VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: Backdoor, Dropper, Spyware, Downloader |
6ded37a61962a6a6626bd47adb66f5f73742d8d2125cdff1dc3f932d0a8e5d2e (SHA256)
gootkit_vbs-6ded37a6.vir.vbs
VBScript
Created at 2018-12-13 14:00:00
Notifications (2/2)
The overall sleep time of all monitored processes was truncated from "29 minutes, 45 seconds" to "1 minute, 40 seconds" to reveal dormant functionality.
Virtual Machine Information
Name | win10_64 |
Description | Windows 10 (TH2, 64-bit), MS Office 2016 (64-bit) |
Architecture | x86 64-bit |
Operating System | Windows 10 Threshold 2 |
Kernel Version | 10.0.10586.0 (0de6dc23-8e19-4bb7-8608-d54b1e6fa379) |
Network Scheme Name | VMRay Cloud |
Network Config Name | Local Gateway |
System Information
Computer Name | X2VS1CUM |
User Domain | X2VS1CUM |
User Name | Nd9E1FYi |
User Profile | C:\Users\Nd9E1FYi |
Temp Directory | C:\Users\Nd9E1FYi\AppData\Local\Temp |
System Root | C:\Windows |
Sample Directory | C:\Users\Nd9E1FYi\Desktop |
Software Information
Adobe Acrobat Reader Version | 15.007.20033 |
Microsoft Office | 2016 |
Microsoft Office Version | 16.0.4266.1001 |
Internet Explorer Version | 11.0.10586.0 |
Chrome Version | 60.0.3112.113 |
Firefox Version | 55.0.2 |
Flash Version | 25.0.0.148 |
Java Version | 8.0.1440.1 |
Randomly Created Artifacts
This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.
Processes (20)
»
Filename | PID | GUI |
---|---|---|
C:\Program Files (x86)\Common Files\its.exe | #3748 | |
C:\Program Files (x86)\Google\bryant.exe | #4012 | |
C:\Program Files (x86)\MSBuild\semi bay.exe | #3828 | |
C:\Program Files (x86)\MSECache\safari.exe | #3132 | |
C:\Program Files (x86)\Mozilla Maintenance Service\oxide.exe | #3960 | |
C:\Program Files (x86)\Windows Sidebar\thoroughlypriestprefix.exe | #3788 | |
C:\Program Files (x86)\WindowsPowerShell\off-covered-playlist.exe | #3980 | |
C:\Program Files (x86)\WindowsPowerShell\ranger_tu_community.exe | #3100 | |
C:\Program Files\Common Files\volunteer.exe | #3092 | |
C:\Program Files\Internet Explorer\gently budapest.exe | #3768 | |
C:\Program Files\Java\eddie_cholesterol_reprint.exe | #1300 | |
C:\Program Files\MSBuild\bracket-natural-chancellor.exe | #3112 | |
C:\Program Files\Microsoft Analysis Services\inserted_field.exe | #3808 | |
C:\Program Files\Microsoft Office 15\crm_remarks_ctrl.exe | #4068 | |
C:\Program Files\Microsoft Office 15\spokesman.exe | #3936 | |
C:\Program Files\Mozilla Firefox\spoken-delayed.exe | #3908 | |
C:\Program Files\Uninstall Information\develop-patent.exe | #3728 | |
C:\Program Files\Uninstall Information\postal-fool.exe | #4032 | |
C:\Program Files\Windows Journal\outdoor.exe | #3848 | |
C:\Program Files\Windows Mail\wool-parish-horses.exe | #3876 |
Files (303)
»
Filename |
---|
C:\Users\Nd9E1FYi\AppData\Local\Temp\0ApU QO40oi.flv |
C:\Users\Nd9E1FYi\AppData\Local\Temp\0ww2kZmSHXJgid0v.gif |
C:\Users\Nd9E1FYi\AppData\Local\Temp\2yNvG-.m4a |
C:\Users\Nd9E1FYi\AppData\Local\Temp\7A2A8.wav |
C:\Users\Nd9E1FYi\AppData\Local\Temp\8P9zQRx1Vax7c3jiy5X.ots |
C:\Users\Nd9E1FYi\AppData\Local\Temp\CEXN.odt |
C:\Users\Nd9E1FYi\AppData\Local\Temp\DtFH0IZ4fsdcG7r_Rz.avi |
C:\Users\Nd9E1FYi\AppData\Local\Temp\EhWXHhsxfTmUPWg9XqVq.jpg |
C:\Users\Nd9E1FYi\AppData\Local\Temp\Hx rjD.flv |
C:\Users\Nd9E1FYi\AppData\Local\Temp\IzxeoF.gif |
C:\Users\Nd9E1FYi\AppData\Local\Temp\JsWpzGNilVYk5m-.wav |
C:\Users\Nd9E1FYi\AppData\Local\Temp\KG_4wO.m4a |
C:\Users\Nd9E1FYi\AppData\Local\Temp\MdSAZfCMiSfH.mp3 |
C:\Users\Nd9E1FYi\AppData\Local\Temp\OIR0WDT0h7b.png |
C:\Users\Nd9E1FYi\AppData\Local\Temp\Omn7k-qELKC.bmp |
C:\Users\Nd9E1FYi\AppData\Local\Temp\Pu_3mJjuY05z5FVFHXw.pps |
C:\Users\Nd9E1FYi\AppData\Local\Temp\Q91E.wav |
C:\Users\Nd9E1FYi\AppData\Local\Temp\QHbahyD0v67ZQ.wav |
C:\Users\Nd9E1FYi\AppData\Local\Temp\U O-11Oj-BbhgltH9WlT.xlsx |
C:\Users\Nd9E1FYi\AppData\Local\Temp\Wm8Hlmenre.gif |
C:\Users\Nd9E1FYi\AppData\Local\Temp\YUOMGs0qoKUFp-csQSA.mp3 |
C:\Users\Nd9E1FYi\AppData\Local\Temp\a_ok81CanP5.odp |
C:\Users\Nd9E1FYi\AppData\Local\Temp\eKspfgtJ9scFLU1vaH.flv |
C:\Users\Nd9E1FYi\AppData\Local\Temp\h2I4cuSS.ots |
C:\Users\Nd9E1FYi\AppData\Local\Temp\iKfHV.wav |
C:\Users\Nd9E1FYi\AppData\Local\Temp\j8N6z4Uq.mp3 |
C:\Users\Nd9E1FYi\AppData\Local\Temp\lsEVH9W.xls |
C:\Users\Nd9E1FYi\AppData\Local\Temp\rWdWuIyA.gif |
C:\Users\Nd9E1FYi\AppData\Local\Temp\rzS Mpm.wav |
C:\Users\Nd9E1FYi\AppData\Local\Temp\spXTUHTuccSvP0s.mp3 |
C:\Users\Nd9E1FYi\AppData\Local\Temp\u9wl_Fa8m.swf |
C:\Users\Nd9E1FYi\AppData\Local\Temp\vTB_uYQBRUPcYVK.flv |
C:\Users\Nd9E1FYi\AppData\Roaming\08tRwe3Y_l.gif |
C:\Users\Nd9E1FYi\AppData\Roaming\0cJ txSwwk.odp |
C:\Users\Nd9E1FYi\AppData\Roaming\3e9baF.swf |
C:\Users\Nd9E1FYi\AppData\Roaming\3ryAhC3--UNQ.wav |
C:\Users\Nd9E1FYi\AppData\Roaming\4kTaPP2f93A6fRlHBtFV.odp |
C:\Users\Nd9E1FYi\AppData\Roaming\5542l.csv |
C:\Users\Nd9E1FYi\AppData\Roaming\5979k3EV8J4Q--jLu.m4a |
C:\Users\Nd9E1FYi\AppData\Roaming\5Z4f2xJ.jpg |
C:\Users\Nd9E1FYi\AppData\Roaming\8IG5mDq.mp3 |
C:\Users\Nd9E1FYi\AppData\Roaming\C6Ut.bmp |
C:\Users\Nd9E1FYi\AppData\Roaming\EIb8YnOr3jU.gif |
C:\Users\Nd9E1FYi\AppData\Roaming\GDZIdJygf.xlsx |
C:\Users\Nd9E1FYi\AppData\Roaming\Him7KgNp0sS1mIXgvn.mkv |
C:\Users\Nd9E1FYi\AppData\Roaming\IeO2uAWXOiMwcnkAg6s.m4a |
C:\Users\Nd9E1FYi\AppData\Roaming\LkTrjZ.mp4 |
C:\Users\Nd9E1FYi\AppData\Roaming\NdkhkvuSNWvYE.bmp |
C:\Users\Nd9E1FYi\AppData\Roaming\PQpk9ezTWue.bmp |
C:\Users\Nd9E1FYi\AppData\Roaming\SFoYACIm6e1-c.wav |
C:\Users\Nd9E1FYi\AppData\Roaming\ULBrz.swf |
C:\Users\Nd9E1FYi\AppData\Roaming\U_yuPOYNlVxrIxI2.bmp |
C:\Users\Nd9E1FYi\AppData\Roaming\Ux5rLTmHyqivHkvDI.mkv |
C:\Users\Nd9E1FYi\AppData\Roaming\avz-fI7D.mp3 |
C:\Users\Nd9E1FYi\AppData\Roaming\begSWwZ4o8EVHXj.xls |
C:\Users\Nd9E1FYi\AppData\Roaming\bmdWBF_8BJI_aSK2EmZi.mp4 |
C:\Users\Nd9E1FYi\AppData\Roaming\cVSjogc2kx1swxQ5R2.wav |
C:\Users\Nd9E1FYi\AppData\Roaming\d6_Crwbze4XDk.doc |
C:\Users\Nd9E1FYi\AppData\Roaming\eLtBld-zPQ23A 7.odt |
C:\Users\Nd9E1FYi\AppData\Roaming\lJNNFzoFnPyZ.flv |
C:\Users\Nd9E1FYi\AppData\Roaming\lLpgs3T7TB.mkv |
C:\Users\Nd9E1FYi\AppData\Roaming\me3p3SKGq-i3k.mp4 |
C:\Users\Nd9E1FYi\AppData\Roaming\oQquU3zKYti0pVDR.jpg |
C:\Users\Nd9E1FYi\AppData\Roaming\rSRwO7QkwmTgzwjodp_.jpg |
C:\Users\Nd9E1FYi\AppData\Roaming\sBdMLkB9vQZU9Y.m4a |
C:\Users\Nd9E1FYi\AppData\Roaming\tVXpBGgkw.flv |
C:\Users\Nd9E1FYi\AppData\Roaming\y7N_0y a3VUel5dw4.jpg |
C:\Users\Nd9E1FYi\AppData\Roaming\zOSTx6Kf.swf |
C:\Users\Nd9E1FYi\Desktop\6CE6BCOLDb1Uv-4wOJ0.bmp |
C:\Users\Nd9E1FYi\Desktop\6s58Vu6OKQRaTG.mkv |
C:\Users\Nd9E1FYi\Desktop\7k7r.docx |
C:\Users\Nd9E1FYi\Desktop\8IFs_0vXOs3ZtnEcep.mp4 |
C:\Users\Nd9E1FYi\Desktop\AMI_yYdXw2hFuhy.pdf |
C:\Users\Nd9E1FYi\Desktop\Eyfg6HI0J9RYBo7Vn.bmp |
C:\Users\Nd9E1FYi\Desktop\KiaqQEC8IfhjRn6Q.gif |
C:\Users\Nd9E1FYi\Desktop\NisSh3Im8LG.pps |
C:\Users\Nd9E1FYi\Desktop\QY3Nr43469nMhbA-rub4.m4a |
C:\Users\Nd9E1FYi\Desktop\RwJQk Df5ggFTfFf.png |
C:\Users\Nd9E1FYi\Desktop\W1 5Y4ke.mp3 |
C:\Users\Nd9E1FYi\Desktop\Xy gMw5_kwthumoxf.m4a |
C:\Users\Nd9E1FYi\Desktop\aTkFmm1cGcHn.mp3 |
C:\Users\Nd9E1FYi\Desktop\cjqHKrcL2Csy.gif |
C:\Users\Nd9E1FYi\Desktop\eQt1Nx3NKjn.ods |
C:\Users\Nd9E1FYi\Desktop\lOt9 jTX.m4a |
C:\Users\Nd9E1FYi\Desktop\nKJd0.bmp |
C:\Users\Nd9E1FYi\Desktop\o5P0k1UJgmbrqU6DYlPx.swf |
C:\Users\Nd9E1FYi\Desktop\ohZ80en7vIWg.mp3 |
C:\Users\Nd9E1FYi\Desktop\r9kxEv9z.gif |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\WWfDY5Pc |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\WWfDY5Pc\2NdrpExB0 wsq-uBrB9.mp3 |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\WWfDY5Pc\3wWkAp.odt |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\WWfDY5Pc\E4N5Yx.flv |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\WWfDY5Pc\FyL7bwAAXW6MoHf.mp3 |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\WWfDY5Pc\K0Ol9wv1nWseRbY7.docx |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\WWfDY5Pc\aFC6_Hnqy_.avi |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\WWfDY5Pc\yq5xx74dw ok 1Ev95.mp4 |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\eO7l |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\eO7l\cLOY9e.odt |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\eO7l\majEAb.jpg |
C:\Users\Nd9E1FYi\Desktop\w7AO_b0QY1pPSD\fdl8-eONO2HYTZ7y7Bd.m4a |
C:\Users\Nd9E1FYi\Documents\0StNfZ97V2u9YyrW-r.docx |
C:\Users\Nd9E1FYi\Documents\2UbbLhAq8KwCgZyc.xlsx |
C:\Users\Nd9E1FYi\Documents\4HCtsvYJHeU.pptx |
C:\Users\Nd9E1FYi\Documents\4OuM.xlsx |
C:\Users\Nd9E1FYi\Documents\4XkTNRNiMyQwKAXapK.ppt |
C:\Users\Nd9E1FYi\Documents\59v5DHOXy8uFzk.pptx |
C:\Users\Nd9E1FYi\Documents\6O7-0PXV0.xlsx |
C:\Users\Nd9E1FYi\Documents\6p IU.xlsx |
C:\Users\Nd9E1FYi\Documents\7JK-B9MJ8ILNjBFSbz.docx |
C:\Users\Nd9E1FYi\Documents\7peXzv8j9a.docx |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\1nRAuUSS.ods |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\6LLZAqj0VHj.ots |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\6o7PqmJz.ots |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\Af35kDrlX SYw.pptx |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\CXX4bUvz6QK.xlsx |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\DDJeytg.csv |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\HtMedSf5.ppt |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\IBpxSf0XA0gztdVsq.ppt |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\LfYuF.csv |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\P9MF9Mg3PsGYD5rTjc_.pps |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\PIB7AMwFfSRkF-K.pdf |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\SkWpEfT5AhOCaubgn1.doc |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\WTD-OV6i5U2cGnf5XDF.xls |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\XpkIj7CKbJqHpE.pptx |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\a5WwNHHZGD.doc |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\a5fUgZZ7Ox.pdf |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\afbDuB HeuFmo.pptx |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\edmIR8Ya-T-vZkPdNsS.ods |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\hbeqnj.pps |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\noKwCMIzf2T8Zo.xlsx |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\nqE8uOD6rheNW.ots |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\oMt_uta.ppt |
C:\Users\Nd9E1FYi\Documents\7uLRtTefIDizHBtGMn7k\oadeX2j2_VDTob2.pdf |
C:\Users\Nd9E1FYi\Documents\893hOkc6oViJagc97zDy.docx |
C:\Users\Nd9E1FYi\Documents\8rfh58wD0lHX.xls |
C:\Users\Nd9E1FYi\Documents\96SakG3-ng8TJ-3Pq.pptx |
C:\Users\Nd9E1FYi\Documents\9QEk6Fl5N.xlsx |
C:\Users\Nd9E1FYi\Documents\AFphk4f8L6OlPI.docx |
C:\Users\Nd9E1FYi\Documents\Dt__g.docx |
C:\Users\Nd9E1FYi\Documents\E2C2yw8k.pptx |
C:\Users\Nd9E1FYi\Documents\EluKZ.xlsx |
C:\Users\Nd9E1FYi\Documents\FZOCidnpbeUAFJ.xlsx |
C:\Users\Nd9E1FYi\Documents\GyLRwA9KmEplt.pptx |
C:\Users\Nd9E1FYi\Documents\Je 4RFwoHUZk1uQUn27z.pptx |
C:\Users\Nd9E1FYi\Documents\JlEXh7RH3vmRsQ0QQ.docx |
C:\Users\Nd9E1FYi\Documents\KH75p7zb78t3.csv |
C:\Users\Nd9E1FYi\Documents\KPQP9VrQ99xuegYicDQ.pptx |
C:\Users\Nd9E1FYi\Documents\Ku9VHW808mf.xlsx |
C:\Users\Nd9E1FYi\Documents\LNm3.docx |
C:\Users\Nd9E1FYi\Documents\M7lSU.pptx |
C:\Users\Nd9E1FYi\Documents\MoYDdqZ.docx |
C:\Users\Nd9E1FYi\Documents\Nk665mNMC_rbljoIXsO.docx |
C:\Users\Nd9E1FYi\Documents\PKn2w-w3ZMor0 y.ods |
C:\Users\Nd9E1FYi\Documents\QWIPI.xlsx |
C:\Users\Nd9E1FYi\Documents\R2WXnazQeiJki3A6Qo.pptx |
C:\Users\Nd9E1FYi\Documents\R6j46ooZPvch-J.pdf |
C:\Users\Nd9E1FYi\Documents\RcXFMdYWY5a8kmg1.pptx |
C:\Users\Nd9E1FYi\Documents\S00izy_Y3w.docx |
C:\Users\Nd9E1FYi\Documents\SF9nWV2u2Q.xlsx |
C:\Users\Nd9E1FYi\Documents\SKQrqnR2Y.csv |
C:\Users\Nd9E1FYi\Documents\Su6daYKF b8uuq0Bcdj.xlsx |
C:\Users\Nd9E1FYi\Documents\WGKg56_NcWAj.odt |
C:\Users\Nd9E1FYi\Documents\Wuks58lo1tl.pptx |
C:\Users\Nd9E1FYi\Documents\X6RruoNj09yt_RBVt.pptx |
C:\Users\Nd9E1FYi\Documents\_3 IVZMU.odt |
C:\Users\Nd9E1FYi\Documents\a1AM1eA6oo1.pps |
C:\Users\Nd9E1FYi\Documents\bB_GgBL0GeBk2Zw.docx |
C:\Users\Nd9E1FYi\Documents\bZWdF_6Pyqc2fPbyh1w.xlsx |
C:\Users\Nd9E1FYi\Documents\bkiqFJURKEC7Rs7c.docx |
C:\Users\Nd9E1FYi\Documents\d1G4 YjV4mN-kTw.xlsx |
C:\Users\Nd9E1FYi\Documents\dUF8FAHb.docx |
C:\Users\Nd9E1FYi\Documents\drh3CNvR4Fs3.pptx |
C:\Users\Nd9E1FYi\Documents\dy7N.xlsx |
C:\Users\Nd9E1FYi\Documents\fRcr.xlsx |
C:\Users\Nd9E1FYi\Documents\fY2nI-zaIvnAfa626Y4.xlsx |
C:\Users\Nd9E1FYi\Documents\fm8qkeyJivfw d.docx |
C:\Users\Nd9E1FYi\Documents\g pzj.docx |
C:\Users\Nd9E1FYi\Documents\gUtk3ey.pptx |
C:\Users\Nd9E1FYi\Documents\hRj4Oiqk_2JT4xY_.docx |
C:\Users\Nd9E1FYi\Documents\iUCWJzm-AVza27E.xlsx |
C:\Users\Nd9E1FYi\Documents\ix72BKi fsFq8-NY2 h.pptx |
C:\Users\Nd9E1FYi\Documents\kKBn56BsGWPO6rPlbO.xlsx |
C:\Users\Nd9E1FYi\Documents\kahGUe.docx |
C:\Users\Nd9E1FYi\Documents\l5VyppMWkk.pptx |
C:\Users\Nd9E1FYi\Documents\mYeZxeOrzvnfnKxkb7.pptx |
C:\Users\Nd9E1FYi\Documents\mf7RGN2p4YCqk.docx |
C:\Users\Nd9E1FYi\Documents\noCzpXGW2IDvkqc0.docx |
C:\Users\Nd9E1FYi\Documents\sH36FND.pptx |
C:\Users\Nd9E1FYi\Documents\t3YIbMOGRzOeR.docx |
C:\Users\Nd9E1FYi\Documents\tMLuNX1q9z.xlsx |
C:\Users\Nd9E1FYi\Documents\tU2GWnl8 wD.pptx |
C:\Users\Nd9E1FYi\Documents\tymQYOUbq.pptx |
C:\Users\Nd9E1FYi\Documents\u605fCJTnNfMwq9H9kmU.docx |
C:\Users\Nd9E1FYi\Documents\u6KkAZS.xlsx |
C:\Users\Nd9E1FYi\Documents\u9QSKRsmg8 o znXS.ods |
C:\Users\Nd9E1FYi\Documents\vX5D.pps |
C:\Users\Nd9E1FYi\Documents\vuH1.xlsx |
C:\Users\Nd9E1FYi\Documents\w4LS.xlsx |
C:\Users\Nd9E1FYi\Documents\yswShZD UTsQr87y.odp |
C:\Users\Nd9E1FYi\Documents\zqqNUyAujh jj9.pptx |
C:\Users\Nd9E1FYi\Music\8 GKZ |
C:\Users\Nd9E1FYi\Music\8 GKZ\6Zuxt_HK18PCSpn |
C:\Users\Nd9E1FYi\Music\8 GKZ\6Zuxt_HK18PCSpn\JIzZ79Fr.wav |
C:\Users\Nd9E1FYi\Music\8 GKZ\6Zuxt_HK18PCSpn\a_BG6utKhx.m4a |
C:\Users\Nd9E1FYi\Music\8 GKZ\6Zuxt_HK18PCSpn\k8XYPu9e8q.mp3 |
C:\Users\Nd9E1FYi\Music\8 GKZ\6Zuxt_HK18PCSpn\yE95j.mp3 |
C:\Users\Nd9E1FYi\Music\8 GKZ\L70NJ5 _KKpxMsff2tc |
C:\Users\Nd9E1FYi\Music\8 GKZ\L70NJ5 _KKpxMsff2tc\1 qyDjbCaX.m4a |
C:\Users\Nd9E1FYi\Music\8 GKZ\L70NJ5 _KKpxMsff2tc\BJv234Ds4kR.m4a |
C:\Users\Nd9E1FYi\Music\8 GKZ\L70NJ5 _KKpxMsff2tc\HFfZP.mp3 |
C:\Users\Nd9E1FYi\Music\8 GKZ\L70NJ5 _KKpxMsff2tc\LH-1db5zj aGeBaw_I6-.m4a |
C:\Users\Nd9E1FYi\Music\8 GKZ\L70NJ5 _KKpxMsff2tc\hSWXSXEl.mp3 |
C:\Users\Nd9E1FYi\Music\8 GKZ\Oh_u4YoD.wav |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5 |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\0lx3I8D27BWBT.wav |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\5Q5SDVwEM_1wrr5M.mp3 |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\8NILA9 B5y.wav |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\X0HVoGPAr |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\X0HVoGPAr\SZMQw.wav |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\X0HVoGPAr\f0 VeaYmmbrkmwV.m4a |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\pR1B G97q7xKqSso_0_.m4a |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\rVTni3PVGO6u5HAqXZ |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\rVTni3PVGO6u5HAqXZ\HCR_Ef8l.m4a |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\rVTni3PVGO6u5HAqXZ\O2LUq.m4a |
C:\Users\Nd9E1FYi\Music\8 GKZ\iD-Ir1fbEomrx5c5\rVTni3PVGO6u5HAqXZ\z9sxwsrF WGiHG6y0.m4a |
C:\Users\Nd9E1FYi\Music\DUV__5i |
C:\Users\Nd9E1FYi\Music\DUV__5i\9eWk8sX1IDc4aP.wav |
C:\Users\Nd9E1FYi\Music\DUV__5i\EQuCpzwQ.m4a |
C:\Users\Nd9E1FYi\Music\DUV__5i\GBxcnJuyz4c5I4B.wav |
C:\Users\Nd9E1FYi\Music\DUV__5i\xBg6J3ghkMhOPZdJfKiG |
C:\Users\Nd9E1FYi\Music\DUV__5i\xBg6J3ghkMhOPZdJfKiG\9ZwGa43OuZ3_dKr.mp3 |
C:\Users\Nd9E1FYi\Music\DUV__5i\xBg6J3ghkMhOPZdJfKiG\GjGh.wav |
C:\Users\Nd9E1FYi\Music\DUV__5i\xBg6J3ghkMhOPZdJfKiG\X0X3y_XQU7Kl4sB.m4a |
C:\Users\Nd9E1FYi\Music\DUV__5i\xBg6J3ghkMhOPZdJfKiG\oAeBpK-0.mp3 |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5 |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5\03WWil0.bmp |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5\2GBMR5.png |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5\6e_o.gif |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5\BauGwpV54j.png |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5\IZRl8xEES1aIay.gif |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5\InJ-nFwWjNgi.jpg |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5\OIiyeAGGX DTr.gif |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5\Q83OH.jpg |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5\rzII.bmp |
C:\Users\Nd9E1FYi\Pictures\4jKhayVUsACS5\vxPvURh8ztKf.jpg |
C:\Users\Nd9E1FYi\Pictures\5TRGP1j.png |
C:\Users\Nd9E1FYi\Pictures\91-hqa1qLy2wFtlYc.gif |
C:\Users\Nd9E1FYi\Pictures\9IAsa8t92j.bmp |
C:\Users\Nd9E1FYi\Pictures\EbLBbpSVY9DMNz.bmp |
C:\Users\Nd9E1FYi\Pictures\J9ule.jpg |
C:\Users\Nd9E1FYi\Pictures\TVQMBflrK27PtKhzo0-.gif |
C:\Users\Nd9E1FYi\Pictures\VyUvT-eJRn.bmp |
C:\Users\Nd9E1FYi\Pictures\Xuwtd8V.bmp |
C:\Users\Nd9E1FYi\Pictures\_xZVNki.bmp |
C:\Users\Nd9E1FYi\Pictures\u5aElneXV |
C:\Users\Nd9E1FYi\Pictures\u5aElneXV\Blp2rahxZa6nEC5.gif |
C:\Users\Nd9E1FYi\Pictures\u5aElneXV\IITub5hY3.bmp |
C:\Users\Nd9E1FYi\Pictures\u5aElneXV\KiQ2t1J8sPknSFjb.bmp |
C:\Users\Nd9E1FYi\Pictures\u5aElneXV\NBLQzUzZhvtkNahxOn9z.bmp |
C:\Users\Nd9E1FYi\Pictures\u5aElneXV\X9Iq2uVx9X.bmp |
C:\Users\Nd9E1FYi\Pictures\u5aElneXV\cF-z8Q1EPjhJBIuCXEJ.bmp |
C:\Users\Nd9E1FYi\Pictures\u5aElneXV\pS7Djvuw3woV6O2Pn.gif |
C:\Users\Nd9E1FYi\Pictures\w1FdSsRve2Xeit_TTpG.bmp |
C:\Users\Nd9E1FYi\Videos\FfJb14-Rozp8KCQf-Pg.swf |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\7eD3Bs5jIEFbzh-FIXl0 |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\7eD3Bs5jIEFbzh-FIXl0\7M3FSZxwTJ 2fK-QwD.swf |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\7eD3Bs5jIEFbzh-FIXl0\JIZXScyWQD.mkv |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\7eD3Bs5jIEFbzh-FIXl0\g47bazgda.swf |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\7eD3Bs5jIEFbzh-FIXl0\njyYg8l Y1f.avi |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\Di5k zo2SsE9HgXJ1.mkv |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\ONtjs-Aj0bv ulZq5V.mp4 |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\QeOU.mkv |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\XDrHotCFZ1nZ1GAts |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\e7XESPe0y |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\e7XESPe0y\Kdx-RD.mkv |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\e7XESPe0y\RFbSUya.flv |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\4zHlEqfpf |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\4zHlEqfpf\O-sLehHgSyZ04.flv |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\4zHlEqfpf\gj1I U |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\4zHlEqfpf\gj1I U\1LFcErNB.avi |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\4zHlEqfpf\gj1I U\exGliXFEx7ihGqi.mkv |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\4zHlEqfpf\gj1I U\juHwQIZE1F.avi |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\IjIX |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\IjIX\58B4I.flv |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\IjIX\XM8kA2M5zcAdt.swf |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\IjIX\ld3DZ9cqnddFR0.avi |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\IjIX\m8hp15 O663_vYXROnYB.avi |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\T2QB.avi |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\XsY_a O2 |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\XsY_a O2\DSvttYzMk65ZeIlQFm8j.mp4 |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\XsY_a O2\PenMOD.mp4 |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\XsY_a O2\ZFCdRBre28oyM.mkv |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\XsY_a O2\oDc6qTSH_7QlutwwXK-Y.mp4 |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\bkm5GjzHb75R3N.avi |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\d51o |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\d51o\iyKa9K8pMWu.mkv |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\d51o\lBOSYFJs6iX5_2DTlkK.swf |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\d51o\pJRf58h.avi |
C:\Users\Nd9E1FYi\Videos\La_Fl z-dPdcUjX\hGCY-oLrtLsM2YkH\yKH1pmBaC_O3hyg.swf |