Unpacked Pony

Virtual Machine Information

Name	win10_64
Description	Windows 10 (TH2, 64-bit), MS Office 2016 (64-bit), Acrobat Reader DC 15.7 (32-bit)
Architecture	x86 64-bit
Operating System	Windows 10 Threshold 2
Kernel Version	10.0.10586.0 (0de6dc23-8e19-4bb7-8608-d54b1e6fa379)

System Information

Computer Name	X2VS1CUM
User Domain	X2VS1CUM
User Name	Nd9E1FYi
User Profile	C:\Users\Nd9E1FYi
Temp Directory	C:\Users\Nd9E1FYi\AppData\Local\Temp
System Root	C:\Windows
Sample Directory	C:\Users\Nd9E1FYi\Desktop

Software Information

Adobe Acrobat Reader Version	15.007.20033
Microsoft Office	2016
Microsoft Office Version	16.0.4266.1001
Internet Explorer Version	11.0.10586.0
Chrome Version	60.0.3112.113
Firefox Version	55.0.2
Flash Version	25.0.0.148
Java Version	8.0.1440.1

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (19)

Filename	PID	GUI
C:\Program Files (x86)\Adobe\satisfactioncup.exe	#3688
C:\Program Files (x86)\Common Files\currently_editions_chart.exe	#3416
C:\Program Files (x86)\Common Files\industries.exe	#3284
C:\Program Files (x86)\Google\concentrations-disability.exe	#4012
C:\Program Files (x86)\MSECache\processed-landscapes.exe	#3944
C:\Program Files (x86)\Windows Photo Viewer\formerly.exe	#3308
C:\Program Files (x86)\Windows Portable Devices\pathology.exe	#2596
C:\Program Files (x86)\Windows Portable Devices\utilization_triangle_lauren.exe	#2592
C:\Program Files\Internet Explorer\thomson-asks.exe	#3960
C:\Program Files\Java\alternative-available.exe	#4068
C:\Program Files\MSBuild\accurately minutes.exe	#4004
C:\Program Files\MSBuild\listpriceinvolving.exe	#4044
C:\Program Files\Microsoft Analysis Services\automobile allen.exe	#3740
C:\Program Files\Microsoft Office 15\mechanics_king.exe	#2076
C:\Program Files\Windows Journal\pakistantall.exe	#3876
C:\Program Files\Windows Mail\aspect-waiver.exe	#3364
C:\Program Files\Windows Multimedia Platform\blake weekends trends.exe	#3408
C:\Program Files\Windows NT\rep.exe	#4080
C:\Program Files\WindowsPowerShell\basics-expectations.exe	#2400

Files (339)

Filename
C:\Users\Nd9E1FYi\AppData\Local\Temp\5YMB1Mzw_.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\7MbRSvWtqPL.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\7myS4PuvSm.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\ANL6oQU5zBj1qXjaf_-5.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\BpprjpxaewqGOXAR3xz.png
C:\Users\Nd9E1FYi\AppData\Local\Temp\J-tAzTOTPc.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\JHQr83zoWo6meqWye6n.gif
C:\Users\Nd9E1FYi\AppData\Local\Temp\JZ4S.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\KIqifEpLBg9c0 YHcG.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\NavVzAVRXdwNWaG-Yc.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\Nouw.xlsx
C:\Users\Nd9E1FYi\AppData\Local\Temp\O20NqChDY5l.jpg
C:\Users\Nd9E1FYi\AppData\Local\Temp\Q3wgJ_.gif
C:\Users\Nd9E1FYi\AppData\Local\Temp\R2Ir uWaN3Fz.avi
C:\Users\Nd9E1FYi\AppData\Local\Temp\Rg-yuDe7Td9FNS.gif
C:\Users\Nd9E1FYi\AppData\Local\Temp\SRP6rKaOmMfhgBIKm.avi
C:\Users\Nd9E1FYi\AppData\Local\Temp\Ww2hWgpOi_6M6g-Zc.gif
C:\Users\Nd9E1FYi\AppData\Local\Temp\YGZ5JVb0.mkv
C:\Users\Nd9E1FYi\AppData\Local\Temp\YsLJw3rcNWB8nRr66.mkv
C:\Users\Nd9E1FYi\AppData\Local\Temp\ZG0a6dUhYdYVPv0FE.odt
C:\Users\Nd9E1FYi\AppData\Local\Temp\_g0INQZ_M0qVpvHdEh.ppt
C:\Users\Nd9E1FYi\AppData\Local\Temp\aIhO20PbL Fv8UiKA6d.mp4
C:\Users\Nd9E1FYi\AppData\Local\Temp\bEDn8G3cPptf.odp
C:\Users\Nd9E1FYi\AppData\Local\Temp\bTANrwbFAqrET.bmp
C:\Users\Nd9E1FYi\AppData\Local\Temp\cP63Gm.bmp
C:\Users\Nd9E1FYi\AppData\Local\Temp\cdLIFweI.doc
C:\Users\Nd9E1FYi\AppData\Local\Temp\cy3pK_y.odp
C:\Users\Nd9E1FYi\AppData\Local\Temp\fFDBJ6Y3zz7.xlsx
C:\Users\Nd9E1FYi\AppData\Local\Temp\fNzLCA6q06SaibSvE.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\jDObnDMeoe9fw.xlsx
C:\Users\Nd9E1FYi\AppData\Local\Temp\l8oPy4sAVWzUBFxcma.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\q6MSp_zXwy31.mp3
C:\Users\Nd9E1FYi\AppData\Local\Temp\rXc5PJI7Zw.gif
C:\Users\Nd9E1FYi\AppData\Local\Temp\rfRSMRxGwLH_eE-dMk.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\swOqlxOQVlOXRRkd.ots
C:\Users\Nd9E1FYi\AppData\Local\Temp\wYK UdcdVF lV9zxxGcT.mkv
C:\Users\Nd9E1FYi\AppData\Local\Temp\wzg0uA53S5K3H.wav
C:\Users\Nd9E1FYi\AppData\Roaming\2bH41CwnOqgMkSwX.doc
C:\Users\Nd9E1FYi\AppData\Roaming\3gTso-6exiW7dNTef.xlsx
C:\Users\Nd9E1FYi\AppData\Roaming\6bOJ.jpg
C:\Users\Nd9E1FYi\AppData\Roaming\7GClQNfFlwLxXcE.png
C:\Users\Nd9E1FYi\AppData\Roaming\CMK52Ob.rtf
C:\Users\Nd9E1FYi\AppData\Roaming\DqiuYJrDZjXpw6A.odp
C:\Users\Nd9E1FYi\AppData\Roaming\DuRc3N_.jpg
C:\Users\Nd9E1FYi\AppData\Roaming\ERCNU_hxJt.flv
C:\Users\Nd9E1FYi\AppData\Roaming\FdOEoKgjpY9Qdm.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\Hk5pdH.ppt
C:\Users\Nd9E1FYi\AppData\Roaming\OBSxWtcADN3sVCtSOgcG.swf
C:\Users\Nd9E1FYi\AppData\Roaming\PhEyL-xeOhzAc.ppt
C:\Users\Nd9E1FYi\AppData\Roaming\Qcx ZU.flv
C:\Users\Nd9E1FYi\AppData\Roaming\U7g69FldCVvU5MwpM.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\UqbD-na8WjTYvdqu3C7_.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\YiN7FsXO4GP.pptx
C:\Users\Nd9E1FYi\AppData\Roaming\_pKlPgFFg-Jc3WoXSp7Y.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\a-yz.wav
C:\Users\Nd9E1FYi\AppData\Roaming\d iWgIl.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\dUvQGZfgC.ppt
C:\Users\Nd9E1FYi\AppData\Roaming\jskaQmXDP3lZ60E.flv
C:\Users\Nd9E1FYi\AppData\Roaming\mbpHMrc.pptx
C:\Users\Nd9E1FYi\AppData\Roaming\mq4J9LsjdarUu2YMr.mkv
C:\Users\Nd9E1FYi\AppData\Roaming\mv11T2kIvX.mkv
C:\Users\Nd9E1FYi\AppData\Roaming\nP7lv.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\pwQBuqVi51iTl-UEid.jpg
C:\Users\Nd9E1FYi\AppData\Roaming\rbOwRIw9JE-Oqak-vlS.rtf
C:\Users\Nd9E1FYi\AppData\Roaming\s7dwbeK9qbr0DyVtA.flv
C:\Users\Nd9E1FYi\AppData\Roaming\sz2RY7a_Bpa.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\tQ6CDp1aMRjfP.rtf
C:\Users\Nd9E1FYi\AppData\Roaming\v DRdGXtvkYLmR2Vnz.flv
C:\Users\Nd9E1FYi\AppData\Roaming\xUJQqtrrL.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\z0vgKfhciwAUU.swf
C:\Users\Nd9E1FYi\Desktop\2Z7t7aKAJEYLt.mkv
C:\Users\Nd9E1FYi\Desktop\3cczvK.gif
C:\Users\Nd9E1FYi\Desktop\7r4iWh
C:\Users\Nd9E1FYi\Desktop\7r4iWh\CBnY2lu.wav
C:\Users\Nd9E1FYi\Desktop\7r4iWh\JXe-qRGw.m4a
C:\Users\Nd9E1FYi\Desktop\7r4iWh\LU1o7WtNzBQqDyU0uFx.mkv
C:\Users\Nd9E1FYi\Desktop\7r4iWh\gTLi6wHcv
C:\Users\Nd9E1FYi\Desktop\7r4iWh\gTLi6wHcv\BvgnzXPqUVQGCtwGu.m4a
C:\Users\Nd9E1FYi\Desktop\7r4iWh\gTLi6wHcv\Im8g8t.mp3
C:\Users\Nd9E1FYi\Desktop\7r4iWh\gTLi6wHcv\JIXqyV0.m4a
C:\Users\Nd9E1FYi\Desktop\7r4iWh\gTLi6wHcv\N3sbqiFpk7EyZmDipW.avi
C:\Users\Nd9E1FYi\Desktop\7r4iWh\gTLi6wHcv\TdDYftyj03rD.mkv
C:\Users\Nd9E1FYi\Desktop\7r4iWh\gTLi6wHcv\ip4-IIxR4n NCQj.mp3
C:\Users\Nd9E1FYi\Desktop\7r4iWh\gTLi6wHcv\zMvJnkSx CeYvRDPys4.png
C:\Users\Nd9E1FYi\Desktop\7r4iWh\kwJm8SY40P
C:\Users\Nd9E1FYi\Desktop\7r4iWh\kwJm8SY40P\Aeh4XQAONb.jpg
C:\Users\Nd9E1FYi\Desktop\7r4iWh\kwJm8SY40P\QM6or.rtf
C:\Users\Nd9E1FYi\Desktop\7r4iWh\kwJm8SY40P\fJi HXQENg-bN1-W.ods
C:\Users\Nd9E1FYi\Desktop\7r4iWh\kwJm8SY40P\gYLKaWP4gS.gif
C:\Users\Nd9E1FYi\Desktop\7r4iWh\kwJm8SY40P\u2EF1d3.bmp
C:\Users\Nd9E1FYi\Desktop\7vKqT1RiSYWUn.wav
C:\Users\Nd9E1FYi\Desktop\7xmS3.bmp
C:\Users\Nd9E1FYi\Desktop\BBwC1d86SY4z.odp
C:\Users\Nd9E1FYi\Desktop\CEG5prBbetRVXfN.swf
C:\Users\Nd9E1FYi\Desktop\Fv7yR7gn1V6u.png
C:\Users\Nd9E1FYi\Desktop\K4GUmY5tBsQBaENz.avi
C:\Users\Nd9E1FYi\Desktop\Kn70HK2lHZ.mkv
C:\Users\Nd9E1FYi\Desktop\KorqZ1INT7ym8dUhF.m4a
C:\Users\Nd9E1FYi\Desktop\MB0zLsUgscA_QpgM.swf
C:\Users\Nd9E1FYi\Desktop\N wCG0I3CN.odp
C:\Users\Nd9E1FYi\Desktop\N1OYHSnZcP.mp4
C:\Users\Nd9E1FYi\Desktop\U2aX7uM.mkv
C:\Users\Nd9E1FYi\Desktop\Ugn5SWWQP0Hgganf.bmp
C:\Users\Nd9E1FYi\Desktop\XjZ6x6RP.gif
C:\Users\Nd9E1FYi\Desktop\YW7byJYOTEFaxldgjqd.flv
C:\Users\Nd9E1FYi\Desktop\_LdVG8dYvsCZZa.docx
C:\Users\Nd9E1FYi\Desktop\iNoCmkv pN-Cd_O3An4e.m4a
C:\Users\Nd9E1FYi\Desktop\kJ3WEOsd.wav
C:\Users\Nd9E1FYi\Desktop\mH GP17b.mp3
C:\Users\Nd9E1FYi\Desktop\musYXrQ3SIGO0t.avi
C:\Users\Nd9E1FYi\Desktop\ogOEwU2s1DNCz1W.flv
C:\Users\Nd9E1FYi\Desktop\pUbPNpB9o6OR.bmp
C:\Users\Nd9E1FYi\Desktop\pvb77LB2sVUxDF-5mED2.png
C:\Users\Nd9E1FYi\Desktop\u60TNZew7Ds8n3VMVT.avi
C:\Users\Nd9E1FYi\Desktop\vK89F7H XVMrAU0-TD9.doc
C:\Users\Nd9E1FYi\Documents\-CwCLZ8Bg3q.pptx
C:\Users\Nd9E1FYi\Documents\-xd_Cr.docx
C:\Users\Nd9E1FYi\Documents\0i25tov2wpXGSaM.xlsx
C:\Users\Nd9E1FYi\Documents\1x8fWTou3kW_ 9PgoO.docx
C:\Users\Nd9E1FYi\Documents\29Ose2uIxZJ.docx
C:\Users\Nd9E1FYi\Documents\3W6484dEDjLw.docx
C:\Users\Nd9E1FYi\Documents\3nY63s1qd0w.pptx
C:\Users\Nd9E1FYi\Documents\4wnPwyV.xlsx
C:\Users\Nd9E1FYi\Documents\5G6n9.pptx
C:\Users\Nd9E1FYi\Documents\5ttJl9La5ZztQnQKvyC.xlsx
C:\Users\Nd9E1FYi\Documents\6cZZOFJJYDx1I4.pptx
C:\Users\Nd9E1FYi\Documents\8QefJoZR.xlsx
C:\Users\Nd9E1FYi\Documents\98rB9.pptx
C:\Users\Nd9E1FYi\Documents\9cw7k6Glo2KXFZ
C:\Users\Nd9E1FYi\Documents\9cw7k6Glo2KXFZ\AldhajAYySLx.pptx
C:\Users\Nd9E1FYi\Documents\9cw7k6Glo2KXFZ\Fbp1wsZT.rtf
C:\Users\Nd9E1FYi\Documents\9cw7k6Glo2KXFZ\TG67dv64wOlLa4.doc
C:\Users\Nd9E1FYi\Documents\9cw7k6Glo2KXFZ\_VXY4s2-sZpvX4.odt
C:\Users\Nd9E1FYi\Documents\9cw7k6Glo2KXFZ\aPOy1Xf0g.rtf
C:\Users\Nd9E1FYi\Documents\As6JX.pdf
C:\Users\Nd9E1FYi\Documents\Baom56hzfNquvdZJ-.odt
C:\Users\Nd9E1FYi\Documents\Bs7oD j2t.pptx
C:\Users\Nd9E1FYi\Documents\D8VzqR.xlsx
C:\Users\Nd9E1FYi\Documents\E8f07o-hZP26.pptx
C:\Users\Nd9E1FYi\Documents\Fi q8x.xlsx
C:\Users\Nd9E1FYi\Documents\H4 FU1Y0jY.xlsx
C:\Users\Nd9E1FYi\Documents\JTmdlkQ.xlsx
C:\Users\Nd9E1FYi\Documents\Jv- xS0.docx
C:\Users\Nd9E1FYi\Documents\Mtf7gcjCUfhJsTJjN7RY.pptx
C:\Users\Nd9E1FYi\Documents\MzzqWAP.pptx
C:\Users\Nd9E1FYi\Documents\NiA1n.docx
C:\Users\Nd9E1FYi\Documents\OMPfKBZBfbUKfeG.docx
C:\Users\Nd9E1FYi\Documents\OaflzM.odp
C:\Users\Nd9E1FYi\Documents\PSn7B0nP2GmurqpMm.docx
C:\Users\Nd9E1FYi\Documents\QChXH.xlsx
C:\Users\Nd9E1FYi\Documents\QGRkJEMmLUO.docx
C:\Users\Nd9E1FYi\Documents\SiCvuNOKsEy3UGjb.docx
C:\Users\Nd9E1FYi\Documents\UdYMSasJLsdojjPPH7Qf.docx
C:\Users\Nd9E1FYi\Documents\X nri10m0J8jSSyfjg_6.pptx
C:\Users\Nd9E1FYi\Documents\XhQotE 6WqMD6
C:\Users\Nd9E1FYi\Documents\XhQotE 6WqMD6\jvpohm-qgoHJ.docx
C:\Users\Nd9E1FYi\Documents\XhQotE 6WqMD6\saXEYrm4I 6UsI.pdf
C:\Users\Nd9E1FYi\Documents\YoqRgtzEJJFhTLYe9D6.pptx
C:\Users\Nd9E1FYi\Documents\ZJq mkVLq-VAOxF.xlsx
C:\Users\Nd9E1FYi\Documents\_0m2sZJnz7QQ43D.xlsx
C:\Users\Nd9E1FYi\Documents\b9s7uAphtpb3ps0Y.xlsx
C:\Users\Nd9E1FYi\Documents\d2t-Qs44701AjY-.pptx
C:\Users\Nd9E1FYi\Documents\e-oekQfPIgKy_KStn_W.pptx
C:\Users\Nd9E1FYi\Documents\f-KJF.docx
C:\Users\Nd9E1FYi\Documents\fT3Ta37A3g.pptx
C:\Users\Nd9E1FYi\Documents\gH6aEUzq2qcogQDuP8k.docx
C:\Users\Nd9E1FYi\Documents\gHHXbv997 4Gjv.odp
C:\Users\Nd9E1FYi\Documents\gMA8.docx
C:\Users\Nd9E1FYi\Documents\gObbjEuTDvx77eKmKhuv.docx
C:\Users\Nd9E1FYi\Documents\hmxE.docx
C:\Users\Nd9E1FYi\Documents\iVjH8T6.pptx
C:\Users\Nd9E1FYi\Documents\ibg3aNtf3j.pptx
C:\Users\Nd9E1FYi\Documents\keT7kbFuEs6MVeuYfQX.xlsx
C:\Users\Nd9E1FYi\Documents\lI0J6nyIgMm.xlsx
C:\Users\Nd9E1FYi\Documents\o7Yxl nd.pptx
C:\Users\Nd9E1FYi\Documents\qNEYK7uwvxILyPGNsl 6.xlsx
C:\Users\Nd9E1FYi\Documents\qXsDJy.xlsx
C:\Users\Nd9E1FYi\Documents\qu02YgPRhanudb3Ikri.docx
C:\Users\Nd9E1FYi\Documents\qw fmuAgGIIl2s2W2Zkz.xlsx
C:\Users\Nd9E1FYi\Documents\rPz20oCu4gDViw-.xlsx
C:\Users\Nd9E1FYi\Documents\ruRhYd0JiYDrobmIf.pptx
C:\Users\Nd9E1FYi\Documents\vHFK.xlsx
C:\Users\Nd9E1FYi\Documents\vj4FFV6gt
C:\Users\Nd9E1FYi\Documents\vj4FFV6gt\G2ZmW0M01
C:\Users\Nd9E1FYi\Documents\vj4FFV6gt\G2ZmW0M01\6L4WwvP8KVo2A5dBSNfO.pps
C:\Users\Nd9E1FYi\Documents\vj4FFV6gt\G2ZmW0M01\CByOPXEG KdHOG o.xls
C:\Users\Nd9E1FYi\Documents\vj4FFV6gt\G2ZmW0M01\_qYus5DN.docx
C:\Users\Nd9E1FYi\Documents\vj4FFV6gt\G2ZmW0M01\qtd86FL.xlsx
C:\Users\Nd9E1FYi\Documents\vj4FFV6gt\H-ameGtBiEF.ots
C:\Users\Nd9E1FYi\Documents\vj4FFV6gt\UkkqSNREK-BGooHHrJ8G.pptx
C:\Users\Nd9E1FYi\Documents\vj4FFV6gt\uXML_DP0L3akU.xlsx
C:\Users\Nd9E1FYi\Documents\xE3s0jB.docx
C:\Users\Nd9E1FYi\Documents\xGsLaNVud5dNP D.docx
C:\Users\Nd9E1FYi\Documents\xX8MWNH.docx
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\D8dVES-p.xls
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\FJsbOOsKYFH0PctveF9.ots
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\Ia2IN-z4CxjuZ2PgtI.odt
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\Wdpg8Gl3n1qf rynq.ods
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\cSDdizbgyTFMv_aow8Y.csv
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\cUG80DmeDksx17B42uJf.pps
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\eAuq1ajdg9-0GPn7IuSG.odp
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\0m-NQjbJ.xlsx
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\GqYOOhybpWUIPJ
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\GqYOOhybpWUIPJ\1_xYfDpV.rtf
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\GqYOOhybpWUIPJ\GFkLMU3aj.rtf
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\MmrivamoFB0.ods
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\pRXOEWQoq26hMCu
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\pRXOEWQoq26hMCu\4Hc4ZvP7Ggm3nh-pCqW.xls
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\pRXOEWQoq26hMCu\SUeotP6Uv.pdf
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\pRXOEWQoq26hMCu\W mT4aD.odt
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\pRXOEWQoq26hMCu\ZMmqUrtR-WNOZ3G.odp
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\pRXOEWQoq26hMCu\nNb-7Ea.xlsx
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\qDBzLpHv2
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\qDBzLpHv2\Lj48dbyrO-.rtf
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\qDBzLpHv2\T Gq.rtf
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\qDBzLpHv2\j9ldx37nEzR46Sz.ods
C:\Users\Nd9E1FYi\Documents\xdHAOC-TYon 4NTK\pTmXTP\tYrBOtJmgW_LYKEJ.docx
C:\Users\Nd9E1FYi\Documents\yVfYXYTWRodOY8I 9WP2.pptx
C:\Users\Nd9E1FYi\Documents\z7Y5yn1kVBD4-d50c.xlsx
C:\Users\Nd9E1FYi\Documents\zTa RKz.docx
C:\Users\Nd9E1FYi\Documents\ziNenFiHr.pptx
C:\Users\Nd9E1FYi\Music\C5LKRgdk7JvlB-8mj.m4a
C:\Users\Nd9E1FYi\Music\VktbsgLQEUYr.wav
C:\Users\Nd9E1FYi\Music\f7QALcET.m4a
C:\Users\Nd9E1FYi\Music\joS 7Mls-_Vh7j.wav
C:\Users\Nd9E1FYi\Music\kGs04Qtnx.m4a
C:\Users\Nd9E1FYi\Music\rrGBsz.wav
C:\Users\Nd9E1FYi\Music\wIOlFv1mOpiQYbt6l R
C:\Users\Nd9E1FYi\Music\wIOlFv1mOpiQYbt6l R\FXyz08lRAArrJRHtzL.mp3
C:\Users\Nd9E1FYi\Music\wIOlFv1mOpiQYbt6l R\McWiS0.mp3
C:\Users\Nd9E1FYi\Music\wIOlFv1mOpiQYbt6l R\WbMOvu8_EgED4w1f.m4a
C:\Users\Nd9E1FYi\Music\wIOlFv1mOpiQYbt6l R\f37Qz33YI0ww01uIAtl6.mp3
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\0K1L9IncU.mp3
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\2Y4Bx2NR
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\2Y4Bx2NR\FHaEINaeX.wav
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\2Y4Bx2NR\IINi.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\2Y4Bx2NR\OqhqdJjVcIYzhBk.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\2Y4Bx2NR\TEQkHtnPB5oNh_uBM.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\2Y4Bx2NR\fVzHtq5
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\2Y4Bx2NR\fVzHtq5\f2qI.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\2Y4Bx2NR\fVzHtq5\rjXtcOp3eLNM r1l4tq.wav
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\EX mtzYf.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\K_IPpKLr0m5dvVMC.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\mk NhL8
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\mk NhL8\IRtv3Ba
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\mk NhL8\IRtv3Ba\3MR2CIiAPB5J.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\mk NhL8\IRtv3Ba\Px7BieRDmWs.wav
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\mk NhL8\IRtv3Ba\q_SqqQMG2nlwE.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\mk NhL8\jeoQvpZq.mp3
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\mk NhL8\k I5p.mp3
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\mk NhL8\zYPXDj2uLzcInFcjEBei.wav
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\0EtDlBGs\utvB1HutC8mRbVRQ3z.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\66H4fvUaGBNvOk.mp3
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\OxqN6BeecsDbr0HlA_q.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\T64Sa4WCXkkzf.wav
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\WodKTR PLHb
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\WodKTR PLHb\ET_l_jpY8AuCPfYRkG.mp3
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\WodKTR PLHb\Nvdaq8iZYo.mp3
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\WodKTR PLHb\RPUsoi8Jj.wav
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\WodKTR PLHb\Wx9-LwrZdgP5.wav
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\a1juieS7CxoiSUxxJ.wav
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\j2VF
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\j2VF\-qR1hrQ.mp3
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\j2VF\-xes1.wav
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\j2VF\G6r0.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\j2VF\J3qe-wGrQU-5DZbCp.m4a
C:\Users\Nd9E1FYi\Music\zFtK-xWIIJj1\j2VF\Jv u_UIBy4ZEpTDSyUA.wav
C:\Users\Nd9E1FYi\Music\z_ R8uUOlpnu1oyIY.wav
C:\Users\Nd9E1FYi\Pictures\3LhrNA23bcfoH9yaX0
C:\Users\Nd9E1FYi\Pictures\3LhrNA23bcfoH9yaX0\9O1YguwzmV0Xps.bmp
C:\Users\Nd9E1FYi\Pictures\3LhrNA23bcfoH9yaX0\PX3KAwiVSfzO7 -G80j.jpg
C:\Users\Nd9E1FYi\Pictures\3LhrNA23bcfoH9yaX0\dWxBHCDT3iCwrN2slcj.gif
C:\Users\Nd9E1FYi\Pictures\3LhrNA23bcfoH9yaX0\zT_l6JUgbwBNfHMKtH
C:\Users\Nd9E1FYi\Pictures\3LhrNA23bcfoH9yaX0\zT_l6JUgbwBNfHMKtH\F80DiekmTgCr.bmp
C:\Users\Nd9E1FYi\Pictures\3LhrNA23bcfoH9yaX0\zT_l6JUgbwBNfHMKtH\e2pb0sSAlpnNfy9V.bmp
C:\Users\Nd9E1FYi\Pictures\4Ten7 b4Y-Y3WEDfAkbd.gif
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\99R_Q lVxE
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\99R_Q lVxE\-PVwcK5neWMSsDp6.png
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\99R_Q lVxE\-gfOkzZ.png
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\99R_Q lVxE\B9raDKXgemPjw2uS.jpg
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\99R_Q lVxE\D2in.jpg
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\99R_Q lVxE\hOfmqF5uYu-1v6IGr.bmp
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\99R_Q lVxE\htKN9uG8N1CkQ6.jpg
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\gZwhK4jMV2Oxn
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\gZwhK4jMV2Oxn\-GnlkHBrUP6LPFZW.png
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\gZwhK4jMV2Oxn\2kwC6oUSa-.bmp
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\gZwhK4jMV2Oxn\i2XjqHCgcktSLRgh.gif
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\igl9D7B54cXiREU.gif
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\x2aQ28LgrL0iIUBOHa08
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\x2aQ28LgrL0iIUBOHa08\Ch3lX8QwjGsJyypU5g
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\x2aQ28LgrL0iIUBOHa08\Ch3lX8QwjGsJyypU5g\sgJ2fTHckzyxrH.gif
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\x2aQ28LgrL0iIUBOHa08\Ch3lX8QwjGsJyypU5g\zLrmim F rDj
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\x2aQ28LgrL0iIUBOHa08\Ch3lX8QwjGsJyypU5g\zLrmim F rDj\GQT7utrnsXZ2ylEQ7.jpg
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\x2aQ28LgrL0iIUBOHa08\Ch3lX8QwjGsJyypU5g\zLrmim F rDj\rqe6x.gif
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\x2aQ28LgrL0iIUBOHa08\Ch3lX8QwjGsJyypU5g\zLrmim F rDj\xvW- 6gVG.bmp
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\x2aQ28LgrL0iIUBOHa08\QTDlSCaV2Rp.png
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\x2aQ28LgrL0iIUBOHa08\WYq-JZDj1kPNyp7SWQI.png
C:\Users\Nd9E1FYi\Pictures\NahBkWRFtXcNl5\x2aQ28LgrL0iIUBOHa08\WgRGomLVk3C.gif
C:\Users\Nd9E1FYi\Pictures\Xq6LlpBhda.png
C:\Users\Nd9E1FYi\Pictures\iM251B2.jpg
C:\Users\Nd9E1FYi\Videos\IHPvbQpL.avi
C:\Users\Nd9E1FYi\Videos\OUPyX78rbc-2emyH4.mkv
C:\Users\Nd9E1FYi\Videos\PdbyMOH54BS
C:\Users\Nd9E1FYi\Videos\PdbyMOH54BS\3ESeW9KQQshdUP_6_.swf
C:\Users\Nd9E1FYi\Videos\PdbyMOH54BS\C6TWOkg_hzJmd6oU N-2.flv
C:\Users\Nd9E1FYi\Videos\PdbyMOH54BS\F8H9.mkv
C:\Users\Nd9E1FYi\Videos\PdbyMOH54BS\I5yo8.avi
C:\Users\Nd9E1FYi\Videos\PdbyMOH54BS\IP2aJxcMvkdrM.swf
C:\Users\Nd9E1FYi\Videos\PdbyMOH54BS\JATLg2PK2 AOj8BcM.avi
C:\Users\Nd9E1FYi\Videos\PdbyMOH54BS\ZUowi1lVpo.swf
C:\Users\Nd9E1FYi\Videos\PdbyMOH54BS\c0_-EI GzBrn7cJVd3B.swf
C:\Users\Nd9E1FYi\Videos\gpym.flv
C:\Users\Nd9E1FYi\Videos\lffS9byWqUCJfGcnz.avi
C:\Users\Nd9E1FYi\Videos\p3qO-2hXsJ
C:\Users\Nd9E1FYi\Videos\p3qO-2hXsJ\8Be-.avi
C:\Users\Nd9E1FYi\Videos\p3qO-2hXsJ\9MFoWkBYiBkH.mkv
C:\Users\Nd9E1FYi\Videos\p3qO-2hXsJ\HsnGsi_Tc03Bi.mp4
C:\Users\Nd9E1FYi\Videos\p3qO-2hXsJ\_XJ6Bg.mkv
C:\Users\Nd9E1FYi\Videos\p3qO-2hXsJ\ltNteBYBPl6LucudY.avi
C:\Users\Nd9E1FYi\Videos\p3qO-2hXsJ\pG69.mp4
C:\Users\Nd9E1FYi\Videos\p3qO-2hXsJ\pqykvFcBHgDT2M.avi
C:\Users\Nd9E1FYi\Videos\p3qO-2hXsJ\uhpz.mp4
C:\Users\Nd9E1FYi\Videos\p9fnBVzB i
C:\Users\Nd9E1FYi\Videos\p9fnBVzB i\1a8ZbwX3CqJc.flv
C:\Users\Nd9E1FYi\Videos\p9fnBVzB i\AaeL.swf
C:\Users\Nd9E1FYi\Videos\p9fnBVzB i\VfZF3.swf
C:\Users\Nd9E1FYi\Videos\p9fnBVzB i\cC2uMBAe54I7psr.mp4
C:\Users\Nd9E1FYi\Videos\p9fnBVzB i\crPyqP6L9bzU2w x.mp4
C:\Users\Nd9E1FYi\Videos\p9fnBVzB i\jGnYPLqLol23kHBdejQ.avi
C:\Users\Nd9E1FYi\Videos\p9fnBVzB i\lviLexFnitBb.swf
C:\Users\Nd9E1FYi\Videos\p9fnBVzB i\uYiyMUp4O4hhfz8W.avi
C:\Users\Nd9E1FYi\Videos\p9fnBVzB i\zECoGoqqe.swf
C:\Users\Nd9E1FYi\Videos\q_he.mp4
C:\Users\Nd9E1FYi\Videos\zQvgTCBzjCfffnVS4.swf

Virtual Machine Information

System Information

Software Information

Randomly Created Artifacts

Before

After