Executable True False False -
mscoree.dll 0x75760000 0x757a9fff Memory Mapped File Readable, Writable, Executable True False False -
cryptbase.dll 0x75980000 0x7598bfff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x75990000 0x759effff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x75a30000 0x75a48fff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x75bb0000 0x75bf5fff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x75fd0000 0x760dffff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x760e0000 0x7617ffff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x76180000 0x761d6fff Memory Mapped File Readable, Writable, Executable False False False -
lpk.dll 0x763c0000 0x763c9fff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x763e0000 0x764dffff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x764e0000 0x7656efff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x76670000 0x7671bfff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x76720000 0x767ebfff Memory Mapped File Readable, Writable, Executable False False False -
clbcatq.dll 0x76890000 0x76912fff Memory Mapped File Readable, Writable, Executable False False False -
shell32.dll 0x76920000 0x77569fff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x77570000 0x775cffff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x775d0000 0x776bffff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x776c0000 0x7781bfff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x77820000 0x778affff Memory Mapped File Readable, Writable, Executable False False False -
usp10.dll 0x77990000 0x77a2cfff Memory Mapped File Readable, Writable, Executable False False False -
private_0x0000000077a30000 0x77a30000 0x77b4efff Private Memory Readable, Writable, Executable True False False -
private_0x0000000077b50000 0x77b50000 0x77c49fff Private Memory Readable, Writable, Executable True False False -
ntdll.dll 0x77c50000 0x77df8fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77e30000 0x77faffff Memory Mapped File Readable, Writable, Executable False False False -
private_0x000000007ef4d000 0x7ef4d000 0x7ef4ffff Private Memory Readable, Writable True False False -
private_0x000000007ef50000 0x7ef50000 0x7ef5ffff Private Memory Readable, Writable, Executable True False False -
private_0x000000007ef60000 0x7ef60000 0x7efaffff Private Memory Readable, Writable, Executable True False False -
pagefile_0x000000007efb0000 0x7efb0000 0x7efd2fff Pagefile Backed Memory Readable True False False -
private_0x000000007efd5000 0x7efd5000 0x7efd7fff Private Memory Readable, Writable True False False -
private_0x000000007efd8000 0x7efd8000 0x7efdafff Private Memory Readable, Writable True False False -
private_0x000000007efdb000 0x7efdb000 0x7efddfff Private Memory Readable, Writable True False False -
private_0x000000007efde000 0x7efde000 0x7efdefff Private Memory Readable, Writable True False False -
private_0x000000007efdf000 0x7efdf000 0x7efdffff Private Memory Readable, Writable True False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffeffff Private Memory Readable True False False -
For performance reasons, the remaining 87 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
»
Filename File Size Hash Values YARA Match Actions
c:\users\5p5nrgjn0js halpmcxz\desktop\@___readme___@.txt.lanran2.0.5 1.65 KB MD5: f87c016123c15f7cc3b4c97e536700ef
SHA1: 0e1a9bc3d17bb350b4f2f138a8b0b97f4097f84a
SHA256: d4196e02e780632b134538a753282e2aa6eb7b1ddb4ac1a12ed860f53fcd53f1 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\0xz6.docx.lanran2.0.5 75.44 KB MD5: b81b4226442e876ea096826fd41fd198
SHA1: c171976886f5b1b969f5772302ad6b69531fe85f
SHA256: 06509f0652c85c0c6bc536a193ec0a5aa3f88f60b4058067622bbc60ef1470aa 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\gspnh93gcri.pptx.lanran2.0.5 77.06 KB MD5: fb40057f5d06ac9fe347c0b9bc4e5f59
SHA1: 0d80b653193cb0da16d5bb14ca85501a2a96da9a
SHA256: fdbeaba5d5b0f9aeddfe11ab92cc777cf7ad31ae50240a0b35ef6e65ef781a62 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\tcca.xlsx.lanran2.0.5 1.28 KB MD5: cc1dace84ac8b813850fea4939ef60bd
SHA1: a4f727dfe1984906ab5f3eb55de9bd788cf10ef4
SHA256: bcad18a4afd56289aef20a355814f0742e981912d47cacd62d9397081a10916a 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\vvsqepacekks.docx.lanran2.0.5 15.48 KB MD5: 2f6d432894f4ec7a3b09c93ad1ff1ecf
SHA1: b2174bf12c36dada5df159b6ad68e16fb5e00e98
SHA256: 08c5b4f66119f07c8308ddc61c68580c03c662bfeedf6be77d623b8bc814b741 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\9ohwcx.csv.lanran2.0.5 46.42 KB MD5: 0effaad403141a978849e5ab0495e4c7
SHA1: b61ada1877d8dea5b4927ffde907657969b935f7
SHA256: 048aee858ef90e21611f84f1073d2668c7f6cf5da55177a54531fca1cbae8b73 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\vcksfe.xlsx.lanran2.0.5 85.86 KB MD5: 5883e26ce474c3b723c6e3abb2e58d6f
SHA1: ecbe65aab5e137c034eee6c3d2ae97f8f13a09c9
SHA256: 0d5e115590ac9ecd9165cf6e0776e9c0d57c0eec32abc3ead9bf1cb713726fa1 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\_omf x\nrgpxtgl5eovktsc.docx.lanran2.0.5 61.78 KB MD5: 0d94615270fd84c573592a86bd13b23c
SHA1: 336140f42c7d4c7f4e38fa75a63cd804038441c8
SHA256: b40005a918d2cc2058ed2bb02b1bc8362c74aaa6c8e1438c35c8fb1edb2703b2 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\svhxap79kwj1dxgdwqi.gif.lanran2.0.5 56.59 KB MD5: b9a475a84616164a8784ffb4c9f04821
SHA1: f3cde0ac76033b09dd4cdf9967a4149c5776eba7
SHA256: 1ab06a48f8998e2759c738be591eeabcd84629fd71309406cab903a6c51d6fca 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\4vk4jynzml2h7s1binw6.gif.lanran2.0.5 55.70 KB MD5: 42a5269963c1e7a416be2a99b2605c75
SHA1: 1dac1b731926ff7b2d5d04a42ddf8350fad038ea
SHA256: 552e2b5617e894b30fc07e39b22a0bcc15c5682710203f03f338fd7db625cf16 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\cyzijwpk.jpg.lanran2.0.5 96.62 KB MD5: 10851c0b54a243133f46a78af62990f5
SHA1: 1fc240cd3a954d04b528f3a0ccdfb3a7e41f33cc
SHA256: 4c5ef731b4a31e7ad1cdeba73eb04ecdcc2f253286bb57b09ea244b0b1d94138 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\qcl6r7woc3tf\5e6mnj.jpg.lanran2.0.5 80.52 KB MD5: bfdec03f1a04c17da10240c5740729ef
SHA1: e4a7e8b7b0b679a5687803e8b3f959e97e69feea
SHA256: f537705ded6e5e494176f68c64c7f39e83df53c65866fd7aad571b56732ad37c 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\qcl6r7woc3tf\rr1ee6x.bmp.lanran2.0.5 97.47 KB MD5: 647ee8ce5eb22845e18f03837058bb81
SHA1: 189fb814e017f1d49eeec376ac0882ad31312991
SHA256: e0460d361172bc30aa39540c26c86437f7a9d230bfea57838da729987e5b773a 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\zdfqpsxm44mcm\ml-82gxwyfnqyhlon.gif.lanran2.0.5 28.50 KB MD5: 764d3992ed3c3742263d13780bf612fd
SHA1: f02a68f4de1861edfc2253fca7bd91921782a62a
SHA256: 1f42a1db993076df9ecd81918981092623dc36185446335891c2ca9766fcfa02 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\jww ehsrfj.pptx.lanran2.0.5 57.39 KB MD5: 686d080a713e96e6621b465d1fbddeb9
SHA1: 673f803920f692da45d934be7c0410e13564ee5e
SHA256: a188db42338e1a893e3efcf5233974a98539ff2871986dd8690f13394b0bde5e 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\os5w-yo1b1y1zoj.rtf.lanran2.0.5 63.03 KB MD5: e20de8de8ce974d60e7776d135036643
SHA1: 340526d76dcd51567f069e5c0712de556e5e907a
SHA256: ac68cbc36e2270687d4e6c6f6d916f374b915c02ed57dce5c40b4b008c0c4cda 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\53otcpmpe7hx\zksm86k.docx.lanran2.0.5 79.47 KB MD5: ee013e8d32939eca021ee382c2f1ad90
SHA1: 3017ef878ee8208cd48aa161184156cae86ffc13
SHA256: 781f3bd550c19777b1f0b38177e3571df69cf10709bd2827de45c68762402c6a 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\hu-0kpxnlm7ritr_t 4\dxxywug.pptx.lanran2.0.5 66.97 KB MD5: f5bafe57ce4c7780ec2cd7c2fc8451e6
SHA1: 83995e2ec71201769a254eb9f40edb134650b1dc
SHA256: 8a00f1557ce69f7bcef62f2b060956daad49f1f53532bb29ee60b20057188e28 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\img.jpg 61.34 KB MD5: 4ee0646461b01405b722581618bdc4b6
SHA1: d24acee6ba1e5f0802844a87e158bc78e4246b4c
SHA256: 17cf70c6714e0368c28e8f7ff71be3238fba4bf7ab8d38107cd4db007e9be21f 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\speech\files\userlexicons\sp_0d85c05bbcff49d5940fdae124e33499.dat 0.00 KB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\speech\files\userlexicons\sp_0d85c05bbcff49d5940fdae124e33499.dat 0.92 KB MD5: c6e11185b0bcdfb0d05915ca42882b18
SHA1: a49ec1c93f1ce871814022032f2e0909d0736ec8
SHA256: 91d1942bbe82229c4e14ca263ad7174331d46963da51e37e2e5f352e0dcf1d3f 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\5aqvg.docx.lanran2.0.5 50.39 KB MD5: c1e3cc16b89cdc74d460ec238d650c81
SHA1: 9e4cbc623c0078c522946a2218dc22631d8f6529
SHA256: 66c9e75c8061693fee7b68763b7e02bc8a88f936f7d69a5a4d138d94f3ecaa9e 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\9xfuxm 1vtcblypynm.docx.lanran2.0.5 54.64 KB MD5: bfa79fc2f957dcf783be24dfeab59ed0
SHA1: f43f0b3e5e397737107d13317906e95cb0560bca
SHA256: 6ad220cf05d55a7d81ce4a559aa57832a1a918643e4076e8a44855d368c0f391 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\aa_k6kqhwa.xlsx.lanran2.0.5 82.89 KB MD5: 3e88163b2a37e48c42016ae2f0cc6849
SHA1: 5d51599912dec604daefef5359d306b2ec13e74e
SHA256: 7d4cd609b44f587b0f9f0a77a5aac8cc78e765928678ff8d300d391ad7e37b7d 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\joza9ejryoprehlv0-r.pptx.lanran2.0.5 18.48 KB MD5: 54afdbf015edab7d2a05b113c4ea76db
SHA1: c69363d4e2fcc74fcb7321db99307520e943f857
SHA256: 0b73c534483e9e3dd95582c68d7765b5f36a1751907ce3a7e0f8668d3f23d740 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\kxh8rnph.docx.lanran2.0.5 52.67 KB MD5: 527507ae28ba5467111d0741e41de858
SHA1: f3c4f89437b9917eece1e3f9142c17b983f06aa0
SHA256: f74de4aefcd5c2ed6e139733f75a7c5ed3bd783274dde30eaf127f8086931f76 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\msvk.pptx.lanran2.0.5 59.41 KB MD5: 65a756a93eccafe32ea5b7253a2087e2
SHA1: be1a98f12955b112f344ca144065f5b136312663
SHA256: 88649a14784f4273a3c267e7521629ba67beaab21a7d26f5274e2f2a99df74fe 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\osafg.xlsx.lanran2.0.5 89.64 KB MD5: 373328ee8ff3dc734544fd5c2e4b781b
SHA1: 9132cf2d500c9ef82e700af6cfc9384428ac4314
SHA256: 91b838d6fc8b829e47cc413422bc988d33fae466791fe3bd9871caed752d588c 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\qohwpoo.xlsx.lanran2.0.5 67.22 KB MD5: b1b601bb39e507e1be91fd93046709f3
SHA1: ccaa07903399165b8437bfc5894ed6f70a62a190
SHA256: 5f6a3c8eaa5928b9761974d89f5e06773d6dcae390c2a1870edb08379677080e 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\vaotvcj53.csv.lanran2.0.5 83.20 KB MD5: a8c28e8ce3521ac2b3d4ca1770a50061
SHA1: 33bf3caee38fb548985264067a4d3d8ba66f5702
SHA256: db37071c905f36ca7512359e4a21a85f80ceb22985b3ae75099d5723079a5013 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\vvim8uklhfcnysa9mi.csv.lanran2.0.5 41.70 KB MD5: 68988a8c78ad8065355d5efc8a90feb8
SHA1: c8b9b7b93fd88367ac4c01e6758b8f16f9a29a31
SHA256: 6b61ba8290c8705785aef55c90d9d323e8657732cd58de9d757072da00e7c381 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\wibix_1nev11d6kwm05l.pptx.lanran2.0.5 44.11 KB MD5: f5ef64a7ae09784bff3e4777bf84e2d3
SHA1: 82e830463cb5eaa36d6f58c7956e5265e35b252d
SHA256: 0321485e254c560b4d0318684638ad8a07074fc53f385a4632c99b70a9b1a126 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\x7thqq.xlsx.lanran2.0.5 72.73 KB MD5: 7988f4f953a9b3999d8993a8c46e5cea
SHA1: 6effb3dcd9e432db804d3ef85c845261c586a016
SHA256: ea83e29268658c4b2f366df08168a6225438edf8b6f6ab3a5502bcada813707f 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\xsyb4due828s75ucs t.pptx.lanran2.0.5 76.77 KB MD5: 120b1d8e19264b3570c35d8384197f19
SHA1: d3017c992ecac91a35a6a96c4289ee0e47c1873a
SHA256: bf119ca1914db58e57c68ef32c942caa5f5d2d46e68c2dcab433a34e14ea9ad0 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\is2fbgoyb_drve2 p.doc.lanran2.0.5 36.91 KB MD5: 0771dc6a2bee4681f29e6c4c9e50ac87
SHA1: 0379dc8ca3795b67756032813405582abb4ab347
SHA256: d42808d37c424b54348c25ddc996051b60ba9469e611bdba6bcdf6036a01fd15 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\lwxjfvxbet 7vcegygl.xls.lanran2.0.5 50.23 KB MD5: 47a7ae0adab3b3946df528b8dfb56aad
SHA1: 8c77c67869cc5b12571d70b82c8fd3dec53c5c8b
SHA256: bd8f238cac049894ce31eff2b2f9ea9df236a1d4ff6e8cb0a4f696018d822648 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\uuqj2vsov--zktoa9e.doc.lanran2.0.5 6.59 KB MD5: 7b7fdc1b57c4a7b15e2744ffe801b672
SHA1: dc96df89cec3dd71e660ac65344520f72c61feaa
SHA256: 2d8114a127c1df7cfb345710e276e2662742893977771e9cc02fc58015f4281b 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\gfyorikcxdmvbjalto\9x4ox9zi66worq566n.xls.lanran2.0.5 85.41 KB MD5: a4633c57f890dc6869f450f43ae659a6
SHA1: 3910fb0fef814d6be05375150dcba1cf64af3f1c
SHA256: c84f031072cbea901f8349f0e9175eef53bde583797f270219500ef239bdcd35 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\gfyorikcxdmvbjalto\mxzhtw exvo.odt.lanran2.0.5 67.12 KB MD5: 9545da4786348da786d6dbd7b6bb6839
SHA1: 1682cb612c40ba54dc8bf94c2ecc57f14d00d904
SHA256: 1f7d0622ccb617ec116d5af2b0771284129024bfb64ab7464e0d91c1678ef43f 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\gfyorikcxdmvbjalto\qcfc96mjr.doc.lanran2.0.5 98.09 KB MD5: 38b670cb940d3bdbb9d741a8568fa43a
SHA1: aa04d4dd9dfba2bee001a74c660fab7bc4e1d444
SHA256: ac80124435060228703e7128df54a4f2d7f3570e0e033be41074bcdffbff86f0 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\gfyorikcxdmvbjalto\zx_h419x-lwtnxskpv6\7mo7p2ajxryjr9e.rtf.lanran2.0.5 80.75 KB MD5: 141728693414536d9a1b6498d56d2c7f
SHA1: 98d1aee262e59df2472135932f312505d17a3e1a
SHA256: acbe982a5ea12db605b5666c10d301c3acec3c32c93dde6c5826989af030757d 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\gfyorikcxdmvbjalto\zx_h419x-lwtnxskpv6\vhpzchnm-9.pdf.lanran2.0.5 36.61 KB MD5: 1853a00d87e00a87168bcf3c8ac3bfc9
SHA1: 3d9a2b9e808fac8063a4e4afa12fa50d4747eb50
SHA256: 5f442c2e1732a7c6d1d1d81c1a9f472d16d6860889519a2a7aed3fe74dad2941 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\hlmh4.xlsx.lanran2.0.5 88.20 KB MD5: 7f78ac822ecaa1b0c1b35e99de52c6d0
SHA1: c64beb076b41d0146461ad24d138983d55444edb
SHA256: 6dfe09e1c68769f67b5622875f7630058e7dd6ad5da2d502b2f7a099d19309ac 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\jdzs.rtf.lanran2.0.5 7.28 KB MD5: 2050ca05aead7e02e800bd492d54d869
SHA1: ed4ef405277e82477c73ba8e654966a47bf9d55e
SHA256: c79586be4c793dffa9058cd6f603859f2fa02498c947f20a990fc328ebd0837d 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\kmqwqfsabihhi9p.pdf.lanran2.0.5 65.38 KB MD5: a4080e00bb617524a729c61ca8b1a588
SHA1: 81d3f1b05535a9ab36bb5b4e6a0b71703fbbea26
SHA256: a83bc5588e006b6c13566666f023459a9338463fd8b05074c5b8733951eb47aa 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\cuoac7cx20oxv\68pvefv6kr3oep2i.pdf.lanran2.0.5 88.73 KB MD5: 2aca90323693544aa090b8b10505769a
SHA1: 336c2622295ecdf03d19684b1cf4a17e49caba50
SHA256: 01b968d6ba09f7b45be925d3077c49958b7210c28cd6aff8e510aca53ef02c0d 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\cuoac7cx20oxv\a21mp_0hc61caiu\8frj-ri0s0j5l0bnl0.docx.lanran2.0.5 48.56 KB MD5: 0797a31bd9f1216ad059e746a8e12185
SHA1: fc28c1f6115f8d7499d373d25d1689c26bd19c67
SHA256: 3f2bbfea6399c24c91458fd48079a1d4f582743aa3fe02a27ca433abcf4d4013 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\cuoac7cx20oxv\a21mp_0hc61caiu\sknb.docx.lanran2.0.5 8.12 KB MD5: adec92983ad093fd3fafc5ff0105927b
SHA1: 654100b7cd27d09678b590b1ee9865bb02d426fb
SHA256: 35cf310c426e247a5d35516d19cde7c02892dd4a944b4e41079a72a01cac29a8 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\cuoac7cx20oxv\a21mp_0hc61caiu\zks2iiid esy6.doc.lanran2.0.5 42.30 KB MD5: c14eb87d9d64763548bd789850051ad7
SHA1: c6e461b418f5bdc03ea3b1e7bb995acfe3a1028a
SHA256: 591d9e5c25c2c5f30ec51f18a990838faad967fdb020c95b8d907ed63de2b201 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\_omf x\bjjubvkfsudxx8e.pdf.lanran2.0.5 26.53 KB MD5: 83b6673064fe5377bc04a4bf3488d781
SHA1: b3187939547badb27d10cef5d5399e4ba0413b64
SHA256: 04927fb7ced77348f80ebfffd5b3b242ef37193b97aec86e6781beab412b01e1 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\_omf x\byp3mohke.odt.lanran2.0.5 47.88 KB MD5: 069a57e78f7b94a83c55f8cd4cc8119d
SHA1: 8e325487de0d98147deb959a9e198e66e5c34676
SHA256: 7c2307209c490978d29d1ee12281916e9193712ea9ec6aa8a0c42d2add7f94bb 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\_omf x\izz4jc1gbs.rtf.lanran2.0.5 18.33 KB MD5: 261943abec3ee00329383cbf0c0b7f4e
SHA1: 74faae8ed03a2fd87ffc30e13e147183e7e9a2c8
SHA256: 7ecfd503e527a6fef98960f9dd38e9b6c42547d548aeafd1f29eea6069b36348 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\xsru4li2eoc0v44\_omf x\q ovyk_kvwgwh45lu86.rtf.lanran2.0.5 44.34 KB MD5: 681b942639c78f8d29c03d62d0b966ba
SHA1: a174a382cc2e601a127ff7f0c6a520e3e6641009
SHA256: 87c2fcc86dbcb0a6c8fe9b921dad679af8cf54f0c632e3fcd9f96f8ad2029c2c 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\xfowv83tosrpbzp9\jsk 9b9p.docx.lanran2.0.5 73.41 KB MD5: 3fd2324640f3b25528b4ca71fd374c6d
SHA1: 5b0991586a8fb68af172c87ea5545af34ea7e57d
SHA256: 9d181a7fbef89d9842f0f7b557b1ad6a9fba78eeda42b18832911cbf9aa9ca39 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\xfowv83tosrpbzp9\kplxgjplfarmrz5m.ppt.lanran2.0.5 55.89 KB MD5: 1ddbc7ed98fe835588643c786e1adbfd
SHA1: 6e95890927d992a67c125e0ac123243adf37ac53
SHA256: 5bbf512ae5800b59cd6e90a04d5b9fbdad0be746a4da2a995483b76cdef19e8b 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\xfowv83tosrpbzp9\qc2b7i.odt.lanran2.0.5 67.64 KB MD5: a33edca431737d7c566d758c10e7f695
SHA1: 2055adcb8164f3dd6c15646aaab28976edc5172e
SHA256: fbb9d56699551393506798493975c43cf12db41e986fe2345526a2f6610d65e3 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\humj9n.gif.lanran2.0.5 59.38 KB MD5: ceca57ee0f1e83ab79226d828838a14c
SHA1: c642984c4271f3e26f26d7dbcf028300b25fee47
SHA256: 104e631c86576a1f84b62c700f059745b117051b076352f6ca52797ba308b222 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\rusj4 m1.png.lanran2.0.5 14.58 KB MD5: b6f90aebe8dca36bfd374bd69f9819bf
SHA1: 83acf76dc4a74ede9a48ee233c343e495586c2ad
SHA256: 390c459f6362fee3a14df3f152b3c828a535e844e7cb00e0f064ed8b773387f1 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\sqh i6mbe59ed2t.gif.lanran2.0.5 46.05 KB MD5: 65a3e6262c6a94d2cbe18704b38d4a13
SHA1: 5ddccb25dcededbb3bcc4469281501b026102f13
SHA256: 01ecf7ffe2ca54b8af9ed97899e52cc279e072e9fd57bfed96b1024d80a783a0 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\4qwn3lf10ala6b.gif.lanran2.0.5 69.42 KB MD5: d027670f06060204c18d3e15424abd6c
SHA1: c517042a4ea3f3e268c2fb73cfbcddefae3e9049
SHA256: bb55ba70d15b81b97c39d782e949e829d92459624519fb481dbce2badf51ea2b 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\d9oryucu13enryj.png.lanran2.0.5 24.16 KB MD5: bc8272d71c4dede1fbe8a3aae781966a
SHA1: 0bf0bb3b7df59a18c2db2aadd2f6a484d32760bf
SHA256: c6404ae51717d6ca48e4d7abdf58967556e74ef7b8aa7c196d20c1623f8dde28 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\lptpzz0usr.png.lanran2.0.5 11.58 KB MD5: e0a451b8678a9e803463119a466026dd
SHA1: eab3794d57719dbb6b21cd74ebfbd7c06bae522c
SHA256: 86039601fa5f4608049ffb64486a40e1ffcbff89218672b09a125905d1cf1b94 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\ofsqsvy_9-o5srbuc-f.gif.lanran2.0.5 9.08 KB MD5: 04a821fb611f244643fc77a25e60694d
SHA1: cd37f86dda826c92319dc74f1aad8407d087ebf3
SHA256: 0c60a301c8b5ad19bbe635f9a85d27fdb296c82829af0d57188fd10c54e7fdeb 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\5rmwu4x8kfj8tv13oi.gif.lanran2.0.5 28.88 KB MD5: 46f3b4f00c829233ad6d4e3f5ce6d3cc
SHA1: f2bac5f1a168f213325405227a75b77463f40085
SHA256: a5e3e119db853d9c5dd7eca0284c20a3707e298b9cbdfad36effd6847a4551d2 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\7eyqrwddtufwea78.jpg.lanran2.0.5 28.62 KB MD5: c16ab8e69993af14796298981d7e387d
SHA1: ab699af50376e060345816574e8f3b0fdcbc2f0f
SHA256: 9fba458d553ff95a89b0c5769cb0e6846c83e3dc0e036c901175c92e67ec9fae 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\bqvsun3uhxnr4kr.bmp.lanran2.0.5 60.97 KB MD5: 15167309a017504418422b97fbdbcbb0
SHA1: 0ed81a7b8eaa3c67d8b71cfb10c3389199be98eb
SHA256: 62b30cbd87bbecda22673a7c623892d0df447442204ef8f5881b9b556343db3b 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\muyhktmdm.jpg.lanran2.0.5 55.25 KB MD5: 3ac11f36164aad71d9665b5df8ff675f
SHA1: 3a08db71418315c0720c01bd376b82e41eacc0e7
SHA256: e944f5d9979edf9136061feb26d21d762ae417e45860e2abf5b1d50b96290593 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\nydnoe6adjhzrnny.bmp.lanran2.0.5 56.14 KB MD5: d28c54c3ec81488fa613431fcdbe05d5
SHA1: 24dfeb746f76b2873ac096ba693e3d1810206746
SHA256: 408677f5a8edd8f1e2b65eaa0a3f774c788c1cc57b8d0f29644109ddd8e50bb7 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\yr4nfivedvx896w.png.lanran2.0.5 85.44 KB MD5: 1909d770b77db3382f84f1eb16249eea
SHA1: f8f161533daf8a9b18e0cb64e86ed8fa0b76b790
SHA256: fddc5559c128513053795076fb698196299e6a26352f2fc125b28b25335be8f2 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\qcl6r7woc3tf\cte330fqj4o3f9xhhv3.bmp.lanran2.0.5 31.80 KB MD5: 93bee82196ae3c9ed45f978c16be86ba
SHA1: 25077de6d1d0b2c1d67f2add990c3fae59d150ba
SHA256: db252388d402aa079b81f1156d1283ece60b06b46f1b14c0b5d362908b9a09a9 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\qcl6r7woc3tf\f4gh7x9-.gif.lanran2.0.5 76.95 KB MD5: e925740392bee51e71ff08ce2273e441
SHA1: 3887bbdc4d45c8281adba99fa6f0ef408383fc00
SHA256: 40cc21d038822f57ced86c8297c04748b27929129273b9214554d7d3d5956910 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\zdfqpsxm44mcm\5 xsesqkjee fd4wdiel.jpg.lanran2.0.5 61.92 KB MD5: 7d3429aed2e0c91ee57c74a2e3107a9a
SHA1: 195b41e00a196bd43b44e42d522af7fb56ae4c82
SHA256: 682f483500716730243b2397c5ef4c244cd63f0a2cad94d7e000f637a6238462 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\zdfqpsxm44mcm\azsni -ulr.png.lanran2.0.5 63.66 KB MD5: f8f3c1157bba09cd1384573afa6a0df7
SHA1: b0122f021385ff942f4b219e6ef53b824547f2c8
SHA256: 0d08d31eb3fa04a80d0cd760058052078265744806464cb52e423d57609dfe85 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\zdfqpsxm44mcm\eve0agd3kpqy.png.lanran2.0.5 42.91 KB MD5: b535338a73541978956c918b552269dc
SHA1: 2668b43425465149c1793fb8ef47d73518a61b97
SHA256: bf2bf644c92aad666a181595683ded9a8587be09ed4fcc2669721db85de51bd7 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\zdfqpsxm44mcm\hhev8.gif.lanran2.0.5 21.47 KB MD5: 28350c2b782b29cfdb716aeb77c369e8
SHA1: 37b2a331634918de0e189c7ab33df36ec889791e
SHA256: badac5d080e8a44efd1cc4804022a74154bdf1f4e6b6ed60c1238d6f2b3832cb 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\zdfqpsxm44mcm\kco0kx-t.jpg.lanran2.0.5 87.95 KB MD5: 31c1dca90ff112f9b3c1bdf56f868808
SHA1: 7731e156b55844176d1da0df460df013b5e1819b
SHA256: bc1724c9135655592dd8d22d90586256592abbd4799cba721198e1586f0444ed 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\zdfqpsxm44mcm\u1fjsyz.jpg.lanran2.0.5 38.23 KB MD5: dbc45e8b4ec4f60b320b4b696bf97982
SHA1: dd93145a4b295a34aea0a88d8a4b6dc203f91e60
SHA256: 58fa9faddad1e776adc8800833eb508351249d856b289ff31add46083f795d20 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\zdfqpsxm44mcm\vr-kwpndecd-l4m.bmp.lanran2.0.5 36.81 KB MD5: c10eb7f1b0926fa5b9e6868c0be059ba
SHA1: d7b9515cfa4887818206eb6f7c0f8e241dad14d5
SHA256: f52a0edd2d1456a7ed5f8d67e878d46f6bc5c1084cf42158c1fc04b25a90f920 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\zdfqpsxm44mcm\wknzeogznere45_5yin.bmp.lanran2.0.5 79.81 KB MD5: 0cd61b6b4f085bc72745314b1a58a9bd
SHA1: 9b44a8af886d26f82b7859b27c60528d3cf6f9b8
SHA256: 7f4cd73b2d1cf217bc9a6ddf9e48b102ba14e5f296eb72e4b7e6d7ee1da67012 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\01zwrvx.ppt.lanran2.0.5 22.61 KB MD5: 47b67abc5150ffd478967c72c009705c
SHA1: e8c75b2805a3c338167b30d8f2c1ac9ac2978322
SHA256: e0af61b9fcf47c716c2acd5021df13cfdf506a70866049f040b899e3cbb7bb9a 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\1g7fsw9r5ibyucv1g3.mp4.lanran2.0.5 41.22 KB MD5: e5f074e9ee65beb3e3e44e6f72bc1892
SHA1: cbc459199aea0647a53a26146c5e5081db0cf76e
SHA256: e6b4d6ffc1396a758b818e7edff84d9d196e382c2dd52669449647cda0d384a7 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\7sctepfgj-s.jpg.lanran2.0.5 30.80 KB MD5: 86123bd2cd08db616af4d3cd93cbeac7
SHA1: e0e369a46ebc7be8be82f25664968d435df268d0
SHA256: 5aa6a18106fa4a3771da0b2f573cccd7bcee6177b6f45909b6afaca601f8cc0d 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\dmiwofz.csv.lanran2.0.5 47.70 KB MD5: c17a21421d03338dde388088597032b6
SHA1: b2e2cfb02524248b6afc622eb92b38f1893999d8
SHA256: f567990594a9fa72707cf6a122a53e05980ba809ce1a889be43d39e5299f63ff 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\e wxc788va.bmp.lanran2.0.5 18.53 KB MD5: bcb4363252d37e6c9a7ee663874586c3
SHA1: f426419b5de931770d2b23c8629a43e3cb8f18f4
SHA256: 2091ead392b9e90beefe9aadc0358be22e35425d1e2f55693a0d3cc423435b61 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\ecsqc_ysqethy4sfp q.png.lanran2.0.5 10.14 KB MD5: cb1ecda2894e615f35c41db4abc16c05
SHA1: 4a3325d171e9026c3ded142dc3e596b22cfe7869
SHA256: ffcc0d4f403d2fbe897cb127c1ecfa468a0902943271cc42ec747771a999eda3 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\fdernccw.mp3.lanran2.0.5 11.75 KB MD5: 96048ea0e88c77b2fe27ca34f99b1260
SHA1: 17c8ad90f23a5c6bef225987a72c46b6f415d3a2
SHA256: eb2741a7414cdca792b1ed5f7343918ab8fddb7c822697dc88e5b210b6e7caa1 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\fukr.odt.lanran2.0.5 7.62 KB MD5: ea54a45fcd7c3487b70ea57f05d1ff54
SHA1: b2d093b3f48623e537a0b638d4f70a18500a8099
SHA256: cef139a5b07d58f72a0fa8ef83c02a943e11dbb05af9c3065808531a9927973b 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\o1dnin_torm0c32phrbo.gif.lanran2.0.5 36.30 KB MD5: 6ac2a89ce3da43c82338f2410952e02e
SHA1: bfed26244be727428df77f23af13df2e00036f11
SHA256: 56430aa57574bb868baf2af41c830cd3d177f2fd636d52e79c65dad532029956 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\pfd82kmu.jpg.lanran2.0.5 76.38 KB MD5: 3957a8d150a04c0f8e85938e042fc753
SHA1: 3d110a0b65c00db7b665b4d1de829f17b863036d
SHA256: 167cf42600887b45212a39d588049eb2ba2cdbd6298342bbed5bcceb048efea8 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\satcx9nutaaxstwmxb.pptx.lanran2.0.5 33.16 KB MD5: 7bf1895b269a074f6a10e22e8bafa525
SHA1: 06444350a8ea460f78e17b25f1d7c9a6400b01b8
SHA256: 276cd3f081101361312ff9264e7d48c04386ae0a6de1e40ad93b73a5b68af192 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\vjxpznfyv9dc.odt.lanran2.0.5 38.47 KB MD5: 376f05df6d7c477ba00aa0f239eb3cb1
SHA1: 84ae7c8d45b8fb5467b65b8ede11fc770f8eb269
SHA256: bb63765e1e5ff04e2924ff217227a5c72baa84e688e0a4d3d1a51b6d73fd87ec 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\xp5sknoafuzblkthwf.png.lanran2.0.5 5.22 KB MD5: 9dd08fb8f7699055125f857f720de832
SHA1: 2ddcde3903e5e1fbaadacf1afcffb085af349bb2
SHA256: f8de01047a6a485e4311346ac62198b8a2f330d92cd4fb89f79d2a7cdd011456 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\53otcpmpe7hx\qb61ws.jpg.lanran2.0.5 10.81 KB MD5: f0b45459003561f6710481fa4e96745a
SHA1: 630883c26d4712ca70bee48530d37306c76a799a
SHA256: 0e46eca8b72f1ca135d0a57ee21e24cb36020a558662d0f2421c2d485c09cb38 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\53otcpmpe7hx\dhcc\b8eedu5rs9qt.mp3.lanran2.0.5 35.50 KB MD5: 27a69d905d21caf03894eeb04770a8b2
SHA1: 32d0697c57e68cf6ebcf7f503b484b884a300a87
SHA256: f43801dfeab7517eba843246e1199b09b12c14ef47822fa095a3190484e69b3f 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\53otcpmpe7hx\dhcc\kufkge8e_3tsephazw.png.lanran2.0.5 23.88 KB MD5: 39d4f8594968eb053eac207810b36fc1
SHA1: cead6b928a731abfec33357b267acff6dd7aa34f
SHA256: 5fc0aa3706dc3b9ebe183556858e0e46401d8a34504bd0ed625951c8093f6da1 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\hu-0kpxnlm7ritr_t 4\ovjda2whk.avi.lanran2.0.5 39.34 KB MD5: 8dd6f012f6c26cddd402dc978af999e9
SHA1: 950af1417ec413078d376fe785c1dd2f4dda1f87
SHA256: d708555ea07033c339702c6c8359e819b35f80a2b3afb81e3f84260c43f5a611 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\hu-0kpxnlm7ritr_t 4\pbcsaw8barzkhg\r4x-n5oyi mg288u.xlsx.lanran2.0.5 21.11 KB MD5: 8eced235b8f152146cc918f693d764ad
SHA1: 024f5f462e69427b6db826f5f12fea62c8c6982a
SHA256: d02bdc0e9a1bca62b6a8f46db6f913d17aa23c17c8db1b7613ce54e19875e66b 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\hu-0kpxnlm7ritr_t 4\tjtcob3z\hn 1fhec4peyiskdkwck.mp3.lanran2.0.5 11.45 KB MD5: afb429cce22c382fcca3b74f1264e3a6
SHA1: 53222a20fa3e0ee14f88f161c1ab5a7e9d2319dd
SHA256: 24cf6375bdf40243e3980d3f7cc1076d98ff8bd7967273c3acbc56b6e2d6bbbb 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\hu-0kpxnlm7ritr_t 4\tjtcob3z\yxeuthdak.ppt.lanran2.0.5 44.05 KB MD5: acf6995221567c00165b4653acb911f9
SHA1: c9feb92ca8d6c5aff9090453aaf6271f22bb59cd
SHA256: 004fac802661109989d573b317d359ff22789ae931e28821c48e90a2939dc5ff 		False
...
c:\users\5p5nrgjn0js halpmcxz\music\ekvtedi3hgit.mp3.lanran2.0.5 27.03 KB MD5: a0d72232a89905a1481325a18ddf3ee5
SHA1: c96b45713072b80f9245315f3838693582a79905
SHA256: 239d01dad7ce6da88419ebf428e8378c6aa1dc3ce22b22e727cdf3e2b36a0f5b 		False
...
c:\users\5p5nrgjn0js halpmcxz\music\bw2ai 23oheuw-u-\pellq xvtj8zfkuwee.mp3.lanran2.0.5 93.20 KB MD5: ad3722791d4ccd4cfd819a865ca3b35e
SHA1: 159f676232db133e96418f430708c0406cc5435a
SHA256: 586926383fc3f809b0773179381a0a53919e79f042d5ae8ab8a3a5748b7f96d5 		False
...
c:\users\5p5nrgjn0js halpmcxz\music\bw2ai 23oheuw-u-\65kbbtyvwqxb_\sj9iur0zvvajif\gncucpscfxtvc9ad.mp3.lanran2.0.5 49.03 KB MD5: 3e316a153e3e5bfc355ace7f46d88cb0
SHA1: ba430928995a91f1f8a45ff1be000a0563e538af
SHA256: 9cd969724fba717bd3a212d847eb9715abcf920b5971a0c32c654a9ba67172de 		False
...
c:\users\5p5nrgjn0js halpmcxz\music\bw2ai 23oheuw-u-\65kbbtyvwqxb_\sj9iur0zvvajif\l op.mp3.lanran2.0.5 97.77 KB MD5: d9fc62d810a25f44f8858036c2adb2aa
SHA1: 3ff6c4e0b010e92ac6c59e341d37a62f2b4731ab
SHA256: c0b173d6f224368282fb9b02c16f8c4754da9ec81197cc241114e210d87e1e2b 		False
...
c:\users\5p5nrgjn0js halpmcxz\music\bw2ai 23oheuw-u-\65kbbtyvwqxb_\sj9iur0zvvajif\hs3qnp_\uxgiqg_18rni5nq9lf.mp3.lanran2.0.5 75.69 KB MD5: 72401986f75b55db10502b9f75d2d698
SHA1: a83a8033a6a30817854ea16d79542b9e77c5e406
SHA256: 8ceabf7461acf25ab2b72b2a606f2aaf15c836564d9b23eb30e22e70a70b91d8 		False
...
c:\users\5p5nrgjn0js halpmcxz\music\bw2ai 23oheuw-u-\65kbbtyvwqxb_\sj9iur0zvvajif\hs3qnp_\ytctsumrwh1cpryn.mp3.lanran2.0.5 25.86 KB MD5: 856b8ed2913d61a32b1cac73062a53ae
SHA1: 760cfdd71fdf3ae58b8f456c7f0bd323f9129956
SHA256: 3712da86051d230b2d9f0ea8d3fe7374f726ecbec4d52234d5bc3f120cbf89ee 		False
...
c:\users\5p5nrgjn0js halpmcxz\music\tkhyua06i3ez\akc-l-vx\wy6oe3new26uepdqh_\_unfijl-.mp3.lanran2.0.5 24.97 KB MD5: 7274857fe3564aab317968ad28275372
SHA1: eae565e7a0371f37ae8c1a9d5dd7acef25eea3ca
SHA256: 344243650bddf3e97019812f1a47684c94b5dd9c5bb762dfcba346a157a6e6f1 		False
...
c:\users\5p5nrgjn0js halpmcxz\music\tkhyua06i3ez\jgsuiwu2\skovqzoy8i53arrb.mp3.lanran2.0.5 88.91 KB MD5: d5d1bfe998918686a3618fa2209e9257
SHA1: 2e65afcf7e7d6f11138285cb7d7ea4c9646c1e1f
SHA256: 6a3a86775fcb4afee6a766c4f41f317cd1421b1468ecf6a47947db14d228e5ae 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\3zwe2-nh.rtf.lanran2.0.5 36.00 KB MD5: bd67b191bcf146e0334f516ee27f6fa4
SHA1: bb3aa633a0da48a8b28c9fffee556221460ff2c3
SHA256: edcdb70770f454533c3c90fcba9e51d435813f56f878d6f29c9ca37817bb6537 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\b m-6pzp2cxtexe n.avi.lanran2.0.5 7.64 KB MD5: ef5b80188e7b6242a181351c09ff2258
SHA1: 39fcb4efa2b7ae9d9132cbec99da5613b8c52359
SHA256: f0d31c1a0a06fa3158db0eacc5274e48b4f57430068b5a80db0a9e941beb1c27 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\dr1a9fjyb6ohzsgyw1x.bmp.lanran2.0.5 88.48 KB MD5: 80f058cb44a46ce452865684829c63f4
SHA1: 3a2a3de612a833128979a7c55c1cde95b847be70
SHA256: 8b8bc442da888c8f72ad59a7aad9861ddd9fe9c178a20ef3ae39af9d2785e5da 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\exlimxnopc.png.lanran2.0.5 64.84 KB MD5: ed3bf1dd22cdcb0965b6682b3c0f4d82
SHA1: fa898c656eb247b978a83404603a9f439d02d27b
SHA256: e881e41a105b0fbdce51d0c98a09729ce4496937fb4c2a5e78a143b7c1820a8a 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\fyvnazxtqq2juonn6.mp3.lanran2.0.5 91.98 KB MD5: 49678ab28c39aa294d39b0a2f0826072
SHA1: 6931095babfebca29e28c6e29fcbb7f20738a490
SHA256: a0c73458a4093f2076e4713a1f893f15ea59e8b76f92be2f29ce6d65c9b52a5e 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\k-qbfp1vgociynj1 n.png.lanran2.0.5 30.42 KB MD5: 2f45ecdb434ec01beba555de742bdacc
SHA1: c482b727ca984f5eaf85a8ee9c08c4db714dbc87
SHA256: 6aa89fa7c7cb70694ba70f39f0b01c3791698c1d3c9dbf4cc5dd8ffb5fe305fe 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\kveoden.flv.lanran2.0.5 27.02 KB MD5: 3ff8b9e1937f1446946df3cd8ff23fae
SHA1: f37aacbc51e1bd74aa32279ebf7fde4e7a27c654
SHA256: 1d5ca34afd1e5d8fd4dfc2e8dfa243760572ae3ce2a788cef5ceb96cf0e79884 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\m-1llo1xsmqy.mp3.lanran2.0.5 95.47 KB MD5: d4e5567149d91b5a932f1e19dbfd0d87
SHA1: 2bcaa65afe53b60585158ea9d8c5a8fb5fc1e211
SHA256: 2a7f4b489af52110407748756be8192c12e8b127fb6034a1b987afafa1e200c8 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\oujzqbivduif6pi.docx.lanran2.0.5 38.14 KB MD5: 7aa49574fb22cb0b763acdababdcbd7d
SHA1: 17cbef91db13405a90704d1b49ce198bc82f6a07
SHA256: 06bb9a3ec37b0168835dbda73da8d69efe24c9c2e333b2e14e188c908f5ef0c3 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\pqinwrm.xls.lanran2.0.5 68.47 KB MD5: 081237a87704de2d0b35b337598ab7bc
SHA1: 98ef5d4a89d8e2ed6488e84fac565ce9f220b7ee
SHA256: 7bb7f4f9741f2bf1aba78b32a9f35f1b90bfb9058fe66d3604928cc0ee3ecb28 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\tdbbjpidntvk8-du.png.lanran2.0.5 64.52 KB MD5: c813b5f8ee4857a75b2836d5d949e6ff
SHA1: 34ac1cb28520d74f792ac693b5fb54f50cb9f961
SHA256: c6b067c46e4299a043078058aae8edb05fc285d8b3208414ca33eeb4fc1f9cbf 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\vepxh_ jzar.gif.lanran2.0.5 33.52 KB MD5: c6f5e2635c2764f836e70c4b0ebcc961
SHA1: bb49e982bd142844aba798a15561a495da58370a
SHA256: 2b35d02bc600099468809095d067968bbc1f25aa826373e4184b3028e09c0175 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\wvhdidgpq5gsdm_.mp3.lanran2.0.5 22.27 KB MD5: f0fd174ab1c7489215865ea162d7b3cf
SHA1: 5ec7597062625a857a29a640870dfe96f22d2f98
SHA256: f704f6391adf18a3ef37d26496cdd85c733e5496f9f8feba4325481eb8ba0c47 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\_9rrw.flv.lanran2.0.5 1.58 KB MD5: 036fab45846b74452302451ae5979491
SHA1: 6e0db7191c8a9bcec2e3683a7af67ab71a7505fb
SHA256: 6d30ffc37cb9595a2c28cd051e865b58140a6a5f45e8457c1b891441b2e6a47d 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\_9uzbi.pdf.lanran2.0.5 77.69 KB MD5: 17bad5cfb8e35aec8143837ef86b01a8
SHA1: 52877cd7216163b2bb9c9a661e7a7263eef2f84a
SHA256: 728a49a586cb4cc8f86cf76f2a5452ae081be50a63cdad1aa3e1dbb2163dc201 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\_fwwi71jjtryvqn.pptx.lanran2.0.5 80.59 KB MD5: b649bf2c496f3093a264c314e8780eeb
SHA1: b3e8f9f0861e3fd612c0949671663ee3644cf5ff
SHA256: cf8c9a74e3352ae5a708d9906c8622f1b582da56366508afc566c8444710e129 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\outlook\outlook.xml.lanran2.0.5 2.42 KB MD5: c29ba723754b7d1b6858474a2c45524c
SHA1: ea778933bcb85e4fe208a37a0420b6ede2edad32
SHA256: d2956ea3fc18a786a2966d7d7177d8ecd084b45249b80b6c92883aad9bb7703f 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\publisher building blocks\contentstore.xml.lanran2.0.5 0.17 KB MD5: 7bca68f63ac92cbcfcb2456c1021a7b1
SHA1: b2a7e859cdcf4c6cd6dde5c03bd9e611f6b0bed2
SHA256: 4e1444b4dc99cd4821db8484bbdd8f6528dd296958b9d874b755c3e63d0a92ca 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\themes\transcodedwallpaper.jpg.lanran2.0.5 627.92 KB MD5: 6fbb222cabec5def6b8cf570307ac385
SHA1: c7a1c253bc5d325e6919afd44cf43dda9c0e558c
SHA256: 6b49b68a31c3eee8f16d7b90c5b48283327d9e648ded86642dec0d7677ae7398 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\mozilla\firefox\crash reports\installtime20131025151332.lanran2.0.5 0.02 KB MD5: fa232a085115a936a6aa3b97e6306e7d
SHA1: e3c5743fa9095ac88af9debae6a1a215579dc904
SHA256: 1df0e8b7c172cf98346cfaf8efcfb2565bdb3a0ce35fe0ad648935704b6a4720 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
c:\users\5p5nrgjn0js halpmcxz\documents\gspnh93gcri.pptx 77.06 KB MD5: fb40057f5d06ac9fe347c0b9bc4e5f59
SHA1: 0d80b653193cb0da16d5bb14ca85501a2a96da9a
SHA256: fdbeaba5d5b0f9aeddfe11ab92cc777cf7ad31ae50240a0b35ef6e65ef781a62 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\tcca.xlsx 1.28 KB MD5: cc1dace84ac8b813850fea4939ef60bd
SHA1: a4f727dfe1984906ab5f3eb55de9bd788cf10ef4
SHA256: bcad18a4afd56289aef20a355814f0742e981912d47cacd62d9397081a10916a 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\vvsqepacekks.docx 15.48 KB MD5: 2f6d432894f4ec7a3b09c93ad1ff1ecf
SHA1: b2174bf12c36dada5df159b6ad68e16fb5e00e98
SHA256: 08c5b4f66119f07c8308ddc61c68580c03c662bfeedf6be77d623b8bc814b741 		False
...
c:\users\5p5nrgjn0js halpmcxz\documents\amzs0-mtupzz4cf\vcksfe.xlsx 85.86 KB MD5: 5883e26ce474c3b723c6e3abb2e58d6f
SHA1: ecbe65aab5e137c034eee6c3d2ae97f8f13a09c9
SHA256: 0d5e115590ac9ecd9165cf6e0776e9c0d57c0eec32abc3ead9bf1cb713726fa1 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\svhxap79kwj1dxgdwqi.gif 56.59 KB MD5: b9a475a84616164a8784ffb4c9f04821
SHA1: f3cde0ac76033b09dd4cdf9967a4149c5776eba7
SHA256: 1ab06a48f8998e2759c738be591eeabcd84629fd71309406cab903a6c51d6fca 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\4vk4jynzml2h7s1binw6.gif 55.70 KB MD5: 42a5269963c1e7a416be2a99b2605c75
SHA1: 1dac1b731926ff7b2d5d04a42ddf8350fad038ea
SHA256: 552e2b5617e894b30fc07e39b22a0bcc15c5682710203f03f338fd7db625cf16 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\cyzijwpk.jpg 96.62 KB MD5: 10851c0b54a243133f46a78af62990f5
SHA1: 1fc240cd3a954d04b528f3a0ccdfb3a7e41f33cc
SHA256: 4c5ef731b4a31e7ad1cdeba73eb04ecdcc2f253286bb57b09ea244b0b1d94138 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\qcl6r7woc3tf\5e6mnj.jpg 80.52 KB MD5: bfdec03f1a04c17da10240c5740729ef
SHA1: e4a7e8b7b0b679a5687803e8b3f959e97e69feea
SHA256: f537705ded6e5e494176f68c64c7f39e83df53c65866fd7aad571b56732ad37c 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\wnoqiwnk2eucp\qcl6r7woc3tf\rr1ee6x.bmp 97.47 KB MD5: 647ee8ce5eb22845e18f03837058bb81
SHA1: 189fb814e017f1d49eeec376ac0882ad31312991
SHA256: e0460d361172bc30aa39540c26c86437f7a9d230bfea57838da729987e5b773a 		False
...
c:\users\5p5nrgjn0js halpmcxz\pictures\lzwu1zxus7hzu2wbfcq\zdfqpsxm44mcm\ml-82gxwyfnqyhlon.gif 28.50 KB MD5: 764d3992ed3c3742263d13780bf612fd
SHA1: f02a68f4de1861edfc2253fca7bd91921782a62a
SHA256: 1f42a1db993076df9ecd81918981092623dc36185446335891c2ca9766fcfa02 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\jww ehsrfj.pptx 57.39 KB MD5: 686d080a713e96e6621b465d1fbddeb9
SHA1: 673f803920f692da45d934be7c0410e13564ee5e
SHA256: a188db42338e1a893e3efcf5233974a98539ff2871986dd8690f13394b0bde5e 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\os5w-yo1b1y1zoj.rtf 63.03 KB MD5: e20de8de8ce974d60e7776d135036643
SHA1: 340526d76dcd51567f069e5c0712de556e5e907a
SHA256: ac68cbc36e2270687d4e6c6f6d916f374b915c02ed57dce5c40b4b008c0c4cda 		False
...
c:\users\5p5nrgjn0js halpmcxz\desktop\53otcpmpe7hx\zksm86k.docx 79.47 KB MD5: ee013e8d32939eca021ee382c2f1ad90
SHA1: 3017ef878ee8208cd48aa161184156cae86ffc13
SHA256: 781f3bd550c19777b1f0b38177e3571df69cf10709bd2827de45c68762402c6a 		False
...
Host Behavior
COM (1)
»
Operation Class Interface Additional Information Success Count Logfile
Create 96749377-3391-11D2-9EE3-00C04F797396 00000001-0000-0000-C000-000000000046 cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 1
Fn
File (1560)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0xZ6.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0xZ6.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5AQVg.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5AQVg.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9XFUXM 1vTcBLyPYnm.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9XFUXM 1vTcBLyPYnm.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Aa_K6KQHWA.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Aa_K6KQHWA.xlsx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GsPNH93GCRi.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GsPNH93GCRi.pptx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JOza9ejrYOPRehLv0-R.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JOza9ejrYOPRehLv0-R.pptx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KXH8rnPH.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KXH8rnPH.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mSvK.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mSvK.pptx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OSaFg.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OSaFg.xlsx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QohWPOo.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QohWPOo.xlsx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TCcA.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TCcA.xlsx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VaOTVcj53.csv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VaOTVcj53.csv desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vViM8UKlhfCNYsa9mI.csv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vViM8UKlhfCNYsa9mI.csv desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VVsQEpacEkkS.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VVsQEpacEkkS.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WIbix_1nEv11d6KWm05L.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WIbix_1nEv11d6KWm05L.pptx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X7thqq.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X7thqq.xlsx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSYB4DUe828s75uCS t.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSYB4DUe828s75uCS t.pptx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\9ohWCx.csv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\9ohWCx.csv desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\Is2FbGOyb_drVe2 P.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\Is2FbGOyb_drVe2 P.doc desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\lwxjfVxbeT 7vCeGygl.xls desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\lwxjfVxbeT 7vCeGygl.xls desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\UuQJ2vSOV--ZKtOA9E.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\UuQJ2vSOV--ZKtOA9E.doc desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\VCkSFE.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\VCkSFE.xlsx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\9x4Ox9Zi66WORq566n.xls desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\9x4Ox9Zi66WORq566n.xls desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\mxzhTw EXVo.odt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\mxzhTw EXVo.odt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\QcfC96Mjr.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\QcfC96Mjr.doc desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\7Mo7p2ajXrYJR9E.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\7Mo7p2ajXrYJR9E.rtf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\vHPzCHNm-9.pdf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\vHPzCHNm-9.pdf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\HLmH4.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\HLmH4.xlsx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\JdZs.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\JdZs.rtf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\KMqWQFsAbIhhI9P.pdf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\KMqWQFsAbIhhI9P.pdf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\68pVeFV6kR3OEP2I.pdf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\68pVeFV6kR3OEP2I.pdf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\8frJ-ri0s0j5l0bnL0.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\8frJ-ri0s0j5l0bnL0.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\sKNb.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\sKNb.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\zKs2Iiid ESy6.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\zKs2Iiid ESy6.doc desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\BJjUBvkfSUdXx8e.pdf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\BJjUBvkfSUdXx8e.pdf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\ByP3moHkE.odt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\ByP3moHkE.odt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\izz4Jc1gbS.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\izz4Jc1gbS.rtf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\nrGPXtGL5EOvKtsC.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\nrGPXtGL5EOvKtsC.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\Q oVYK_KvWgWH45lu86.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\Q oVYK_KvWgWH45lu86.rtf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\Jsk 9b9p.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\Jsk 9b9p.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\KpLxgJplfaRmRZ5m.ppt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\KpLxgJplfaRmRZ5m.ppt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\qC2b7I.odt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\qC2b7I.odt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\hUmJ9N.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\hUmJ9N.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RUSJ4 m1.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RUSJ4 m1.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SQh i6mBe59Ed2T.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SQh i6mBe59Ed2T.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\svhXap79kwJ1dXgDwQI.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\svhXap79kwJ1dXgDwQI.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\4QWN3LF10ALA6b.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\4QWN3LF10ALA6b.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\D9orYUcU13enryJ.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\D9orYUcU13enryJ.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\lPTPZZ0usr.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\lPTPZZ0usr.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\OFsQSvY_9-O5SRBUC-f.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\OFsQSvY_9-O5SRBUC-f.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\4VK4jynZmL2H7s1bInW6.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\4VK4jynZmL2H7s1bInW6.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\5rMWu4X8kfJ8TV13OI.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\5rMWu4X8kfJ8TV13OI.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\7eyqrwDDTufwEa78.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\7eyqrwDDTufwEa78.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\BqVsUN3uHxNr4KR.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\BqVsUN3uHxNr4KR.bmp desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\cyzIjwPk.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\cyzIjwPk.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\MuYhktmDM.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\MuYhktmDM.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\NyDNoE6ADjhZrNny.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\NyDNoE6ADjhZrNny.bmp desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\yr4nFIveDvX896w.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\yr4nFIveDvX896w.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\5e6mNJ.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\5e6mNJ.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\cTe330FQj4O3F9xHHv3.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\cTe330FQj4O3F9xHHv3.bmp desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\F4gh7x9-.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\F4gh7x9-.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\rr1Ee6x.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\rr1Ee6x.bmp desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\5 xsEsQkJee Fd4wdiEl.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\5 xsEsQkJee Fd4wdiEl.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\AZsni -ULR.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\AZsni -ULR.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Eve0agd3KPqY.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Eve0agd3KPqY.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\hHev8.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\hHev8.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\kcO0kX-t.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\kcO0kX-t.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Ml-82GXwYFnqYhLoN.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Ml-82GXwYFnqYhLoN.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\U1fjsyz.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\U1fjsyz.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\vR-kWPndecD-L4M.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\vR-kWPndecD-L4M.bmp desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\WKnzeOgZNEre45_5yIn.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\WKnzeOgZNEre45_5yIn.bmp desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\01zWrvx.ppt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\01zWrvx.ppt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1G7fsw9R5iByUcV1g3.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1G7fsw9R5iByUcV1g3.mp4 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SCtEpFgj-s.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SCtEpFgj-s.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dMiWOFZ.csv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dMiWOFZ.csv desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E wXC788vA.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E wXC788vA.bmp desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\eCSQc_YSQetHy4sfP Q.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\eCSQc_YSQetHy4sfP Q.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FDernCcw.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FDernCcw.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Fukr.odt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Fukr.odt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jww eHSrFj.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jww eHSrFj.pptx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O1DNiN_torm0c32phrbO.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O1DNiN_torm0c32phrbO.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OS5w-yo1B1y1Zoj.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OS5w-yo1B1y1Zoj.rtf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PFD82kmu.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PFD82kmu.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SaTcx9nUTAAxStWMXB.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SaTcx9nUTAAxStWMXB.pptx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VJXPZNfyV9DC.odt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VJXPZNfyV9DC.odt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Xp5sKnOAFUzblkTHWf.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Xp5sKnOAFUzblkTHWf.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\qB61ws.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\qB61ws.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\zKSm86k.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\zKSm86k.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\B8eEDu5rS9Qt.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\B8eEDu5rS9Qt.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\KUfKgE8e_3TsEPhAZw.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\KUfKgE8e_3TsEPhAZw.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\DXXyWug.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\DXXyWug.pptx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\ovJDA2WhK.avi desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\ovJDA2WhK.avi desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\PBCSaW8baRzkhg\R4X-N5oyI Mg288u.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\PBCSaW8baRzkhg\R4X-N5oyI Mg288u.xlsx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\Hn 1FheC4pEyIsKDKwCk.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\Hn 1FheC4pEyIsKDKwCk.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\yXEUThDAK.ppt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\yXEUThDAK.ppt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\ekvTEdI3HGiT.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\ekvTEdI3HGiT.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\PEllq xVTj8zFKUweE.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\PEllq xVTj8zFKUweE.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\GNCucpScFXtVc9ad.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\GNCucpScFXtVc9ad.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\L OP.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\L OP.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\uXgIQG_18Rni5Nq9LF.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\uXgIQG_18Rni5Nq9LF.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\yTctsumRWh1CPRYn.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\yTctsumRWh1CPRYn.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\AKC-l-Vx\wY6OE3NEW26UepDqh_\_UNFIJl-.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\AKC-l-Vx\wY6OE3NEW26UepDqh_\_UNFIJl-.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\jGSuiwU2\skoVQzoY8I53ARRB.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\jGSuiwU2\skoVQzoY8I53ARRB.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\3ZwE2-Nh.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\3ZwE2-Nh.rtf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\b M-6pZp2CxTeXe N.avi desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\b M-6pZp2CxTeXe N.avi desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\DR1A9fjyB6ohZsGYw1x.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\DR1A9fjyB6ohZsGYw1x.bmp desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Exlimxnopc.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Exlimxnopc.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\fYvNAZXTqQ2JUONn6.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\fYvNAZXTqQ2JUONn6.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\K-qbFP1VgOcIyNJ1 N.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\K-qbFP1VgOcIyNJ1 N.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\kveODEn.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\kveODEn.flv desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\M-1Llo1xSmqy.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\M-1Llo1xSmqy.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\OuJZQBIvdUif6pI.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\OuJZQBIvdUif6pI.docx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\PqINwRM.xls desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\PqINwRM.xls desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\TDBbJpIDntVK8-dU.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\TDBbJpIDntVK8-dU.png desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\VEPxh_ jzar.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\VEPxh_ jzar.gif desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\wVHDIdgpq5gSDM_.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\wVHDIdgpq5gSDM_.mp3 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9RRw.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9RRw.flv desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9UZbI.pdf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9UZbI.pdf desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_Fwwi71JjtrYVqN.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_Fwwi71JjtrYVqN.pptx desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.xml desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\CREDHIST desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\CREDHIST desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\SYNCHIST desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\SYNCHIST desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\Preferred desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\Preferred desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\02540a10-7eb7-4b20-a8c7-470f8986389c desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\02540a10-7eb7-4b20-a8c7-470f8986389c desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\2be989a0-16a1-424b-9211-51aa3bb43e5d desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\2be989a0-16a1-424b-9211-51aa3bb43e5d desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\fbbe72db-afd8-443b-88dd-64b20388700d desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\fbbe72db-afd8-443b-88dd-64b20388700d desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\Preferred desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\Preferred desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[3].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[3].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@demdex[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@demdex[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@everesttech[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@everesttech[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@google[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@google[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@ml314[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@ml314[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@rlcdn[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@rlcdn[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adformdsp[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adformdsp[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adform[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adform[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adnxs[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adnxs[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtech[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtech[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtr02[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtr02[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@advertising[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@advertising[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@api.bing[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@api.bing[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@at.atwola[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@at.atwola[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@bing[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@bing[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.bing[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.bing[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.msn[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.msn[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@doubleclick[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@doubleclick[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[3].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[3].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[4].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[4].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@linkedin[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@linkedin[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@m.exactag[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@m.exactag[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@msn[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@msn[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@skadtec[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@skadtec[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@track.adform[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@track.adform[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.bing[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.bing[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.msn[2].txt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.msn[2].txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20131025151332 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20131025151332 desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temprunsom.config type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0xZ6.docx type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0xZ6.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\machine.config type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0xZ6.docx type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0xZ6.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5AQVg.docx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5AQVg.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5AQVg.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9XFUXM 1vTcBLyPYnm.docx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9XFUXM 1vTcBLyPYnm.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Aa_K6KQHWA.xlsx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Aa_K6KQHWA.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GsPNH93GCRi.pptx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GsPNH93GCRi.pptx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JOza9ejrYOPRehLv0-R.pptx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JOza9ejrYOPRehLv0-R.pptx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JOza9ejrYOPRehLv0-R.pptx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KXH8rnPH.docx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KXH8rnPH.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mSvK.pptx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mSvK.pptx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OSaFg.xlsx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OSaFg.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QohWPOo.xlsx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QohWPOo.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TCcA.xlsx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TCcA.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VaOTVcj53.csv type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VaOTVcj53.csv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VaOTVcj53.csv type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vViM8UKlhfCNYsa9mI.csv type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vViM8UKlhfCNYsa9mI.csv type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VVsQEpacEkkS.docx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VVsQEpacEkkS.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WIbix_1nEv11d6KWm05L.pptx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WIbix_1nEv11d6KWm05L.pptx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WIbix_1nEv11d6KWm05L.pptx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X7thqq.xlsx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X7thqq.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSYB4DUe828s75uCS t.pptx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSYB4DUe828s75uCS t.pptx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\9ohWCx.csv type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\9ohWCx.csv type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\Is2FbGOyb_drVe2 P.doc type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\Is2FbGOyb_drVe2 P.doc type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\Is2FbGOyb_drVe2 P.doc type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\lwxjfVxbeT 7vCeGygl.xls type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\lwxjfVxbeT 7vCeGygl.xls type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\lwxjfVxbeT 7vCeGygl.xls type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\UuQJ2vSOV--ZKtOA9E.doc type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\UuQJ2vSOV--ZKtOA9E.doc type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\VCkSFE.xlsx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\VCkSFE.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\9x4Ox9Zi66WORq566n.xls type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\9x4Ox9Zi66WORq566n.xls type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\9x4Ox9Zi66WORq566n.xls type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\mxzhTw EXVo.odt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\mxzhTw EXVo.odt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\QcfC96Mjr.doc type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\QcfC96Mjr.doc type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\7Mo7p2ajXrYJR9E.rtf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\7Mo7p2ajXrYJR9E.rtf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\7Mo7p2ajXrYJR9E.rtf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\vHPzCHNm-9.pdf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\vHPzCHNm-9.pdf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\vHPzCHNm-9.pdf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\HLmH4.xlsx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\HLmH4.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\JdZs.rtf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\JdZs.rtf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\KMqWQFsAbIhhI9P.pdf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\KMqWQFsAbIhhI9P.pdf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\68pVeFV6kR3OEP2I.pdf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\68pVeFV6kR3OEP2I.pdf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\68pVeFV6kR3OEP2I.pdf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\8frJ-ri0s0j5l0bnL0.docx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\8frJ-ri0s0j5l0bnL0.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\sKNb.docx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\sKNb.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\zKs2Iiid ESy6.doc type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\zKs2Iiid ESy6.doc type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\BJjUBvkfSUdXx8e.pdf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\BJjUBvkfSUdXx8e.pdf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\BJjUBvkfSUdXx8e.pdf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\ByP3moHkE.odt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\ByP3moHkE.odt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\ByP3moHkE.odt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\izz4Jc1gbS.rtf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\izz4Jc1gbS.rtf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\nrGPXtGL5EOvKtsC.docx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\nrGPXtGL5EOvKtsC.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\Q oVYK_KvWgWH45lu86.rtf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\Q oVYK_KvWgWH45lu86.rtf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\Q oVYK_KvWgWH45lu86.rtf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\Jsk 9b9p.docx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\Jsk 9b9p.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\Jsk 9b9p.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\KpLxgJplfaRmRZ5m.ppt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\KpLxgJplfaRmRZ5m.ppt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\qC2b7I.odt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\qC2b7I.odt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\hUmJ9N.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\hUmJ9N.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\hUmJ9N.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RUSJ4 m1.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RUSJ4 m1.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SQh i6mBe59Ed2T.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SQh i6mBe59Ed2T.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\svhXap79kwJ1dXgDwQI.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\svhXap79kwJ1dXgDwQI.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\4QWN3LF10ALA6b.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\4QWN3LF10ALA6b.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\4QWN3LF10ALA6b.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\D9orYUcU13enryJ.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\D9orYUcU13enryJ.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\lPTPZZ0usr.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\lPTPZZ0usr.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\OFsQSvY_9-O5SRBUC-f.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\OFsQSvY_9-O5SRBUC-f.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\4VK4jynZmL2H7s1bInW6.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\4VK4jynZmL2H7s1bInW6.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\4VK4jynZmL2H7s1bInW6.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\5rMWu4X8kfJ8TV13OI.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\5rMWu4X8kfJ8TV13OI.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\5rMWu4X8kfJ8TV13OI.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\7eyqrwDDTufwEa78.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\7eyqrwDDTufwEa78.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\7eyqrwDDTufwEa78.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\BqVsUN3uHxNr4KR.bmp type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\BqVsUN3uHxNr4KR.bmp type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\cyzIjwPk.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\cyzIjwPk.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\MuYhktmDM.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\MuYhktmDM.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\MuYhktmDM.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\NyDNoE6ADjhZrNny.bmp type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\NyDNoE6ADjhZrNny.bmp type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\yr4nFIveDvX896w.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\yr4nFIveDvX896w.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\5e6mNJ.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\5e6mNJ.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\cTe330FQj4O3F9xHHv3.bmp type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\cTe330FQj4O3F9xHHv3.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\cTe330FQj4O3F9xHHv3.bmp type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\F4gh7x9-.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\F4gh7x9-.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\rr1Ee6x.bmp type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\rr1Ee6x.bmp type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\5 xsEsQkJee Fd4wdiEl.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\5 xsEsQkJee Fd4wdiEl.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\5 xsEsQkJee Fd4wdiEl.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\AZsni -ULR.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\AZsni -ULR.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Eve0agd3KPqY.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Eve0agd3KPqY.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\hHev8.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\hHev8.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\kcO0kX-t.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\kcO0kX-t.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Ml-82GXwYFnqYhLoN.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Ml-82GXwYFnqYhLoN.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\U1fjsyz.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\U1fjsyz.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\U1fjsyz.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\vR-kWPndecD-L4M.bmp type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\vR-kWPndecD-L4M.bmp type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\WKnzeOgZNEre45_5yIn.bmp type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\WKnzeOgZNEre45_5yIn.bmp type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\01zWrvx.ppt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\01zWrvx.ppt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\01zWrvx.ppt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1G7fsw9R5iByUcV1g3.mp4 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1G7fsw9R5iByUcV1g3.mp4 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SCtEpFgj-s.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SCtEpFgj-s.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dMiWOFZ.csv type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dMiWOFZ.csv type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E wXC788vA.bmp type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E wXC788vA.bmp type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\eCSQc_YSQetHy4sfP Q.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\eCSQc_YSQetHy4sfP Q.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FDernCcw.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FDernCcw.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Fukr.odt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Fukr.odt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jww eHSrFj.pptx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jww eHSrFj.pptx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O1DNiN_torm0c32phrbO.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O1DNiN_torm0c32phrbO.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O1DNiN_torm0c32phrbO.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OS5w-yo1B1y1Zoj.rtf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OS5w-yo1B1y1Zoj.rtf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PFD82kmu.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PFD82kmu.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PFD82kmu.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SaTcx9nUTAAxStWMXB.pptx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SaTcx9nUTAAxStWMXB.pptx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VJXPZNfyV9DC.odt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VJXPZNfyV9DC.odt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Xp5sKnOAFUzblkTHWf.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Xp5sKnOAFUzblkTHWf.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\qB61ws.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\qB61ws.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\qB61ws.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\zKSm86k.docx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\zKSm86k.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\B8eEDu5rS9Qt.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\B8eEDu5rS9Qt.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\B8eEDu5rS9Qt.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\KUfKgE8e_3TsEPhAZw.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\KUfKgE8e_3TsEPhAZw.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\DXXyWug.pptx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\DXXyWug.pptx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\ovJDA2WhK.avi type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\ovJDA2WhK.avi type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\ovJDA2WhK.avi type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\PBCSaW8baRzkhg\R4X-N5oyI Mg288u.xlsx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\PBCSaW8baRzkhg\R4X-N5oyI Mg288u.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\Hn 1FheC4pEyIsKDKwCk.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\Hn 1FheC4pEyIsKDKwCk.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\Hn 1FheC4pEyIsKDKwCk.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\yXEUThDAK.ppt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\yXEUThDAK.ppt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\ekvTEdI3HGiT.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\ekvTEdI3HGiT.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\ekvTEdI3HGiT.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\PEllq xVTj8zFKUweE.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\PEllq xVTj8zFKUweE.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\PEllq xVTj8zFKUweE.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\GNCucpScFXtVc9ad.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\GNCucpScFXtVc9ad.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\L OP.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\L OP.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\uXgIQG_18Rni5Nq9LF.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\uXgIQG_18Rni5Nq9LF.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\yTctsumRWh1CPRYn.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\yTctsumRWh1CPRYn.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\AKC-l-Vx\wY6OE3NEW26UepDqh_\_UNFIJl-.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\AKC-l-Vx\wY6OE3NEW26UepDqh_\_UNFIJl-.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\jGSuiwU2\skoVQzoY8I53ARRB.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\jGSuiwU2\skoVQzoY8I53ARRB.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\3ZwE2-Nh.rtf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\3ZwE2-Nh.rtf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\b M-6pZp2CxTeXe N.avi type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\b M-6pZp2CxTeXe N.avi type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\DR1A9fjyB6ohZsGYw1x.bmp type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\DR1A9fjyB6ohZsGYw1x.bmp type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Exlimxnopc.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Exlimxnopc.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\fYvNAZXTqQ2JUONn6.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\fYvNAZXTqQ2JUONn6.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\K-qbFP1VgOcIyNJ1 N.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\K-qbFP1VgOcIyNJ1 N.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\kveODEn.flv type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\kveODEn.flv type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\M-1Llo1xSmqy.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\M-1Llo1xSmqy.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\OuJZQBIvdUif6pI.docx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\OuJZQBIvdUif6pI.docx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\PqINwRM.xls type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\PqINwRM.xls type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\TDBbJpIDntVK8-dU.png type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\TDBbJpIDntVK8-dU.png type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\VEPxh_ jzar.gif type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\VEPxh_ jzar.gif type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\wVHDIdgpq5gSDM_.mp3 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\wVHDIdgpq5gSDM_.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9RRw.flv type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9RRw.flv type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9UZbI.pdf type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9UZbI.pdf type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_Fwwi71JjtrYVqN.pptx type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_Fwwi71JjtrYVqN.pptx type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.xml type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.xml type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\CREDHIST type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\SYNCHIST type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9 type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3111613574-2524581245-2586426736-500\Preferred type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\02540a10-7eb7-4b20-a8c7-470f8986389c type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\2be989a0-16a1-424b-9211-51aa3bb43e5d type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\fbbe72db-afd8-443b-88dd-64b20388700d type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\S-1-5-21-3388679973-3930757225-3770151564-1000\Preferred type = file_type True 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[3].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[3].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@demdex[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@demdex[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@everesttech[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@everesttech[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@google[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@google[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@ml314[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@ml314[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@rlcdn[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@rlcdn[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adformdsp[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adformdsp[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adform[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adform[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adnxs[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adnxs[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtech[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtech[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtr02[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtr02[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@advertising[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@advertising[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@api.bing[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@api.bing[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@at.atwola[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@at.atwola[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@bing[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@bing[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.bing[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.bing[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.msn[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.msn[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@doubleclick[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@doubleclick[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[3].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[3].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[4].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[4].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@linkedin[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@linkedin[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@m.exactag[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@m.exactag[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@msn[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@msn[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@skadtec[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@skadtec[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@track.adform[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@track.adform[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.bing[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.bing[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.msn[2].txt type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.msn[2].txt type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20131025151332 type = file_type True 4
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20131025151332 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt type = file_type True 2
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0xZ6.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0xZ6.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5AQVg.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5AQVg.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9XFUXM 1vTcBLyPYnm.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9XFUXM 1vTcBLyPYnm.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Aa_K6KQHWA.xlsx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Aa_K6KQHWA.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GsPNH93GCRi.pptx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GsPNH93GCRi.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JOza9ejrYOPRehLv0-R.pptx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JOza9ejrYOPRehLv0-R.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KXH8rnPH.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KXH8rnPH.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mSvK.pptx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mSvK.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OSaFg.xlsx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OSaFg.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QohWPOo.xlsx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QohWPOo.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TCcA.xlsx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TCcA.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VaOTVcj53.csv.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VaOTVcj53.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vViM8UKlhfCNYsa9mI.csv.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vViM8UKlhfCNYsa9mI.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VVsQEpacEkkS.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VVsQEpacEkkS.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WIbix_1nEv11d6KWm05L.pptx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WIbix_1nEv11d6KWm05L.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X7thqq.xlsx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X7thqq.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSYB4DUe828s75uCS t.pptx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSYB4DUe828s75uCS t.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\9ohWCx.csv.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\9ohWCx.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\Is2FbGOyb_drVe2 P.doc.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\Is2FbGOyb_drVe2 P.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\lwxjfVxbeT 7vCeGygl.xls.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\lwxjfVxbeT 7vCeGygl.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\UuQJ2vSOV--ZKtOA9E.doc.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\UuQJ2vSOV--ZKtOA9E.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\VCkSFE.xlsx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\VCkSFE.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\9x4Ox9Zi66WORq566n.xls.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\9x4Ox9Zi66WORq566n.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\mxzhTw EXVo.odt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\mxzhTw EXVo.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\QcfC96Mjr.doc.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\QcfC96Mjr.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\7Mo7p2ajXrYJR9E.rtf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\7Mo7p2ajXrYJR9E.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\vHPzCHNm-9.pdf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\vHPzCHNm-9.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\HLmH4.xlsx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\HLmH4.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\JdZs.rtf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\JdZs.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\KMqWQFsAbIhhI9P.pdf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\KMqWQFsAbIhhI9P.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\68pVeFV6kR3OEP2I.pdf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\68pVeFV6kR3OEP2I.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\8frJ-ri0s0j5l0bnL0.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\8frJ-ri0s0j5l0bnL0.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\sKNb.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\sKNb.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\zKs2Iiid ESy6.doc.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\zKs2Iiid ESy6.doc True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\BJjUBvkfSUdXx8e.pdf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\BJjUBvkfSUdXx8e.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\ByP3moHkE.odt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\ByP3moHkE.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\izz4Jc1gbS.rtf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\izz4Jc1gbS.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\nrGPXtGL5EOvKtsC.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\nrGPXtGL5EOvKtsC.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\Q oVYK_KvWgWH45lu86.rtf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\Q oVYK_KvWgWH45lu86.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\Jsk 9b9p.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\Jsk 9b9p.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\KpLxgJplfaRmRZ5m.ppt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\KpLxgJplfaRmRZ5m.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\qC2b7I.odt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\qC2b7I.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\hUmJ9N.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\hUmJ9N.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RUSJ4 m1.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RUSJ4 m1.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SQh i6mBe59Ed2T.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SQh i6mBe59Ed2T.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\svhXap79kwJ1dXgDwQI.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\svhXap79kwJ1dXgDwQI.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\4QWN3LF10ALA6b.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\4QWN3LF10ALA6b.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\D9orYUcU13enryJ.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\D9orYUcU13enryJ.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\lPTPZZ0usr.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\lPTPZZ0usr.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\OFsQSvY_9-O5SRBUC-f.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\OFsQSvY_9-O5SRBUC-f.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\4VK4jynZmL2H7s1bInW6.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\4VK4jynZmL2H7s1bInW6.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\5rMWu4X8kfJ8TV13OI.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\5rMWu4X8kfJ8TV13OI.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\7eyqrwDDTufwEa78.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\7eyqrwDDTufwEa78.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\BqVsUN3uHxNr4KR.bmp.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\BqVsUN3uHxNr4KR.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\cyzIjwPk.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\cyzIjwPk.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\MuYhktmDM.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\MuYhktmDM.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\NyDNoE6ADjhZrNny.bmp.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\NyDNoE6ADjhZrNny.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\yr4nFIveDvX896w.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\yr4nFIveDvX896w.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\5e6mNJ.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\5e6mNJ.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\cTe330FQj4O3F9xHHv3.bmp.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\cTe330FQj4O3F9xHHv3.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\F4gh7x9-.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\F4gh7x9-.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\rr1Ee6x.bmp.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\rr1Ee6x.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\5 xsEsQkJee Fd4wdiEl.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\5 xsEsQkJee Fd4wdiEl.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\AZsni -ULR.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\AZsni -ULR.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Eve0agd3KPqY.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Eve0agd3KPqY.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\hHev8.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\hHev8.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\kcO0kX-t.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\kcO0kX-t.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Ml-82GXwYFnqYhLoN.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Ml-82GXwYFnqYhLoN.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\U1fjsyz.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\U1fjsyz.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\vR-kWPndecD-L4M.bmp.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\vR-kWPndecD-L4M.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\WKnzeOgZNEre45_5yIn.bmp.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\WKnzeOgZNEre45_5yIn.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\01zWrvx.ppt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\01zWrvx.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1G7fsw9R5iByUcV1g3.mp4.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1G7fsw9R5iByUcV1g3.mp4 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SCtEpFgj-s.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SCtEpFgj-s.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dMiWOFZ.csv.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dMiWOFZ.csv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E wXC788vA.bmp.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E wXC788vA.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\eCSQc_YSQetHy4sfP Q.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\eCSQc_YSQetHy4sfP Q.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FDernCcw.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FDernCcw.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Fukr.odt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Fukr.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jww eHSrFj.pptx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jww eHSrFj.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O1DNiN_torm0c32phrbO.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O1DNiN_torm0c32phrbO.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OS5w-yo1B1y1Zoj.rtf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OS5w-yo1B1y1Zoj.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PFD82kmu.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PFD82kmu.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SaTcx9nUTAAxStWMXB.pptx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SaTcx9nUTAAxStWMXB.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VJXPZNfyV9DC.odt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VJXPZNfyV9DC.odt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Xp5sKnOAFUzblkTHWf.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Xp5sKnOAFUzblkTHWf.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\qB61ws.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\qB61ws.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\zKSm86k.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\zKSm86k.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\B8eEDu5rS9Qt.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\B8eEDu5rS9Qt.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\KUfKgE8e_3TsEPhAZw.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\KUfKgE8e_3TsEPhAZw.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\DXXyWug.pptx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\DXXyWug.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\ovJDA2WhK.avi.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\ovJDA2WhK.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\PBCSaW8baRzkhg\R4X-N5oyI Mg288u.xlsx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\PBCSaW8baRzkhg\R4X-N5oyI Mg288u.xlsx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\Hn 1FheC4pEyIsKDKwCk.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\Hn 1FheC4pEyIsKDKwCk.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\yXEUThDAK.ppt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\yXEUThDAK.ppt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\ekvTEdI3HGiT.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\ekvTEdI3HGiT.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\PEllq xVTj8zFKUweE.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\PEllq xVTj8zFKUweE.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\GNCucpScFXtVc9ad.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\GNCucpScFXtVc9ad.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\L OP.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\L OP.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\uXgIQG_18Rni5Nq9LF.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\uXgIQG_18Rni5Nq9LF.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\yTctsumRWh1CPRYn.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\yTctsumRWh1CPRYn.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\AKC-l-Vx\wY6OE3NEW26UepDqh_\_UNFIJl-.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\AKC-l-Vx\wY6OE3NEW26UepDqh_\_UNFIJl-.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\jGSuiwU2\skoVQzoY8I53ARRB.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\jGSuiwU2\skoVQzoY8I53ARRB.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\3ZwE2-Nh.rtf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\3ZwE2-Nh.rtf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\b M-6pZp2CxTeXe N.avi.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\b M-6pZp2CxTeXe N.avi True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\DR1A9fjyB6ohZsGYw1x.bmp.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\DR1A9fjyB6ohZsGYw1x.bmp True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Exlimxnopc.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Exlimxnopc.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\fYvNAZXTqQ2JUONn6.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\fYvNAZXTqQ2JUONn6.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\K-qbFP1VgOcIyNJ1 N.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\K-qbFP1VgOcIyNJ1 N.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\kveODEn.flv.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\kveODEn.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\M-1Llo1xSmqy.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\M-1Llo1xSmqy.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\OuJZQBIvdUif6pI.docx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\OuJZQBIvdUif6pI.docx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\PqINwRM.xls.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\PqINwRM.xls True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\TDBbJpIDntVK8-dU.png.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\TDBbJpIDntVK8-dU.png True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\VEPxh_ jzar.gif.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\VEPxh_ jzar.gif True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\wVHDIdgpq5gSDM_.mp3.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\wVHDIdgpq5gSDM_.mp3 True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9RRw.flv.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9RRw.flv True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9UZbI.pdf.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9UZbI.pdf True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_Fwwi71JjtrYVqN.pptx.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_Fwwi71JjtrYVqN.pptx True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.xml.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\Outlook.xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[3].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[3].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@demdex[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@demdex[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@everesttech[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@everesttech[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@google[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@google[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@ml314[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@ml314[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@rlcdn[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adformdsp[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adform[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adform[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adnxs[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adnxs[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtech[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtech[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtr02[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtr02[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@advertising[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@advertising[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@api.bing[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@api.bing[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@at.atwola[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@bing[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@bing[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.bing[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.bing[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.msn[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.msn[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@doubleclick[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[3].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[3].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[4].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[4].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@linkedin[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@linkedin[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@m.exactag[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@msn[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@msn[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@skadtec[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@skadtec[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@track.adform[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@track.adform[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.bing[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.bing[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.msn[2].txt.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.msn[2].txt True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg True 1
Fn
Move C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20131025151332.LanRan2.0.5 source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20131025151332 True 1
Fn
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0xZ6.docx size = 77238, size_out = 77238 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5AQVg.docx size = 51596, size_out = 51596 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\9XFUXM 1vTcBLyPYnm.docx size = 55950, size_out = 55950 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\Aa_K6KQHWA.xlsx size = 84878, size_out = 84878 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\GsPNH93GCRi.pptx size = 78898, size_out = 78898 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\JOza9ejrYOPRehLv0-R.pptx size = 18919, size_out = 18919 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\KXH8rnPH.docx size = 53927, size_out = 53927 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\mSvK.pptx size = 60830, size_out = 60830 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\OSaFg.xlsx size = 91790, size_out = 91790 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\QohWPOo.xlsx size = 68819, size_out = 68819 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\TCcA.xlsx size = 4096, size_out = 1297 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VaOTVcj53.csv size = 85192, size_out = 85192 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\vViM8UKlhfCNYsa9mI.csv size = 42697, size_out = 42697 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\VVsQEpacEkkS.docx size = 15843, size_out = 15843 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\WIbix_1nEv11d6KWm05L.pptx size = 45154, size_out = 45154 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\X7thqq.xlsx size = 74478, size_out = 74478 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\XSYB4DUe828s75uCS t.pptx size = 78605, size_out = 78605 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\9ohWCx.csv size = 47523, size_out = 47523 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\Is2FbGOyb_drVe2 P.doc size = 37791, size_out = 37791 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\lwxjfVxbeT 7vCeGygl.xls size = 51428, size_out = 51428 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\UuQJ2vSOV--ZKtOA9E.doc size = 6745, size_out = 6745 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\VCkSFE.xlsx size = 87910, size_out = 87910 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\9x4Ox9Zi66WORq566n.xls size = 87440, size_out = 87440 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\mxzhTw EXVo.odt size = 68733, size_out = 68733 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\QcfC96Mjr.doc size = 100437, size_out = 100437 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\7Mo7p2ajXrYJR9E.rtf size = 82673, size_out = 82673 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\gfYOriKcxDMvbjAlTO\Zx_H419X-lWtnXsKpv6\vHPzCHNm-9.pdf size = 37475, size_out = 37475 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\HLmH4.xlsx size = 90307, size_out = 90307 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\JdZs.rtf size = 7452, size_out = 7452 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\KMqWQFsAbIhhI9P.pdf size = 66943, size_out = 66943 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\68pVeFV6kR3OEP2I.pdf size = 90857, size_out = 90857 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\8frJ-ri0s0j5l0bnL0.docx size = 49723, size_out = 49723 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\sKNb.docx size = 8318, size_out = 8318 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\Cuoac7Cx20oxV\A21mp_0hc61caIu\zKs2Iiid ESy6.doc size = 43306, size_out = 43306 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\BJjUBvkfSUdXx8e.pdf size = 27154, size_out = 27154 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\ByP3moHkE.odt size = 49012, size_out = 49012 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\izz4Jc1gbS.rtf size = 18766, size_out = 18766 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\nrGPXtGL5EOvKtsC.docx size = 63257, size_out = 63257 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\aMZs0-MTUPZZ4CF\XSRU4lI2eOc0v44\_omF x\Q oVYK_KvWgWH45lu86.rtf size = 45394, size_out = 45394 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico size = 29926, size_out = 29926 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\Jsk 9b9p.docx size = 75152, size_out = 75152 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\KpLxgJplfaRmRZ5m.ppt size = 57216, size_out = 57216 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Documents\xFoWV83ToSRPBZP9\qC2b7I.odt size = 69262, size_out = 69262 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\hUmJ9N.gif size = 60798, size_out = 60798 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\RUSJ4 m1.png size = 14922, size_out = 14922 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\SQh i6mBe59Ed2T.gif size = 47139, size_out = 47139 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\svhXap79kwJ1dXgDwQI.gif size = 57947, size_out = 57947 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\4QWN3LF10ALA6b.gif size = 71072, size_out = 71072 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\D9orYUcU13enryJ.png size = 24729, size_out = 24729 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\lPTPZZ0usr.png size = 11845, size_out = 11845 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\OFsQSvY_9-O5SRBUC-f.gif size = 9289, size_out = 9289 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\4VK4jynZmL2H7s1bInW6.gif size = 57036, size_out = 57036 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\5rMWu4X8kfJ8TV13OI.gif size = 29554, size_out = 29554 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\7eyqrwDDTufwEa78.jpg size = 29304, size_out = 29304 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\BqVsUN3uHxNr4KR.bmp size = 62416, size_out = 62416 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\cyzIjwPk.jpg size = 98932, size_out = 98932 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\MuYhktmDM.jpg size = 56570, size_out = 56570 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\NyDNoE6ADjhZrNny.bmp size = 57478, size_out = 57478 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\yr4nFIveDvX896w.png size = 87478, size_out = 87478 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\5e6mNJ.jpg size = 82441, size_out = 82441 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\cTe330FQj4O3F9xHHv3.bmp size = 32545, size_out = 32545 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\F4gh7x9-.gif size = 78785, size_out = 78785 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\wNoQiWNK2EuCp\qcl6r7WOC3TF\rr1Ee6x.bmp size = 99792, size_out = 99792 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\5 xsEsQkJee Fd4wdiEl.jpg size = 63397, size_out = 63397 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\AZsni -ULR.png size = 65182, size_out = 65182 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Eve0agd3KPqY.png size = 43933, size_out = 43933 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\hHev8.gif size = 21979, size_out = 21979 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\kcO0kX-t.jpg size = 90050, size_out = 90050 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\Ml-82GXwYFnqYhLoN.gif size = 29170, size_out = 29170 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\U1fjsyz.jpg size = 39140, size_out = 39140 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\vR-kWPndecD-L4M.bmp size = 37690, size_out = 37690 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\lzwU1zxUs7HZu2wbFCQ\zDFQPSXm44McM\WKnzeOgZNEre45_5yIn.bmp size = 81726, size_out = 81726 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\01zWrvx.ppt size = 23136, size_out = 23136 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1G7fsw9R5iByUcV1g3.mp4 size = 42202, size_out = 42202 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7SCtEpFgj-s.jpg size = 31521, size_out = 31521 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt size = 4096, size_out = 1686 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dMiWOFZ.csv size = 48833, size_out = 48833 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E wXC788vA.bmp size = 18968, size_out = 18968 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\eCSQc_YSQetHy4sfP Q.png size = 10377, size_out = 10377 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\FDernCcw.mp3 size = 12026, size_out = 12026 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Fukr.odt size = 7794, size_out = 7794 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Jww eHSrFj.pptx size = 58764, size_out = 58764 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe size = 214016, size_out = 214016 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\O1DNiN_torm0c32phrbO.gif size = 37158, size_out = 37158 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\OS5w-yo1B1y1Zoj.rtf size = 64537, size_out = 64537 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\PFD82kmu.jpg size = 78203, size_out = 78203 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SaTcx9nUTAAxStWMXB.pptx size = 33945, size_out = 33945 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\VJXPZNfyV9DC.odt size = 39387, size_out = 39387 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Xp5sKnOAFUzblkTHWf.png size = 5341, size_out = 5341 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\qB61ws.jpg size = 11064, size_out = 11064 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\zKSm86k.docx size = 81372, size_out = 81372 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\B8eEDu5rS9Qt.mp3 size = 36338, size_out = 36338 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\53otCpmPe7hX\dhcC\KUfKgE8e_3TsEPhAZw.png size = 24434, size_out = 24434 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\DXXyWug.pptx size = 68573, size_out = 68573 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\ovJDA2WhK.avi size = 40276, size_out = 40276 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\PBCSaW8baRzkhg\R4X-N5oyI Mg288u.xlsx size = 21604, size_out = 21604 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\Hn 1FheC4pEyIsKDKwCk.mp3 size = 11726, size_out = 11726 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\hu-0kPxnlm7RItR_t 4\tjTCOb3z\yXEUThDAK.ppt size = 45089, size_out = 45089 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\ekvTEdI3HGiT.mp3 size = 27674, size_out = 27674 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\PEllq xVTj8zFKUweE.mp3 size = 95427, size_out = 95427 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\GNCucpScFXtVc9ad.mp3 size = 50192, size_out = 50192 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\L OP.mp3 size = 100101, size_out = 100101 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\uXgIQG_18Rni5Nq9LF.mp3 size = 77488, size_out = 77488 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\BW2Ai 23ohEUW-U-\65KBbTyvWQXb_\Sj9Iur0ZVVAjIF\hS3QNP_\yTctsumRWh1CPRYn.mp3 size = 26478, size_out = 26478 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\AKC-l-Vx\wY6OE3NEW26UepDqh_\_UNFIJl-.mp3 size = 25559, size_out = 25559 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Music\tKHyuA06i3Ez\jGSuiwU2\skoVQzoY8I53ARRB.mp3 size = 91024, size_out = 91024 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KryptoTrojaner.exe size = 214016, size_out = 214016 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\3ZwE2-Nh.rtf size = 36861, size_out = 36861 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\b M-6pZp2CxTeXe N.avi size = 7811, size_out = 7811 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\DR1A9fjyB6ohZsGYw1x.bmp size = 90607, size_out = 90607 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Exlimxnopc.png size = 66386, size_out = 66386 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\fYvNAZXTqQ2JUONn6.mp3 size = 94183, size_out = 94183 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\K-qbFP1VgOcIyNJ1 N.png size = 31151, size_out = 31151 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\kveODEn.flv size = 27662, size_out = 27662 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\M-1Llo1xSmqy.mp3 size = 97750, size_out = 97750 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\OuJZQBIvdUif6pI.docx size = 39055, size_out = 39055 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\PqINwRM.xls size = 70096, size_out = 70096 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\TDBbJpIDntVK8-dU.png size = 66048, size_out = 66048 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\VEPxh_ jzar.gif size = 34309, size_out = 34309 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\wVHDIdgpq5gSDM_.mp3 size = 22787, size_out = 22787 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9RRw.flv size = 4096, size_out = 1600 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_9UZbI.pdf size = 79539, size_out = 79539 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_Fwwi71JjtrYVqN.pptx size = 82521, size_out = 82521 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[1].txt size = 4096, size_out = 83 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@adobe[3].txt size = 4096, size_out = 551 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@demdex[1].txt size = 4096, size_out = 241 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt size = 4096, size_out = 111 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@everesttech[1].txt size = 4096, size_out = 110 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@google[2].txt size = 4096, size_out = 276 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@ml314[1].txt size = 4096, size_out = 86 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\5p5nrgjn0js_halpmcxz@rlcdn[2].txt size = 4096, size_out = 414 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt size = 4096, size_out = 102 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt size = 4096, size_out = 102 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adformdsp[1].txt size = 4096, size_out = 93 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adform[1].txt size = 4096, size_out = 234 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adnxs[1].txt size = 4096, size_out = 578 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtech[2].txt size = 4096, size_out = 101 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@adtr02[1].txt size = 4096, size_out = 82 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@advertising[1].txt size = 4096, size_out = 293 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@api.bing[2].txt size = 4096, size_out = 221 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@at.atwola[1].txt size = 4096, size_out = 513 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@bing[1].txt size = 4096, size_out = 490 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.bing[1].txt size = 4096, size_out = 456 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@c.msn[1].txt size = 4096, size_out = 130 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@doubleclick[2].txt size = 4096, size_out = 272 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[1].txt size = 4096, size_out = 598 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[3].txt size = 4096, size_out = 196 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@google[4].txt size = 4096, size_out = 543 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@linkedin[1].txt size = 4096, size_out = 272 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@m.exactag[1].txt size = 4096, size_out = 118 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@msn[1].txt size = 4096, size_out = 823 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt size = 4096, size_out = 206 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt size = 4096, size_out = 108 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@skadtec[1].txt size = 4096, size_out = 104 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@track.adform[2].txt size = 4096, size_out = 178 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.bing[2].txt size = 4096, size_out = 215 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt size = 4096, size_out = 169 True 1
Fn
Data
Read C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Cookies\Low\5p5nrgjn0js_halpmcxz@www.msn[2].txt size = 4096, size_out = 1026 True 1
Fn
Data
For performance reasons, the remaining 68 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (3)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework value_name = DbgJITDebugLaunchSetting, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework value_name = DbgManagedDebugger, type = REG_NONE False 1
Fn
Module (11)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\user32.dll base_address = 0x763e0000 True 2
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\local\temprunsom.exe base_address = 0xc80000 True 7
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcW, address_out = 0x77e625dd True 2
Fn
Window (16)
»
Operation Window Name Additional Information Success Count Logfile
Create - class_name = WindowsForms10.Window.8.app.0.378734a, wndproc_parameter = 0 True 1
Fn
Create .NET-BroadcastEventWindow.2.0.0.0.378734a.0 class_name = .NET-BroadcastEventWindow.2.0.0.0.378734a.0, wndproc_parameter = 0 True 1
Fn
Create - class_name = WindowsForms10.Window.8.app.0.378734a, wndproc_parameter = 0 True 1
Fn
Create - class_name = WindowsForms10.Window.8.app.0.378734a, wndproc_parameter = 0 True 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.378734a, index = 18446744073709551612, new_long = 2011571677 True 2
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.378734a, index = 18446744073709551612, new_long = 9570954 True 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.378734a, index = 18446744073709551612, new_long = 2011571677 True 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.378734a, index = 18446744073709551612, new_long = 9573530 True 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.378734a, index = 18446744073709551608, new_long = 0 False 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.378734a, index = 18446744073709551600, new_long = 33619968 True 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.378734a, index = 18446744073709551596, new_long = 327680 True 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.378734a, index = 18446744073709551612, new_long = 2011571677 True 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.378734a, index = 18446744073709551612, new_long = 9573578 True 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.378734a, index = 18446744073709551604, new_long = 197082 False 1
Fn
Set Attribute .NET-BroadcastEventWindow.2.0.0.0.378734a.0 class_name = .NET-BroadcastEventWindow.2.0.0.0.378734a.0, index = 18446744073709551612, new_long = 2011571677 True 1
Fn
System (6)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = XDUWTFONO True 1
Fn
Get Info type = Operating System True 5
Fn
Process #4: notepad.exe
0 0
»
Information Value
ID #4
File Name c:\windows\system32\notepad.exe
Command Line "C:\Windows\system32\NOTEPAD.EXE" C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\@___README___@.txt
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:07, Reason: Child Process
Unmonitor End Time: 00:02:35, Reason: Terminated by Timeout
Monitor Duration 00:01:28
Remarks No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xa58
Parent PID 0x964 (c:\users\5p5nrgjn0js halpmcxz\desktop\kryptotrojaner.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A5C
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x0000000000020000 0x00020000 0x00026fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000040000 0x00040000 0x00041fff Pagefile Backed Memory Readable True False False -
locale.nls 0x00050000 0x000b6fff Memory Mapped File Readable False False False -
pagefile_0x00000000000c0000 0x000c0000 0x000c1fff Pagefile Backed Memory Readable, Writable True False False -
private_0x00000000000d0000 0x000d0000 0x0014ffff Private Memory Readable, Writable True False False -
notepad.exe.mui 0x00150000 0x00152fff Memory Mapped File Readable, Writable False False False -
private_0x0000000000160000 0x00160000 0x00160fff Private Memory Readable, Writable True False False -
private_0x0000000000170000 0x00170000 0x0017ffff Private Memory Readable, Writable True False False -
private_0x0000000000180000 0x00180000 0x0027ffff Private Memory Readable, Writable True False False -
private_0x0000000000280000 0x00280000 0x00280fff Private Memory Readable, Writable True False False -
pagefile_0x00000000002a0000 0x002a0000 0x002a1fff Pagefile Backed Memory Readable True False False -
private_0x0000000000340000 0x00340000 0x0043ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000440000 0x00440000 0x005c7fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000005d0000 0x005d0000 0x00750fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000760000 0x00760000 0x01b5ffff Pagefile Backed Memory Readable True False False -
private_0x0000000001b90000 0x01b90000 0x01c0ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000001c10000 0x01c10000 0x01ceefff Pagefile Backed Memory Readable True False False -
private_0x0000000001cf0000 0x01cf0000 0x01cfffff Private Memory Readable, Writable True False False -
kernel32.dll 0x77a30000 0x77b4efff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x77b50000 0x77c49fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77c50000 0x77df8fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x000000007efe0000 0x7efe0000 0x7ffdffff Private Memory Readable True False False -
pagefile_0x000000007efe0000 0x7efe0000 0x7f0dffff Pagefile Backed Memory Readable True False False -
private_0x000000007f0e0000 0x7f0e0000 0x7ffdffff Private Memory Readable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
notepad.exe 0xffc90000 0xffcc4fff Memory Mapped File Readable, Writable, Executable False False False -
winspool.drv 0x7fef7db0000 0x7fef7e20fff Memory Mapped File Readable, Writable, Executable False False False -
dwmapi.dll 0x7fefc090000 0x7fefc0a7fff Memory Mapped File Readable, Writable, Executable False False False -
uxtheme.dll 0x7fefc4c0000 0x7fefc515fff Memory Mapped File Readable, Writable, Executable False False False -
comctl32.dll 0x7fefc670000 0x7fefc863fff Memory Mapped File Readable, Writable, Executable False False False -
version.dll 0x7fefcd60000 0x7fefcd6bfff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x7fefda90000 0x7fefda9efff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x7fefde60000 0x7fefdecafff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x7fefdf70000 0x7fefe172fff Memory Mapped File Readable, Writable, Executable False False False -
shell32.dll 0x7fefe180000 0x7fefef07fff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x7fefefb0000 0x7feff0dcfff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x7feff210000 0x7feff2aefff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x7feff2b0000 0x7feff38afff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x7feff390000 0x7feff3aefff Memory Mapped File Readable, Writable, Executable False False False -
lpk.dll 0x7feff3b0000 0x7feff3bdfff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x7feff3c0000 0x7feff3edfff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x7feff910000 0x7feff976fff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x7feff980000 0x7feff9f0fff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x7feffa00000 0x7feffb08fff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x7feffb10000 0x7feffbe6fff Memory Mapped File Readable, Writable, Executable False False False -
comdlg32.dll 0x7feffdd0000 0x7feffe66fff Memory Mapped File Readable, Writable, Executable False False False -
usp10.dll 0x7feffe90000 0x7fefff58fff Memory Mapped File Readable, Writable, Executable False False False -
apisetschema.dll 0x7fefff70000 0x7fefff70fff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x000007fffffb0000 0x7fffffb0000 0x7fffffd2fff Pagefile Backed Memory Readable True False False -
private_0x000007fffffdc000 0x7fffffdc000 0x7fffffddfff Private Memory Readable, Writable True False False -
private_0x000007fffffde000 0x7fffffde000 0x7fffffdefff Private Memory Readable, Writable True False False -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image