VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: Ransomware, Trojan |
svchost.exe
Windows Exe (x86-32)
Created at 2019-05-15T13:44:00
Remarks
(0x200001d): The maximum number of extracted files was exceeded. Some files may be missing in the report.
(0x200001b): The maximum number of file reputation requests per analysis (20) was exceeded.
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
File Reputation Information
»
Severity |
Blacklisted
|
First Seen | 2019-05-15 14:32 (UTC+2) |
Last Seen | 2019-05-15 14:48 (UTC+2) |
Names | Win32.Trojan.Filecoder |
Families | Filecoder |
Classification | Trojan |
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x409f34 |
Size Of Initialized Data | 0xc200 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2019-02-01 18:36:19+00:00 |
Sections (1)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.rdata | 0x401000 | 0xd178 | 0xd200 | 0x400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.08 |
Imports (5)
»
KERNEL32.dll (45)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SetFilePointerEx | 0x0 | 0x401024 | 0xcb64 | 0xbf64 | 0x467 |
CloseHandle | 0x0 | 0x401028 | 0xcb68 | 0xbf68 | 0x52 |
lstrlenW | 0x0 | 0x40102c | 0xcb6c | 0xbf6c | 0x54e |
CreateFileW | 0x0 | 0x401030 | 0xcb70 | 0xbf70 | 0x8f |
HeapCreate | 0x0 | 0x401034 | 0xcb74 | 0xbf74 | 0x2cd |
GetCurrentProcess | 0x0 | 0x401038 | 0xcb78 | 0xbf78 | 0x1c0 |
ExitProcess | 0x0 | 0x40103c | 0xcb7c | 0xbf7c | 0x119 |
CreateThread | 0x0 | 0x401040 | 0xcb80 | 0xbf80 | 0xb5 |
GetCurrentThread | 0x0 | 0x401044 | 0xcb84 | 0xbf84 | 0x1c4 |
SetThreadPriority | 0x0 | 0x401048 | 0xcb88 | 0xbf88 | 0x499 |
WaitForMultipleObjects | 0x0 | 0x40104c | 0xcb8c | 0xbf8c | 0x4f7 |
Sleep | 0x0 | 0x401050 | 0xcb90 | 0xbf90 | 0x4b2 |
GetLogicalDrives | 0x0 | 0x401054 | 0xcb94 | 0xbf94 | 0x209 |
SetFilePointer | 0x0 | 0x401058 | 0xcb98 | 0xbf98 | 0x466 |
FindClose | 0x0 | 0x40105c | 0xcb9c | 0xbf9c | 0x12e |
lstrcmpiA | 0x0 | 0x401060 | 0xcba0 | 0xbfa0 | 0x544 |
lstrcmpiW | 0x0 | 0x401064 | 0xcba4 | 0xbfa4 | 0x545 |
lstrcpyA | 0x0 | 0x401068 | 0xcba8 | 0xbfa8 | 0x547 |
ReadFile | 0x0 | 0x40106c | 0xcbac | 0xbfac | 0x3c0 |
lstrcatW | 0x0 | 0x401070 | 0xcbb0 | 0xbfb0 | 0x53f |
GetModuleFileNameW | 0x0 | 0x401074 | 0xcbb4 | 0xbfb4 | 0x214 |
CreateProcessW | 0x0 | 0x401078 | 0xcbb8 | 0xbfb8 | 0xa8 |
GetEnvironmentVariableW | 0x0 | 0x40107c | 0xcbbc | 0xbfbc | 0x1dc |
GetDriveTypeA | 0x0 | 0x401080 | 0xcbc0 | 0xbfc0 | 0x1d2 |
GetTempPathW | 0x0 | 0x401084 | 0xcbc4 | 0xbfc4 | 0x285 |
GetTempFileNameW | 0x0 | 0x401088 | 0xcbc8 | 0xbfc8 | 0x283 |
SetFileAttributesW | 0x0 | 0x40108c | 0xcbcc | 0xbfcc | 0x461 |
GetFileAttributesW | 0x0 | 0x401090 | 0xcbd0 | 0xbfd0 | 0x1ea |
FindFirstFileW | 0x0 | 0x401094 | 0xcbd4 | 0xbfd4 | 0x139 |
FindNextFileW | 0x0 | 0x401098 | 0xcbd8 | 0xbfd8 | 0x145 |
CopyFileW | 0x0 | 0x40109c | 0xcbdc | 0xbfdc | 0x75 |
MoveFileExW | 0x0 | 0x4010a0 | 0xcbe0 | 0xbfe0 | 0x360 |
SetPriorityClass | 0x0 | 0x4010a4 | 0xcbe4 | 0xbfe4 | 0x47d |
MultiByteToWideChar | 0x0 | 0x4010a8 | 0xcbe8 | 0xbfe8 | 0x367 |
WideCharToMultiByte | 0x0 | 0x4010ac | 0xcbec | 0xbfec | 0x511 |
CompareStringA | 0x0 | 0x4010b0 | 0xcbf0 | 0xbff0 | 0x61 |
WriteFile | 0x0 | 0x4010b4 | 0xcbf4 | 0xbff4 | 0x525 |
GetFileSizeEx | 0x0 | 0x4010b8 | 0xcbf8 | 0xbff8 | 0x1f1 |
GetLastError | 0x0 | 0x4010bc | 0xcbfc | 0xbffc | 0x202 |
lstrlenA | 0x0 | 0x4010c0 | 0xcc00 | 0xc000 | 0x54d |
GetProcessHeap | 0x0 | 0x4010c4 | 0xcc04 | 0xc004 | 0x24a |
HeapFree | 0x0 | 0x4010c8 | 0xcc08 | 0xc008 | 0x2cf |
HeapReAlloc | 0x0 | 0x4010cc | 0xcc0c | 0xc00c | 0x2d2 |
lstrcpyW | 0x0 | 0x4010d0 | 0xcc10 | 0xc010 | 0x548 |
HeapAlloc | 0x0 | 0x4010d4 | 0xcc14 | 0xc014 | 0x2cb |
ADVAPI32.dll (8)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegQueryValueExW | 0x0 | 0x401000 | 0xcb40 | 0xbf40 | 0x26e |
RegOpenKeyExW | 0x0 | 0x401004 | 0xcb44 | 0xbf44 | 0x261 |
RegCreateKeyExW | 0x0 | 0x401008 | 0xcb48 | 0xbf48 | 0x239 |
RegCloseKey | 0x0 | 0x40100c | 0xcb4c | 0xbf4c | 0x230 |
CryptGenRandom | 0x0 | 0x401010 | 0xcb50 | 0xbf50 | 0xc1 |
CryptReleaseContext | 0x0 | 0x401014 | 0xcb54 | 0xbf54 | 0xcb |
CryptAcquireContextW | 0x0 | 0x401018 | 0xcb58 | 0xbf58 | 0xb1 |
RegSetValueExW | 0x0 | 0x40101c | 0xcb5c | 0xbf5c | 0x27e |
SHELL32.dll (2)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SHChangeNotify | 0x0 | 0x4010dc | 0xcc1c | 0xc01c | 0x7f |
ShellExecuteExW | 0x0 | 0x4010e0 | 0xcc20 | 0xc020 | 0x121 |
SHLWAPI.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
PathFindFileNameW | 0x0 | 0x4010e8 | 0xcc28 | 0xc028 | 0x49 |
PathRemoveFileSpecW | 0x0 | 0x4010ec | 0xcc2c | 0xc02c | 0x8b |
PathAddBackslashW | 0x0 | 0x4010f0 | 0xcc30 | 0xc030 | 0x30 |
ntdll.dll (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
_aulldiv | 0x0 | 0x4010f8 | 0xcc38 | 0xc038 | 0x4fe |
_alldiv | 0x0 | 0x4010fc | 0xcc3c | 0xc03c | 0x4f6 |
_allrem | 0x0 | 0x401100 | 0xcc40 | 0xc040 | 0x4fa |
_chkstk | 0x0 | 0x401104 | 0xcc44 | 0xc044 | 0x502 |
RtlUnwind | 0x0 | 0x401108 | 0xcc48 | 0xc048 | 0x396 |
NtQueryVirtualMemory | 0x0 | 0x40110c | 0xcc4c | 0xc04c | 0x135 |
Memory Dumps (2)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
svchost.exe | 1 | 0x00400000 | 0x0040EFFF | Content Changed | - | 32-bit | 0x004070A6, 0x00406C91, ... |
![]() |
![]() |
...
|
svchost.exe | 1 | 0x00400000 | 0x0040EFFF | Relevant Image | - | 32-bit | - |
![]() |
![]() |
...
|
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Generic.Ransom.GlobeImposter.0C1C66DE |
Malicious
|
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\js\base.js | Modified File | Text |
Malicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Severity | Actions |
---|---|---|---|---|
JS_Eval | JavaScript calls eval function; possible obfuscation | - |
Malicious
|
...
|
JS_Unicode_escaped_bytes | JavaScript contains many unicode-escaped bytes; possible obfuscation | - |
Suspicious
|
...
|
JS_charCodeAt | JavaScript references charCodeAt function; possible obfuscation | - |
Suspicious
|
...
|
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\js\ui.js | Modified File | Text |
Suspicious
|
...
|
»
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Severity | Actions |
---|---|---|---|---|
JS_charCodeAt | JavaScript references charCodeAt function; possible obfuscation | - |
Suspicious
|
...
|
C:\Windows10Upgrade\GetCurrentRollback.EXE | Modified File | Binary |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\default.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\default_eos.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_de-de.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_en-us.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_es-mx.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_fr-fr.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_hr-hr.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_hu-hu.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_it-it.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_nl-nl.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_pt-br.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_ru-ru.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_sl-si.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_sr-latn-cs.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_sv-se.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_zh-hk.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_zh-tw.htm | Modified File | Text |
Unknown
|
...
|
»
C:\Users\Public\Videos\desktop.ini | Modified File | Binary |
Unknown
|
...
|
»
C:\Windows10Upgrade\appraiserxp.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\bootsect.exe | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\Configuration.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\cosquery.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\DevInv.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\downloader.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\DW20.EXE | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\DWDCW20.DLL | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\DWTRIG20.EXE | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\EnableWiFiTracing.cmd | Modified File | Unknown |
Not Queried
|
...
|
»
C:\Windows10Upgrade\ESDHelper.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\esdstub.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\GatherOSState.EXE | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\GetCurrentDeploy.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\GetCurrentOOBE.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\HttpHelper.exe | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\PostOOBEScript.cmd | Modified File | Unknown |
Not Queried
|
...
|
»
C:\Windows10Upgrade\upgrader_default.log | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\upgrader_win10.log | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\wimgapi.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\windlp.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\Windows10UpgraderApp.exe | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\WinREBootApp32.exe | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\WinREBootApp64.exe | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\hwcompatShared.txt | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\block.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\bluelogo.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\bullet.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\default.css | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\default_eos.css | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\default_oobe.css | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\default_oobe.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\eula.css | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\GetStarted.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\GetStartedHoverOver.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\loading.gif | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\lock.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\logo.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\marketing.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\NetworkIssueFAQ.mht | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\NoNetworkConnection.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\NoNetworkConnectionHoverOver.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\pass.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\css\oobe-desktop.css | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\css\ui-dark.css | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_ar-sa.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_bg-bg.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_cs-cz.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_da-dk.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_el-gr.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_en-gb.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_es-es.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_et-ee.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_fi-fi.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_fr-ca.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_he-il.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_ja-jp.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_ko-kr.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_lt-lt.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_lv-lv.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_nb-no.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_pl-pl.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_pt-pt.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_ro-ro.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_sk-sk.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_th-th.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_tr-tr.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_uk-ua.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\ux\EULA\EULA_zh-cn.htm | Modified File | Text |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\i386\BiosBlocks.xml | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\i386\hwcompat.txt | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\i386\hwexclude.txt | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\i386\nxquery.cat | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\i386\nxquery.inf | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\i386\NXQuery.sys | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\amd64\BiosBlocks.xml | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\amd64\hwcompat.txt | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\amd64\hwexclude.txt | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\amd64\nxquery.cat | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\amd64\nxquery.inf | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\resources\amd64\NXQuery.sys | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\dll2\webservices.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\dll1\cosqueryxp.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\dll1\wdscore.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\dll1\webservices.dll | Modified File | Stream |
Not Queried
|
...
|
»
C:\Windows10Upgrade\2052\DWINTL20.DLL | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\Pictures\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\Music\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\Libraries\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\Libraries\RecordedTV.library-ms | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\Downloads\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\Documents\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\Desktop\Acrobat Reader DC.lnk | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\Desktop\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\Desktop\Google Chrome.lnk | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\Desktop\Mozilla Firefox.lnk | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\AccountPictures\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\2G4jHr_jKsfJA-R.mp4 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\7ZAQ_8-z.avi | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\n3vlmZ6-.avi | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\tO9pAo.avi | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\xmT13G_wqq.flv | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\Jl0C.swf | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\UHxSn8V6bAV.mp4 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\zjZrYYkb44qqQEFnHqom\46Y sA4xqn1mkiWfe4.mp4 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\zjZrYYkb44qqQEFnHqom\EAExctTFQPMl8WtaYS.mkv | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\zjZrYYkb44qqQEFnHqom\Pb9eQoao SP.flv | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\NcXnYr6x6woBEiON-rN\bh AN-eEd3pAd.mkv | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\NcXnYr6x6woBEiON-rN\sfAW.mp4 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\Bn1EL_rNfqQMckmEi\1ny84OLSFqFQ9.avi | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\Bn1EL_rNfqQMckmEi\2RV7ZqtkIQAy.swf | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\Bn1EL_rNfqQMckmEi\RbHKQb.mp4 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\Bn1EL_rNfqQMckmEi\Z5Ha.mkv | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\5ogEXtNZf0B\b4iPziHdJp0rZ.mkv | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\5ogEXtNZf0B\HrWnwNEc.mp4 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\5ogEXtNZf0B\jEPjuBAsOvP1O7SS4rI1.avi | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\5ogEXtNZf0B\N6mOHgddbvke6KjX.avi | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\5ogEXtNZf0B\tnr9kITOz2NeRQ_.swf | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\5ogEXtNZf0B\wvm_YPLQQnYUMnD1hGKw.flv | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\-kQaMk6N3RTKBidRVR6\g4fjfKB2.swf | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\-kQaMk6N3RTKBidRVR6\LB 3vCSyt.flv | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\-kQaMk6N3RTKBidRVR6\Pam-rO9WSYDB5Aau0.flv | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\-kQaMk6N3RTKBidRVR6\pH7Yo0Q.swf | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\-kQaMk6N3RTKBidRVR6\UTKSb4.swf | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Videos\JwYzrY1QYURz\-kQaMk6N3RTKBidRVR6\YI0OJ.avi | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Searches\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Searches\Everywhere.search-ms | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Searches\Indexed Locations.search-ms | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Searches\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Saved Games\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\-2zw.jpg | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\-b02kVqWvf.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\1gNasKYorpdQ71V5s.jpg | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\2WNpPaYQ7bCH6uHV-Wi.bmp | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\5Mc5tu.jpg | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\a-l cZ2WhL3Gi9EP91pv.bmp | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\AAfDEiE2PNHO9chgg.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\AEeie.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\atmBsJmJ.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\a_cHEoVLcdMdko0UNSN.jpg | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\DHNDov5.bmp | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\dW 4vWF3KS.jpg | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\EwKDZvQL.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\FFZTJM.gif | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\iPiG9DnbWOn5Lccr.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\ISwBI.gif | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\KHN blqiETx3MDUQXCIP.bmp | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\l-w8ML42eH7z3tMNH.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\lzcdU5diYS_BASUK.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\M1wZLHN6Fkt-r.gif | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\NdP2S1 XoxsMawE7P9M4.bmp | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\NwiXzxAjISOq6RX.jpg | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\nXyIT0GyxsFB.bmp | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\NyCuwZpUZ.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\NYUV.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\o0Nhv6wBAauXXRjT2tXD.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\ofGEte5FSqkNeh.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\PxAGmyezRVyRmSZAc0.jpg | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\siYWMQkbaR.jpg | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\T333.gif | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\Tcd9M dgrM7.jpg | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\xnkbNTgPvTY.bmp | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\XT8TZGP8nb_M.gif | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\YBTX2K.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\YU pTz2YsRXNYdiKDM.gif | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\yWGb9EM5K6eaJ.png | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\zj2VFMQGp.gif | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\ZXNoV6pTeigFzJ_.jpg | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\Saved Pictures\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Pictures\Camera Roll\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\OneDrive\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_zlm.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\desktop.ini | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\Faq2bp18.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\PvZb.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\Q4s2ptq2.m4a | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\WnzFd.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\f9Y8dx-\IXGTQQAcvQ.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\f9Y8dx-\kupntcSqN.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\f9Y8dx-\uulyokO0sZL4s.m4a | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\jqyCF3Kx006 jNKpA.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\LY325VqD.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\qckyy-4-m.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\NY7c7TBw5p\-eMcFt1lTpcIk.m4a | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\NY7c7TBw5p\HHZsqNo.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\NY7c7TBw5p\s1sEELv-P.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\NY7c7TBw5p\AYoFGbZ\KAwef_CpO2I6YOJ7bT.m4a | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\NY7c7TBw5p\AYoFGbZ\oUwDwHpc7yvxphvDrY.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\NY7c7TBw5p\AYoFGbZ\PXt_aUReRHQ_ubQ3.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\NY7c7TBw5p\AYoFGbZ\kHNjZV_y\GWdFXKk5.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\NY7c7TBw5p\AYoFGbZ\kHNjZV_y\iPKgYx-e.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\NY7c7TBw5p\AYoFGbZ\kHNjZV_y\ZipKeGLiNvFiFN_Dai.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\LM4F-Q9mEj1iog.m4a | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\qTZ_rt3NhfeWG-dwmp.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\XQ-rsbyj0qzm.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\vWya\60UrEB nNZ.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\vWya\8xod8JR wYWOtLbR.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\vWya\pHNh8pr9MG.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\CCM9emPBDlXJ1x\fi4GXHvoE.m4a | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\CCM9emPBDlXJ1x\lwbM.m4a | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\CCM9emPBDlXJ1x\npfoUNG.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\CCM9emPBDlXJ1x\oESa-56Lwow.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\CCM9emPBDlXJ1x\sRDmYrpUcB.wav | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\FD1HVy\Music\1_kDgtiBq1\ilgk0lJV\CCM9emPBDlXJ1x\uwpIml4ss_wW9q.mp3 | Modified File | Stream |
Not Queried
|
...
|
»
C:\Users\Public\987D0A577E52701B2BC411B375E79D954AE4355674A1B58EA37913B0886E2882 | Dropped File | Text |
Not Queried
|
...
|
»