Sample File: MD5 hash: 1cc146d47918d23cee86a97c77f87918 SHA1 hash: 3d07f8db1010627f1481b5fde714185215971935 SHA256 hash: 5ff8a87fd7626d4beab7a5be7f285f1d1d64478509f27aca6fd9deb3f69155e7 SSDEEP hash: 12288:lUykCSZQeSdPLHNHgdvb0INuK8afD7Gj7qqtisK1yty+79mmUE7evpp:hsQeS9Hpg7ear7GXZgTvmUwup Filename(s): API .doc.rtf Filetype: RTF Document Mutex IOCs: UA9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038 Registry Key IOCs: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName HKEY_LOCAL_MACHINE HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Version HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\189cba75c69c634996739bac92103ebb HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\1a8bd43e654f65418fbafadeef063a57 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\1cfb96c6c96b454ebff73da2e9f63f51 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\3517490d76624c419a828607e2a54604 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\467888fc50a6c6448d6cc0cf7b5307d6 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\48dea081c9634a43a6861907855add5c HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\55aad8d134512d438564aa678cb92d66 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\71b0295bef58e344911262b243f005ac HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\8503020000000000c000000000000046 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\Email HKEY_CURRENT_USER HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\Email HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\POP3 Server HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\POP3 User HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\POP3 Port HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\POP3 Password HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\IMAP Server HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP Server HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP User HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP Port HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP Password HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\Email HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\ HKEY_CURRENT_USER\Software\monero-project\monero-core HKEY_CURRENT_USER\Software\monero-project\monero-core\wallet_path HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir HKEY_CURRENT_USER\Software\BitcoinGold\BitcoinGold-Qt HKEY_CURRENT_USER\Software\BitcoinGold\BitcoinGold-Qt\strDataDir HKEY_CURRENT_USER\Software\BitCore\BitCore-Qt HKEY_CURRENT_USER\Software\BitCore\BitCore-Qt\strDataDir HKEY_CURRENT_USER\Software\Litecoin\Litecoin-Qt HKEY_CURRENT_USER\Software\Litecoin\Litecoin-Qt\strDataDir HKEY_CURRENT_USER\Software\BitcoinABC\BitcoinABC-Qt HKEY_CURRENT_USER\Software\BitcoinABC\BitcoinABC-Qt\strDataDir HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 25.0 (x86 en-US) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 25.0 (x86 en-US)\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 25.0 (x86 en-US)\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F03217071FF} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F03217071FF}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F03217071FF}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3c3aafc8-d898-43ec-998f-965ffdae065a} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3c3aafc8-d898-43ec-998f-965ffdae065a}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3c3aafc8-d898-43ec-998f-965ffdae065a}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{582EA838-9199-3518-A05C-DB09462F68EC} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{582EA838-9199-3518-A05C-DB09462F68EC}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{582EA838-9199-3518-A05C-DB09462F68EC}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{68306422-7C57-373F-8860-D26CE4BA2A15} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{68306422-7C57-373F-8860-D26CE4BA2A15}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{68306422-7C57-373F-8860-D26CE4BA2A15}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AA0000000001} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e52a6842-b0ac-476e-b48f-378a97a67346} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e52a6842-b0ac-476e-b48f-378a97a67346}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e52a6842-b0ac-476e-b48f-378a97a67346}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e6e75766-da0f-4ba2-9788-6ea593ce702d} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{f325f05b-f963-4640-a43b-c8a494cdda0f} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{f325f05b-f963-4640-a43b-c8a494cdda0f}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{f325f05b-f963-4640-a43b-c8a494cdda0f}\DisplayVersion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185} HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}\DisplayName HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}\DisplayVersion HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayVersion HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun HKEY_CURRENT_USER\Software\Microsoft\Command Processor HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Domain IOCs: kalpvedafoundation.com onedrive.live.com tarot-sunce.com IP IOCs: 192.185.76.89 13.107.42.13 178.218.167.4 URL IOCs: http://kalpvedafoundation.com/amour/linkder.exe http://kalpvedafoundation.com/amour/linkder.exe http://onedrive.live.com/download?cid=4C3F5C65A99DA195&resid=4C3F5C65A99DA195%21241&authkey=AGyBKeKMs6qKShY tarot-sunce.com/linko/PL341/index.php File IOCs: Filenames: C:\Users\aETAdzjz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\\ C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\WidevineCdm\Login Data C:\Users\aETAdzjz\AppData\Local\Xpom\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\OriginTrials\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@serving.experianmarketingservices[1].txt C:\Users\aETAdzjz\AppData\Local\CocCoc\Browser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/nssdbm3.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@bidswitch[1].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-console-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Sputnik\Sputnik\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SSLErrorAssistant\Cookies C:\Users\aETAdzjz\AppData\Roaming\\Adobe\wallet.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\PepperFlash\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\.\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SwReporter\Cookies C:\Users\aETAdzjz\AppData\Local\Nichrome\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/softokn3.dll C:\Users\aETAdzjz\AppData\Roaming\\..\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome SxS\User Data\\\Login Data C:\Users\aETAdzjz\Desktop\P0Hc9z_vVr1Uxdn12a C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-environment-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Waterfox\Profiles\\\formhistory.sqlite C:\Users\aETAdzjz\AppData\Roaming\\Identities\wallets\.wallet C:\Users\aETAdzjz\Documents\Outlook Files C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@c.msn[2].txt C:\Users\aETAdzjz\AppData\Roaming\\.\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@pixel.rubiconproject[1].txt C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SwReporter\Login Data C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@microsoft[1].txt C:\Users\aETAdzjz\AppData\Roaming\filezilla\recentservers.xml C:\Users\aETAdzjz\AppData\Local\Orbitum\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\electrum.dat C:\Users\aETAdzjz\AppData\Local\Epic Privacy Browser\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-file-l1-2-0.dll C:\Users\aETAdzjz\AppData\Local\360Browser\Browser\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\182004765502204915563913.tmp C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-runtime-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Temp\182029721896254689506701.tmp-journal C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@doubleclick[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Default\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\..\Web Data C:\Users\aETAdzjz\AppData\Local\CocCoc\Browser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Bromium\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\\aetadzjz@g.live[1].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-errorhandling-l1-1-0.dll C:\Users\aETAdzjz\Desktop\P0Hc9z_vVr1Uxdn12a\0K3ML.docx C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\PepperFlash\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-time-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Yandex\YandexBrowser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\.\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CrashpadMetrics-active.pma\Cookies C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adtech[2].txt C:\Users\aETAdzjz\AppData\Local\RockMelt\User Data\\\Cookies C:\Users\aETAdzjz\Documents\My Shapes\_private C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@api.bing[2].txt C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\\Adobe\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@msn[2].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@ibeu2.mookie1[2].txt C:\Users\aETAdzjz\AppData\Local\Kometa\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@at.atwola[2].txt C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\360Browser\Browser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Torch\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\182028482867542631482656.tmp C:\Users\aETAdzjz\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\\logins.json C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CertificateTransparency\Cookies C:\Users\aETAdzjz\AppData\Roaming\fghvhghvgfdgfhchfg.exe C:\Users\aETAdzjz\AppData\Local\QIP Surf\User Data\\\Web Data C:\Program Files\Qemu-ga\qemu-ga.exe C:\Users\aETAdzjz\AppData\Local\TorBro\Profile\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@smartadserver[1].txt C:\Users\aETAdzjz\AppData\Local\Temp\182032848139586271779370.tmp-journal C:\Users\aETAdzjz\Desktop\API .doc.rtf C:\Users\aETAdzjz\AppData\Local\Temp\2035036576518928862638.tmp-journal C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Yandex\YandexBrowser\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adscale[1].txt C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\.\logins.json C:\Users\aETAdzjz\AppData\Local\Amigo\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@casalemedia[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-private-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\Identities\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\curbuf.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@pubmatic[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/msvcp140.dll C:\Users\aETAdzjz\AppData\Roaming\Waterfox\Profiles\\\cookies.sqlite C:\Users\aETAdzjz\AppData\Local\Safer Technologies\Secure Browser\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\182031918183732679381489.tmp-journal C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\\\formhistory.sqlite C:\Users\aETAdzjz\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\\logins.json C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-processthreads-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/mozglue.dll C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adsrvr[1].txt C:\Users\aETAdzjz\AppData\Local\Xpom\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\\\cookies.sqlite C:\Users\aETAdzjz\AppData\Local\Chedot\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\Adobe\electrum.dat C:\Users\aETAdzjz\AppData\Local\Rafotech\Mustang\User Data\\\Cookies C:\Windows\SysWOW64\cmd.exe C:\Users\aETAdzjz\AppData\Local\Orbitum\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Sputnik\Sputnik\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@ad.360yield[2].txt C:\Users\aETAdzjz\AppData\Roaming\\.\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\182029721896254689506701.tmp-wal C:\Windows\SysWOW64\timeout.exe C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Local State\Web Data C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Comodo\IceDragon\Profiles\\\formhistory.sqlite C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@ad13.adfarm1.adition[2].txt C:\Users\aETAdzjz\AppData\Local\7Star\7Star\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/ucrtbase.dll C:\Users\aETAdzjz\AppData\Local\Xpom\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@rubiconproject[1].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@www.msn[2].txt C:\Users\aETAdzjz\AppData\Local\Nichrome\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\3y2joh8o.default\cookies.sqlite C:\Users\aETAdzjz\AppData\Local\Chedot\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-process-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-convert-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Yandex\YandexBrowser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@c1.microsoft[2].txt C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Comodo\Dragon\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\..\cookies.sqlite C:\Users\aETAdzjz\AppData\Local\Go!\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\WidevineCdm\Cookies C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Bromium\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@turn[1].txt C:\Users\aETAdzjz\AppData\Local\Chromium\User Data\\\Cookies C:\Users\aETAdzjz\Documents\z8Q_yDu1jaODNbm6Rg\-B8VZiXAJgeyuxM1J9Dr.docx C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-debug-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\182029721896254689506701.tmp C:\Users\aETAdzjz\AppData\Roaming\\.\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\RockMelt\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Go!\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\brave\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\.wallet C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@m.exactag[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\FileTypePolicies\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Default\Cookies C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\.\Web Data C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\.wallet C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adnxs[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\2035036576518928862638.tmp C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-multibyte-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\wallet.dat C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\INetCache\\ C:\Users\aETAdzjz\AppData\Local\CentBrowser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\..\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\182029721896254689506701.tmp-shm C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Crashpad\Cookies C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\logins.json C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Bromium\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\182032848139586271779370.tmp-wal C:\Users\aETAdzjz\AppData\Roaming\\Adobe\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adformdsp[2].txt C:\Users\aETAdzjz\AppData\Roaming\\..\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Crashpad\Login Data C:\Users\aETAdzjz\Documents\imR3uKJ.xlsx C:\Users\aETAdzjz\AppData\Roaming\Opera Software\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@serving-sys[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\pnacl\Web Data C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\.purple\accounts.xml C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adfarm1.adition[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\182028482867542631482656.tmp-wal C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@mathtag[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\182032848139586271779370.tmp C:\Users\aETAdzjz\AppData\Local\Rafotech\Mustang\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-libraryloader-l1-1-0.dll C:\Users\aETAdzjz\Documents\z8Q_yDu1jaODNbm6Rg\uhxF0nw C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\WidevineCdm\Web Data C:\Users\aETAdzjz\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\\\cookies.sqlite C:\Users\aETAdzjz\AppData\Local\Vivaldi\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SSLErrorAssistant\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\\aetadzjz@live[2].txt C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@bs.serving-sys[1].txt C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\wallets\wallet.dat C:\Windows\system32\MSVBVM60.DLL C:\Users\aETAdzjz\AppData\Local\Kometa\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CertificateTransparency\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\182031918183732679381489.tmp-wal C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\FileTypePolicies\Cookies C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-interlocked-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-math-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\electrum.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\First Run\Login Data C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-heap-l1-1-0.dll db997093559061c627f0580b0046fbc6c93be52f6bb3056c17688ab60ea3e729 C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\.wallet C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\First Run\Cookies C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\wallets\wallet.dat C:\Users\aETAdzjz\Documents\tXrvgvZhuK.docx C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\EVWhitelist\Login Data C:\Users\aETAdzjz\AppData\Roaming\8pecxstudios\Cyberfox\Profiles\\\formhistory.sqlite C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-processthreads-l1-1-1.dll C:\Users\aETAdzjz\AppData\Local\TorBro\Profile\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@advertising[1].txt C:\Users\aETAdzjz\AppData\Local\Elements Browser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@linkedin[2].txt C:\Users\aETAdzjz\AppData\Local\Orbitum\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-locale-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\.\formhistory.sqlite C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-conio-l1-1-0.dll C:\Users\aETAdzjz\Documents\Nu56E.docx C:\Users\aETAdzjz\AppData\Local\Epic Privacy Browser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Local State\Cookies C:\Users\aETAdzjz\AppData\Roaming\\Identities\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adform[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\182031289079242754423543.tmp-wal bb7c277a1ea7a3bb3882861f8571185ee64edbf10e837b2010361380139f5444 C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@exelator[1].txt C:\Users\aETAdzjz\AppData\Roaming\\Adobe\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SSLErrorAssistant\Web Data C:\Users\aETAdzjz\AppData\Roaming\\.\wallet.dat C:\Users\aETAdzjz\AppData\Local\Temp\182033787308292230589271.tmp-journal C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-heap-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@openx[1].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-util-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Sputnik\Sputnik\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\\aetadzjz@google[1].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\First Run\Web Data C:\Users\aETAdzjz\AppData\Roaming\Thunderbird\Profiles\\logins.json C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@connextra[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-datetime-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-synch-l1-2-0.dll C:\Users\aETAdzjz\AppData\Local\Chromium\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\brave\\\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-string-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Superbird\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\PepperFlash\Login Data C:\Users\aETAdzjz\AppData\Local\RockMelt\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/vcruntime140.dll C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-synch-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Suhba\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\182031289079242754423543.tmp C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\pnacl\Cookies C:\Users\aETAdzjz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\Cookies\\ C:\Users\aETAdzjz\Documents\OneNote Notebooks C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\FileTypePolicies\Web Data C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@bluekai[1].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\.\Cookies C:\Users\aETAdzjz\AppData\Local\uCozMedia\Uran\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@bing[1].txt C:\Users\aETAdzjz\Documents\z8Q_yDu1jaODNbm6Rg C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-file-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Suhba\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\.\.wallet C:\Users\aETAdzjz\AppData\Local\Rafotech\Mustang\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@track.adform[2].txt C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\.wallet C:\Users\aETAdzjz\AppData\Roaming\\..\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-namedpipe-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\EVWhitelist\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\ C:\Users\aETAdzjz\AppData\Local\Torch\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-handle-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\.\cookies.sqlite C:\Users\aETAdzjz\AppData\Local\Chromium\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\Identities\.wallet C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@ih.adscale[1].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-memory-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Nichrome\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\wallets\.wallet C:\Users\aETAdzjz\AppData\Roaming\Opera Software\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@tapad[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-filesystem-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@w55c[2].txt C:\Users\aETAdzjz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\INetCookies\\ C:\Users\aETAdzjz\AppData\Roaming\\kSQ8d9iRcfRWCQRh.gif\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@eyeota[1].txt C:\Users\aETAdzjz\AppData\Local\Torch\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Go!\User Data\\\Cookies C:\Users\aETAdzjz\Desktop\~$I .doc.rtf C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-file-l2-1-0.dll C:\Users\aETAdzjz\AppData\Local\Vivaldi\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\SwReporter\Web Data C:\Users\aETAdzjz\AppData\Local\360Browser\Browser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/freebl3.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@crwdcntrl[1].txt d6dcb74ede20ce104e6cf1b52dd5551105feaf027401ef34d7ca5a5d3333fa95 C:\Users\aETAdzjz\AppData\Roaming\Waterfox\Profiles\\logins.json C:\Users\aETAdzjz\AppData\Roaming\\..\electrum.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\..\Cookies C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\.wallet C:\Users\aETAdzjz\AppData\Local\Vivaldi\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Superbird\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\pnacl\Login Data C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\3y2joh8o.default\formhistory.sqlite C:\Users\aETAdzjz\AppData\Local\7Star\7Star\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\..\logins.json C:\Users\aETAdzjz\AppData\Roaming\\h7DVpNm6QA.png\wallet.dat C:\Users\aETAdzjz\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cookies\\ C:\Users\aETAdzjz\AppData\Local\Elements Browser\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\Temp\182004765502204915563913.tmp-wal C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@scorecardresearch[2].txt C:\Program Files\qga\qga.exe C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\182004765502204915563913.tmp-journal C:\Users\aETAdzjz\AppData\Local\Suhba\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-stdio-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\..\.wallet \??\C:\Windows\syswow64\msvbvm60.dll C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/nss3.dll C:\Users\aETAdzjz\AppData\Local\Temp\182031289079242754423543.tmp-journal C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-processenvironment-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\OriginTrials\Cookies C:\Users\aETAdzjz\AppData\Local\TorBro\Profile\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@semasio[1].txt C:\Users\aETAdzjz\Documents\z8Q_yDu1jaODNbm6Rg\uhxF0nw\8O4HGEn56P C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@addthis[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-profile-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\electrum.dat C:\Users\aETAdzjz\AppData\Local\CentBrowser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\FeDQmW2i.flv\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Local\Temp\182033787308292230589271.tmp-wal C:\Users\aETAdzjz\AppData\Local\Epic Privacy Browser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\eDL9vRODWdK0.avi\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-timezone-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Safer Technologies\Secure Browser\User Data\\\Cookies C:\Users\aETAdzjz\Documents\fqs7LNS.xlsx C:\Users\aETAdzjz\AppData\Local\Elements Browser\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Superbird\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-rtlsupport-l1-1-0.dll C:\Users\aETAdzjz\AppData\Local\Amigo\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\wallets\wallet.dat Equation3_1 C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@bs.serving-sys[3].txt 1932d8c415f078ca690f84b2a7ec372d03ff32beb804629619fe3775e7850099 C:\Users\aETAdzjz\AppData\Roaming\brave\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@www.linkedin[1].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CertificateTransparency\Web Data C:\Users\aETAdzjz\AppData\Local\Amigo\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@www.bing[1].txt C:\Users\aETAdzjz\Documents\_Lw_Ioi_qC44f0vdNG C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@dpm.demdex[1].txt C:\Users\aETAdzjz\AppData\Local\7Star\7Star\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\QIP Surf\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome SxS\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\electrum.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Local State\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\EVWhitelist\Web Data C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\electrum.dat C:\Users\aETAdzjz\AppData\Roaming\\hhMbey-61drTCHdugi.m4a\.wallet C:\Users\aETAdzjz\Documents\_Lw_Ioi_qC44f0vdNG\jNZkgQds.doc C:\Users\aETAdzjz\AppData\Roaming\\Identities\wallets\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@c.bing[1].txt C:\Users\aETAdzjz\AppData\Roaming\\LJc6a5Q_MmBs.swf\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\iY Y.mp3\electrum.dat C:\Users\aETAdzjz\AppData\Local\Google\Chrome SxS\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\Kometa\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\\GU1xEN.png\wallet.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-string-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Comodo\IceDragon\Profiles\\logins.json C:\Users\aETAdzjz\AppData\Roaming\\LYycmo-cjNTfWau.pdf\wallet.dat C:\Users\aETAdzjz\AppData\Local\Comodo\Dragon\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\uCozMedia\Uran\User Data\\\Web Data C:\Users\aETAdzjz\AppData\Local\QIP Surf\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Roaming\\Identities\wallets\electrum.dat C:\Users\aETAdzjz\Documents\My Shapes C:\Users\aETAdzjz\AppData\Roaming\Opera Software\\\Cookies C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\Crashpad\Web Data C:\Users\aETAdzjz\AppData\Roaming\Comodo\IceDragon\Profiles\\\cookies.sqlite C:\Users\aETAdzjz\AppData\Roaming\\fghvhghvgfdgfhchfg.exe\.wallet C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-crt-utility-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\\foOZ1HtoS4PjQ8Udex.avi\wallet.dat C:\Users\aETAdzjz\AppData\Roaming\\Mg5zkU.png\wallet.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-sysinfo-l1-1-0.dll C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@server.adformdsp[2].txt C:\Users\aETAdzjz\AppData\Local\Temp\182033787308292230589271.tmp C:\Users\aETAdzjz\AppData\Roaming\\bMn7rPCuez.xls\wallets\electrum.dat C:\Users\aETAdzjz\AppData\Local\Temp\41E341C3\/api-ms-win-core-localization-l1-2-0.dll C:\Users\aETAdzjz\AppData\Local\Temp\182028482867542631482656.tmp-journal C:\Users\aETAdzjz\Documents\z8Q_yDu1jaODNbm6Rg\uhxF0nw\3wiKno2U6 C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@angsrvr[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CrashpadMetrics-active.pma\Web Data C:\Users\aETAdzjz\AppData\Local\Comodo\Dragon\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Local\Chedot\User Data\\\Cookies C:\Users\aETAdzjz\AppData\Local\uCozMedia\Uran\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming C:\Users\aETAdzjz\AppData\Local\Safer Technologies\Secure Browser\User Data\\\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@demdex[1].txt C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\\..\formhistory.sqlite C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@adserving.ancoraplatform[2].txt C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\OriginTrials\Web Data C:\Users\aETAdzjz\AppData\Roaming\\Macromedia\wallets\.wallet C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\..\Login Data C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\\CrashpadMetrics-active.pma\Login Data C:\Users\aETAdzjz\AppData\Roaming\Microsoft\Windows\Cookies\Low\\aetadzjz@google[2].txt MD5 hashes: e479444bdd4ae4577fd32314a68f5d28 6d778e83f74a4c7fe4c077dc279f6867 b52a0ca52c9c207874639b62b6082242 4217fd1f9c0d91c9d57cc6767f58c0b5 0fc9ece6a952fb99876dc1c0ed720b24 8e99b89611a54ea10706d3abcabf3b99 7c342898a34f5fc5ce6dd147f5492427 ac290dad7cb4ca2d93516580452eda1c 404604cd100a1e60dfdaf6ecf5ba14c0 d500d9e24f33933956df0e26f087fd91 86a42d3b113836c1c1479970288f1b11 9e682f1eb98a9d41468fc3e50f907635 a031e9d545551a24e4c77344f84539d4 d6326267ae77655f312d2287903db4d3 b7c14ec6110fa820ca6b65f5aec85911 8b0ba750e7b15300482ce6c961a932f0 7587bf9cb4147022cd5681b015183046 19a40af040bd7add901aa967600259d9 2ea3901d7b50bf6071ec8732371b821c e2f648ae40d234a3892e1455b4dbbe05 0d1aa99ed8069ba73cfd74b0fddc7b3a f167061aa11d4d88bce348a7704db935 12cc7d8017023ef04ebdd28ef9558305 88ff191fd8648099592ed28ee6c442a5 6ea692f862bdeb446e649e4b2893e36f 72e28c902cd947f9a3425b19ac5a64bd 343aa83574577727aabe537dccfdeafc d97a1cb141c6806f0101a5ed2673a63d 569a7a65658a46f9412bdfa04f86e2b2 6db54065b33861967b491dd1c8fd8595 fee0926aa1bf00f2bec9da5db7b2de56 a2f2258c32e3ba9abf9e9e38ef7da8c9 502263c56f931df8440d7fd2fa7b7c00 35fc66bd813d0f126883e695664e7b83 cb978304b79ef53962408c611dfb20f5 41a348f9bedc8681fb30fa78e45edb24 a2d7d7711f9c0e3e065b2929ff342666 0f079489abd2b16751ceb7447512a70d 556ea09421a0f74d31c4c0a89a70dc23 67827db2380b5848166a411bae9f0632 d41d8cd98f00b204e9800998ecf8427e 4a755de35d5f03cd209e9f5725fe92b5 d0873e21721d04e20b6ffb038accf2f1 8d02dd4c29bd490e672d271700511371 0755beab2e195850485c6aa4fd79870a 6389834774166f7a20359003254939f2 6f6796d1278670cce6e2d85199623e27 1d0658e804791ee90258526373d8e5c4 5f73a814936c8e7e4a2dfd68876143c8 fefb98394cb9ef4368da798deab00e21 93d3da06bf894f4fa21007bee06b5e7d 71af7ed2a72267aaad8564524903cff6 9910a1bfdc41c5b39f6af37f0a22aacd 1cc146d47918d23cee86a97c77f87918 b8f205f9f2dbf68c60dcfc3df3e9053d eff11130bfe0d9c90c0026bf2fb219ae aec2268601470050e62cb8066dd41a59 babf80608fd68a09656871ec8597296c 94ae25c7a5497ca0be6882a00644ca64 849f2c3ebf1fcba33d16153692d5810f fdba0db0a1652d86cd471eaa509e56ea 0de20195a34bb53aeec70f622a926f6d 109f0f02fd37c84bfc7508d4227d7ed5 60b900594c282fd33198488327e5fa32 d0289835d97d103bad0dd7b9637538a1 SHA1 hashes: e7be926f0f7d842271f7edc7a4989544f4477da7 2fd63c18cc5dc4defc7ea82f421050e668f68548 77edf9509a252e886d4da388bf9c9294d95498eb 9ce3b9a182429c0dba9821e2e72d3ab46f5d0a06 71a2f5d76d23e48cef8f258eaad63e586cfc0e19 ed0938bbc0e2a863859aad64606b8fc4c69b810a 58469835ab4b916927b3cabf54aee4f380ff6748 33952578924b0376ca4ae6a10b8d4ed749d10688 44cc0038e891ae73c43b61a71a46c97f98b1030d 66e76c0574a549f293323dd6f863a8a5b54f3f9b 116846ca871114b7c54148ab2d968f364da6142f 316d86926b558c9f3f6133739c1a8477b9e60740 3197cb45787d47bac80223e3e98851e48a122efa 84fceae03d28ff1907048acee7eae7e45baaf2bd 6fb845d6a82102ff74bd35f42a2844d8c450413b f68f1096c5a3f7b90824aa0f7b9da372228363ff 6a4f818b53606a5602c609ec343974c2103bc9cc 9e39e505d80d67b347b19a349a1532746c1f7f88 99ef5a5fac0807bce8a5164d0c2e4dca012b0fcc 3814214b06d827b877a6a23944f53720d3682ecd f7ac28bbc47e46485025a51eeb6c304b70cee215 6f6d35a033e466749b8fd1574d7827a91faaa82c 8aa2155c3d3d5aa23f56cd0bc507255fc953ccc3 db8b3fd502f0953c7a28e71b75e8c06a460a7449 1581961d4cf6f304fbe88233d7017f9e71b6b4e4 a17b1f36e73b82ef9bfb831058f187535a550eb8 f5d9cf848f79a57f690da9841c209b4837c2e6c3 f859a66009d1caae88bf36b569b63e1fbdae9493 681bf1e0ca4394c89d68d2b5ad1f75f4e54e04b1 d9d750e828b629cfb7b402a3442947545d8d781b 85e0ceca36f657ddf6547aa0744f0855a27527ee f2106306a8f6f0da5afb7fc765cfa0757ad5a628 9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7 3d07f8db1010627f1481b5fde714185215971935 91f3008494f3a842a5b59319c5a75e15ff6c405e d960016c4f553e461afb5b06b039a15d2e76135e eed8a788db31c39463e24e1f0197f366700fafca 1e47230a7ebcfaf643087a1929a385e0d554ad15 6c537678ab6cfd6f3ea0dc0f5abefd1c4924f0c0 da39a3ee5e6b4b0d3255bfef95601890afd80709 47fa76778556f34a5e7910c816c78835109e4050 f02975c3c5d386975ad1e662f094b7cc077a73cf 679dd712ed1c46fbd9bc8615598da585d94d5d87 5806e2ac52fe48573dca9b2ac8e4504d7d781b6e f739ba9b548ee64b13eb434a3130406d23f836e3 d31a84c1499a9128a8f0efea4230fcfa6c9579be 05b6322979b0b67526ae5cd6e820596cbe7393e4 8a8437123de5a22ab843adc24a01ac06f48db0d3 1f8eda52d31512ebfdd546be60990b95c8e28bfb eca42f7754fb0017e86d50d507674981f80bc0b9 7b996a476a9f7fe763ab19c39d3dc318966d18b8 363ed259905442c4e3b89901bfd8a43b96bf25e4 cf4c89a6e46090d3d8feeb9eb697aea8a26e4088 ba1f5384072df8af5743f81fd02c98773b5ed147 5ed7e68d094e2a41fca037f9ec12698213c49976 fa949453557d0049d723f9615e4f390010520eda 523a3d7c3f4491e67fc710575d8e23314db2c1a2 f5a4eb3d8ac8fb68af716857629a43cd6be63473 1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f f3035a756e2e963764912c6b432e74615ae07011 ef7420141bb15ac334d3964082361a460bfdb975 8ceebe1e9abb0044808122557de8aab28ad14575 608eeb7488042453c9ca40f7e1398fc1a270f3f4 4dfa181dde8c5ba010cb2a0d6d8a74a835a1ddd7 08ad49071afdb4c2b095c6bcb07336ab2f267387 SHA256 hashes: 94a5df1227818edbfd0d5091c6a48f86b4117c38550343f780c604eee1cd6231 24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca bb33a9e906a5863043753c44f6f8165afe4d5edb7e55efa4c7e6e1ed90778eca fe117e2f56177afe116cd747fe1df06d60f4ab5e324530f8fbdcecb826e63e1c 30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1 bb25ccf8694d1fcfce85a7159dcf6985fdb54728d29b021cb3d14242f65909ce c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b 9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2 66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735 b00114acc920b170147d1a11b5272f210fd1bb8033ee0c7a072680508d1ee305 73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c 2cade4fc6b55395aa4bc691c03755e609bdb1b25b82750d2046929b6d39ca251 7ea06b7050f9ea2bcc12af34374bdf1173646d4e5ebf66ad690b37f4df5f3d4e 4b704b36e1672ae02e697efd1bf46f11b42d776550ba34a90cd189f6c5c61f92 9dab884071b1f7d7a167f9bec94ba2bee875e3365603fa29b31de286c6a97a1d 91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a c310cc91464c9431ab0902a561af947fa5c973925ff70482d3de017ed3f73b7d c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03 393ae7f06fe6cd19ea6d57a93dd0acd839ee39ba386cf1ca774c4c59a3bfebd8 aecd0296f38fa691e15177c5fe550172c938c61036a910bf05e8f71faa2b442d a97dcca76cdb12e985dff71040815f28508c655ab2b073512e386dd63f4da325 f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d e000b0cae7df0753ea12d97175e393bacf905613eef1a59d7e1784a913993f58 96898930ffb338da45497be019ae1adcd63c5851141169d3023e53ce4c7a483e 23b1cf9e40b9ba27ec7eb7cd01b4609e4418aba063275fb2a0aebcf28f8f8620 7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2 541a293c450e609810279f121a5e9dfa4e924d52e8b0c6c543512b5026efe7ec c20353043062ed74b77a57e471bf4293b7e57b9b51942a2616c25dc16a9e7e20 5dd4ccd63e6ed07ca3987ab5634ca4207d69c47c2544dfefc41935617652820f 3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1 2257fea1e71f7058439b3727ed68ef048bd91dcacd64762eb5c64a9d49df0b57 f7d450a0f59151bcefb98d20fcae35f76029df57138002db5651d1b6a33adc86 7670fdede524a485c13b11a7c878015e9b0d441b7d8eb15ca675ad6b9c9a7311 f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4 565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33 8eb5270fa99069709c846db38be743a1a80a42aa1a88776131f79e1d07cc411c bb7c277a1ea7a3bb3882861f8571185ee64edbf10e837b2010361380139f5444 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb 9a7f11c212d61856dfc494de111911b7a6d9d5e9795b0b70bbbc998896f068ae 5ff8a87fd7626d4beab7a5be7f285f1d1d64478509f27aca6fd9deb3f69155e7 65ded8d2ce159b2f5569f55b2caf0e2c90f3694bd88c89de790a15a49d8386b9 0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9 44f6df4280c8ecc9c6e609b1a4bfee041332d337d84679cfe0d6678ce8f2998a c2b933557ca7812205a57a0f724cdb464e7b06cbbb77a657fb337c0307e888c8 1932d8c415f078ca690f84b2a7ec372d03ff32beb804629619fe3775e7850099 d6dcb74ede20ce104e6cf1b52dd5551105feaf027401ef34d7ca5a5d3333fa95 c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382 c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b 03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97 5be8fbb1985582aa220e9bb5d8781c4e3c21206e31cff7f911cdb2fbbed1acb9 69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed 830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0 58f82370f5b62c631e96b51171d2264c4c759be04bb111ab29f26c6d96e08952 db997093559061c627f0580b0046fbc6c93be52f6bb3056c17688ab60ea3e729 945cc64ee04b1964c1f9fcdc3124dd83973d332f5cfb696cdf128ca5c4cbd0e5 deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719 90fae0e7c3644a6754833c42b0ac39b6f23859f9a7cf4b6c8624820f59b9dad3 c4f60f911068ab6d7f578d449ba7b5b9969f08fc683fd0ce8e2705bbf061f507 SSDEEP hashes: 384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V 3072:55B4b9jFsfD22PXsE7TxKRGvgkKkGAkVzM5yrUk75TCpKhs9:osFkKdKRIhKtAkVzM5yrUkha 384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53 3:vpqMLJUQ2W0cpStcwVTdD:vEMWXbc8tZhp 192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP 1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw 192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7 384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7 384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF 24:TLEag/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fB:ToR/ecVTgPOpEveoJZFrU1cQB 384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8 384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd 1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj 384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV 384:QS+qYFlfk44jGaCvySv3Lxj0eu1Du1ju1Uu1Evdj44V/Dd:1+qYj+cF3LxgYD 6144:0DKVMHO3ZKWEZkBetYMIx2SBD7VIXng1dNQ13Si6u4er12v1vTUX7zP7RFk9O73n:0DKVF3wWoNtNE3BPeXgQ1MGp3kYTP9eu 192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw 192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2 384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L 3:wcaJHofQdXDk1h2caCi20f6fATikiub78Dv:wcaJofQdXQecH0f64QO8Dv 192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC 384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH 384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep 192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0 12:DBl/Zed12Of5LZWfY0xpMujuHWMu6N2OHjWOzMbdym/eRgBoQFmgW2FOmO6Mz6LX:DLZs1x7WxHaiSlMxosJF/Ezo 384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX 12288:lUykCSZQeSdPLHNHgdvb0INuK8afD7Gj7qqtisK1yty+79mmUE7evpp:hsQeS9Hpg7ear7GXZgTvmUwup 192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs 24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn 192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q 96:GKuNQIoYnMvqyWx7pnqH+w/fVIrECuKdPraBdUDBBVWqwmKT/WTPepeWbtxY:tJkMvuzzTP6bt 3:oqu:oV 192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv 192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s 48:T9aC3BdjNPp+suktLReRK+nVaNU74ePLrL2Iua6maxNPM5ETQTcrQHIvYysX0jpi:RVdvUVaN+LrL2IlLvU+kYysX0j4t 24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb 384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp 192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552 384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y 24:LLi4N0KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6UwcpYMQW:zNz+JH3yJUheCVE9V8MX0PFlNU1uW 384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp 768:Ak9YyFYxwLT2qDk/BRB6FRutiSiHQ6orjcvYGfQjq89Zh116RS2CuD9CbVJsgY6L:j5hf2qgB67uUS+Q6XajRhr6Rs8oyDT+ 3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv 192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI 384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp 384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu 3:: 192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP 6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z 384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex 192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB 49152:y9zgkv58gK28UBvyFfYELWcLPik69kBREGr1YdgIVWfo74T+BP3E:EFRUaaqnG5ihETCP3E 384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn 384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj 384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv 384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8 96:Dbn5HKlV8/VDHLRilOhFTFf6FdqA9LJp6Y/e2DkrGJ6hmCcaLeU8ukONPk7iriQ:3n5HKEnhTFiPsvW7iri 384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0 192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU 192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v 3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR 384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/