Comnie dropper

Virtual Machine Information

Name	win10_64
Description	Windows 10 (64-bit), MS Office 2016 (64-bit)
Architecture	x86 64-bit
Operating System	Windows 10 Threshold 2
Kernel Version	10.0.10586.0 (0de6dc23-8e19-4bb7-8608-d54b1e6fa379)

System Information

Computer Name	X2VS1CUM
User Domain	X2VS1CUM
User Name	Nd9E1FYi
User Profile	C:\Users\Nd9E1FYi
Temp Directory	C:\Users\Nd9E1FYi\AppData\Local\Temp
System Root	C:\Windows
Sample Directory	C:\Users\Nd9E1FYi\Desktop

Software Information

Adobe Acrobat Reader Version	15.007.20033
Microsoft Office	2016
Microsoft Office Version	16.0.4266.1001
Internet Explorer Version	11.0.10586.0
Chrome Version	60.0.3112.113
Firefox Version	55.0.2
Flash Version	25.0.0.148
Java Version	8.0.1440.1

Randomly Created Artifacts

This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.

Processes (20)

Filename	PID	GUI
C:\Program Files (x86)\Common Files\coming-macintosh.exe	#3100
C:\Program Files (x86)\Google\object.exe	#4020
C:\Program Files (x86)\Internet Explorer\firewire-promotions.exe	#3800
C:\Program Files (x86)\MSBuild\collecting-nano.exe	#3692
C:\Program Files (x86)\Microsoft Analysis Services\parentstrialbk.exe	#3920
C:\Program Files (x86)\Mozilla Maintenance Service\avatar_into.exe	#2732
C:\Program Files (x86)\Mozilla Maintenance Service\fact.exe	#3840
C:\Program Files (x86)\Reference Assemblies\outcome.exe	#3860
C:\Program Files (x86)\Reference Assemblies\passannouncedcambridge.exe	#3680
C:\Program Files (x86)\Windows Mail\aka iso.exe	#3968
C:\Program Files (x86)\Windows Mail\beast install.exe	#3520
C:\Program Files (x86)\Windows NT\soviet.exe	#2352
C:\Program Files (x86)\Windows Portable Devices\tariffran.exe	#4000
C:\Program Files\Uninstall Information\seasons political lawsuit.exe	#3896
C:\Program Files\Windows Mail\respiratory.exe	#3912
C:\Program Files\Windows NT\nicechevy.exe	#3092
C:\Program Files\Windows NT\primarily-knowledge-univ.exe	#3880
C:\Program Files\Windows Portable Devices\platinumfilms.exe	#3940
C:\Program Files\Windows Portable Devices\weekends twins.exe	#2892
C:\Program Files\Windows Sidebar\wyoming_flows_extending.exe	#3820

Files (308)

Filename
C:\Users\Nd9E1FYi\AppData\Local\Temp\-8ue5lwIlIVdr.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\0Sf oS.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\2s-d58Be7AFwnK.gif
C:\Users\Nd9E1FYi\AppData\Local\Temp\59LwOvpge2VRa.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\Cog-RW34zqGCk.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\CxhKCdiGGLgSwXmCL.odp
C:\Users\Nd9E1FYi\AppData\Local\Temp\Fe-M.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\GO9E H.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\QEzLG8f_RBvwE.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\Yo7QeFMH0lodNY7UNqv.ots
C:\Users\Nd9E1FYi\AppData\Local\Temp\ZS4Sh3.jpg
C:\Users\Nd9E1FYi\AppData\Local\Temp\Zj4eVmqY37j.bmp
C:\Users\Nd9E1FYi\AppData\Local\Temp\_VxqJTex4xLMB--.rtf
C:\Users\Nd9E1FYi\AppData\Local\Temp\_lle.gif
C:\Users\Nd9E1FYi\AppData\Local\Temp\aL7Cau JluQY1P_KNY.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\aso-09bk3rtTeuQ5Wt.png
C:\Users\Nd9E1FYi\AppData\Local\Temp\dnyQgNgWK4BpWu_.xls
C:\Users\Nd9E1FYi\AppData\Local\Temp\gF99H1MFljFqOT2kW7.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\hkTAkr3.pdf
C:\Users\Nd9E1FYi\AppData\Local\Temp\jttUlVkgpC-SywUkJ.m4a
C:\Users\Nd9E1FYi\AppData\Local\Temp\lUATxx.doc
C:\Users\Nd9E1FYi\AppData\Local\Temp\mtz09.png
C:\Users\Nd9E1FYi\AppData\Local\Temp\oj9M.wav
C:\Users\Nd9E1FYi\AppData\Local\Temp\qzL NFGl3FOBAcHjV.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\s5G84pjv4Sv2Lzn0jGb.mp4
C:\Users\Nd9E1FYi\AppData\Local\Temp\se3w7Ofp7y46kiri.ots
C:\Users\Nd9E1FYi\AppData\Local\Temp\wGvdeAMkSkf.odt
C:\Users\Nd9E1FYi\AppData\Local\Temp\wv_Q6DNozNRg9oUz59.swf
C:\Users\Nd9E1FYi\AppData\Local\Temp\zWpVDFRYW.flv
C:\Users\Nd9E1FYi\AppData\Local\Temp\ziQpgwKaV.ots
C:\Users\Nd9E1FYi\AppData\Roaming\0Ez1Exdl_Uqqpui.flv
C:\Users\Nd9E1FYi\AppData\Roaming\0PzFZCC.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\1PsbJVkYWxJ9xIOFI.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\1rT9jOc.swf
C:\Users\Nd9E1FYi\AppData\Roaming\6YxLTmbomdWDV3de.pptx
C:\Users\Nd9E1FYi\AppData\Roaming\7yag7Vw6to58BQtQzmeV.jpg
C:\Users\Nd9E1FYi\AppData\Roaming\8IiHmIGQu 9Au.flv
C:\Users\Nd9E1FYi\AppData\Roaming\B2xpizhVUeBrOQP.wav
C:\Users\Nd9E1FYi\AppData\Roaming\FVKCj.wav
C:\Users\Nd9E1FYi\AppData\Roaming\GeGMnWBgmx3u66jVebGD.wav
C:\Users\Nd9E1FYi\AppData\Roaming\GjI2P59Uxb5u a.gif
C:\Users\Nd9E1FYi\AppData\Roaming\Hv4V9E3LinQ7XDU k.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\IXMNS_JaoZ.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\IyuDP8wTl4tdQ.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\JfwPY2KUll7SGb0e.ots
C:\Users\Nd9E1FYi\AppData\Roaming\L5AZ9H3N4.swf
C:\Users\Nd9E1FYi\AppData\Roaming\NJcvkse2YLCi5SO.ots
C:\Users\Nd9E1FYi\AppData\Roaming\P2f8Waed3.docx
C:\Users\Nd9E1FYi\AppData\Roaming\UIoyyixoCCNfInd210X.jpg
C:\Users\Nd9E1FYi\AppData\Roaming\Un9 ESoh1SHxB83EI9.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\YSwaW.xlsx
C:\Users\Nd9E1FYi\AppData\Roaming\YsJ.wav
C:\Users\Nd9E1FYi\AppData\Roaming\auoeUHPk7EbUToyR.bmp
C:\Users\Nd9E1FYi\AppData\Roaming\bR7BTf5ZUKa7kDokrMs.mkv
C:\Users\Nd9E1FYi\AppData\Roaming\bYCH7lZD3v.avi
C:\Users\Nd9E1FYi\AppData\Roaming\eoP JpBb.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\g HZEwil9ZCkB.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\gAh 1RteNx- M.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\gHzkLITx.avi
C:\Users\Nd9E1FYi\AppData\Roaming\glTdf2.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\gzQZ8X2.pdf
C:\Users\Nd9E1FYi\AppData\Roaming\jyO85xNjIWhPzN3XLEWX.pdf
C:\Users\Nd9E1FYi\AppData\Roaming\ryBtr_ImzJ-YH.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\tDbDdQIU.png
C:\Users\Nd9E1FYi\AppData\Roaming\tGO1g9a9iJqPbCX623Z.m4a
C:\Users\Nd9E1FYi\AppData\Roaming\y26 ETKlKdw6lpfVFKw.swf
C:\Users\Nd9E1FYi\AppData\Roaming\zDam7i8-.mp3
C:\Users\Nd9E1FYi\AppData\Roaming\zDeednOSIL.png
C:\Users\Nd9E1FYi\AppData\Roaming\zREI.pptx
C:\Users\Nd9E1FYi\Desktop\-9Trf.swf
C:\Users\Nd9E1FYi\Desktop\-OYX9EEQECN61L1yQ_gW.gif
C:\Users\Nd9E1FYi\Desktop\0nnsU6 3x.png
C:\Users\Nd9E1FYi\Desktop\2XyJ1n26wW.wav
C:\Users\Nd9E1FYi\Desktop\3WjcvS0eF3.doc
C:\Users\Nd9E1FYi\Desktop\6_LyGgNWJML5v2AEJ.png
C:\Users\Nd9E1FYi\Desktop\B-XOybPIj61amekbe3.flv
C:\Users\Nd9E1FYi\Desktop\DvFo5H d89.mkv
C:\Users\Nd9E1FYi\Desktop\E6nZIZA3WamUfQrFUL.gif
C:\Users\Nd9E1FYi\Desktop\F4rCHcMtVZrfr2v5T8.jpg
C:\Users\Nd9E1FYi\Desktop\FJ2E932Csl 3dAqI.mp4
C:\Users\Nd9E1FYi\Desktop\NR 8.mkv
C:\Users\Nd9E1FYi\Desktop\OVp1qTXx.swf
C:\Users\Nd9E1FYi\Desktop\UUBCzlq40tkH.png
C:\Users\Nd9E1FYi\Desktop\UV5947dYSr qot.wav
C:\Users\Nd9E1FYi\Desktop\Y4meTi4hCXo.png
C:\Users\Nd9E1FYi\Desktop\YF29-KJbSCujkqsZAW.swf
C:\Users\Nd9E1FYi\Desktop\YZpmARfkMqrB.flv
C:\Users\Nd9E1FYi\Desktop\ZYAwreiSBmoB3.m4a
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\6rUHj6tCh.m4a
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\72A4BmkLK9E3Heyb8.png
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\CWgK.mkv
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\HmVveniF.pptx
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\Mp-8N5x68OKnFvCt.jpg
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\b05fSzf.avi
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\bUJ0KF2tCfb4.gif
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\dV4QA0rRqFciDA.jpg
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\eBVbwf.wav
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\jw-z1etq3vB.ots
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\k_jvpvCHGUb.wav
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\sGztOGZPeR-GT.png
C:\Users\Nd9E1FYi\Desktop\ZfV8RGgyIVAP9I2AIO\z2D3.jpg
C:\Users\Nd9E1FYi\Desktop\ZuQl3WrM7.mkv
C:\Users\Nd9E1FYi\Desktop\_jezKEm.mp3
C:\Users\Nd9E1FYi\Desktop\dhL6Fu-g.mp3
C:\Users\Nd9E1FYi\Desktop\fhwL5vFV76L.mp4
C:\Users\Nd9E1FYi\Desktop\jM106hnpo0Mp1.png
C:\Users\Nd9E1FYi\Desktop\l1zghqcaxoTfetjemk.wav
C:\Users\Nd9E1FYi\Desktop\mMtBJeIL7x.ppt
C:\Users\Nd9E1FYi\Desktop\n58o0SLdjiJrq_.jpg
C:\Users\Nd9E1FYi\Desktop\rlavyAN6BKLDxr.gif
C:\Users\Nd9E1FYi\Desktop\vGYXq7_nn2Xdyc.pdf
C:\Users\Nd9E1FYi\Desktop\wr25.m4a
C:\Users\Nd9E1FYi\Desktop\x4sfgnh6.avi
C:\Users\Nd9E1FYi\Desktop\z4JD0cF.jpg
C:\Users\Nd9E1FYi\Desktop\zSxORLyxk2WPTyHJ.wav
C:\Users\Nd9E1FYi\Documents\-w4Z.pptx
C:\Users\Nd9E1FYi\Documents\0jasXOqUwZJ.docx
C:\Users\Nd9E1FYi\Documents\1xVvP8J5QD58Br.pptx
C:\Users\Nd9E1FYi\Documents\3yTs1g3y1b3T82jbZ.docx
C:\Users\Nd9E1FYi\Documents\44kQq.xlsx
C:\Users\Nd9E1FYi\Documents\5SEl7yNJfNf 7.xlsx
C:\Users\Nd9E1FYi\Documents\5Vp2zNMQw.docx
C:\Users\Nd9E1FYi\Documents\7LpdMtkosdHoWkd.pptx
C:\Users\Nd9E1FYi\Documents\7PwL.pptx
C:\Users\Nd9E1FYi\Documents\7gAX BXMTy_on P.xlsx
C:\Users\Nd9E1FYi\Documents\8EleCa0h.pptx
C:\Users\Nd9E1FYi\Documents\8JWky26g.pptx
C:\Users\Nd9E1FYi\Documents\8ze3BvalytNgJ0.doc
C:\Users\Nd9E1FYi\Documents\Auv9TkhK4AVcEM1snR6.xlsx
C:\Users\Nd9E1FYi\Documents\BMYvd7i.docx
C:\Users\Nd9E1FYi\Documents\Bx2dghVSc15JQ.pptx
C:\Users\Nd9E1FYi\Documents\Byce0.ots
C:\Users\Nd9E1FYi\Documents\C8cawMZIhls6wnpfX7.xlsx
C:\Users\Nd9E1FYi\Documents\DT9y-MMc7v7TSzc7.xls
C:\Users\Nd9E1FYi\Documents\ErxL_Fctc.pptx
C:\Users\Nd9E1FYi\Documents\ExP5d.docx
C:\Users\Nd9E1FYi\Documents\F1 9mS42.xlsx
C:\Users\Nd9E1FYi\Documents\F8JI33ipP6.xlsx
C:\Users\Nd9E1FYi\Documents\FS1i-2xsN.xlsx
C:\Users\Nd9E1FYi\Documents\FV2C8uSQJnEC82 KB.xlsx
C:\Users\Nd9E1FYi\Documents\GnpUk.pptx
C:\Users\Nd9E1FYi\Documents\I5KYDRFKLmRe.docx
C:\Users\Nd9E1FYi\Documents\IyFSxGm63ipj8Fi.docx
C:\Users\Nd9E1FYi\Documents\K16 iK_pnuIi2Y.docx
C:\Users\Nd9E1FYi\Documents\NqmH-s4P.pptx
C:\Users\Nd9E1FYi\Documents\NwEgm fkgFylD3AmQj--.xlsx
C:\Users\Nd9E1FYi\Documents\OGy4o1.xlsx
C:\Users\Nd9E1FYi\Documents\PM2dnrAW XSnb59p.pptx
C:\Users\Nd9E1FYi\Documents\S-Ew.docx
C:\Users\Nd9E1FYi\Documents\TBKBM6xdJVb3EfdCQC.docx
C:\Users\Nd9E1FYi\Documents\UOfFU40gTf6N9bJP.xlsx
C:\Users\Nd9E1FYi\Documents\VlmSD.xlsx
C:\Users\Nd9E1FYi\Documents\YF7U-RLlv_S-sJHB0.pptx
C:\Users\Nd9E1FYi\Documents\YZmissvlme--GI.ods
C:\Users\Nd9E1FYi\Documents\YtODKee6X7FObc.pdf
C:\Users\Nd9E1FYi\Documents\bQpCsm9XED akG.docx
C:\Users\Nd9E1FYi\Documents\bpQ_iePFAsJw.pptx
C:\Users\Nd9E1FYi\Documents\cDeaa0w.docx
C:\Users\Nd9E1FYi\Documents\cPMmF.docx
C:\Users\Nd9E1FYi\Documents\eamZqrO2R1DQ.pptx
C:\Users\Nd9E1FYi\Documents\gQFzMLqSn59ww7it2lYz.pptx
C:\Users\Nd9E1FYi\Documents\hAFLGvRvH7.docx
C:\Users\Nd9E1FYi\Documents\hAh ZaAd64laSsE.pptx
C:\Users\Nd9E1FYi\Documents\hEfGd_.docx
C:\Users\Nd9E1FYi\Documents\hay272u52KVmziq.xlsx
C:\Users\Nd9E1FYi\Documents\iQZWtnEmp60cCuHkvip.pptx
C:\Users\Nd9E1FYi\Documents\iuI_7E.docx
C:\Users\Nd9E1FYi\Documents\jXLz4BcRLq1WA.xlsx
C:\Users\Nd9E1FYi\Documents\jbMuEIJRUe.docx
C:\Users\Nd9E1FYi\Documents\l4g4BpknN_RZ5eTgTZrV.xlsx
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\2zEQXHuWB18v-.pdf
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\3JiAXE-Dvg9u4wthKp1.odp
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\4_hu.csv
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\5d5Wt0rB.docx
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\BxPFetzC90cfA.pps
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\FbDbpIpR_FrukJKVHB.doc
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\FnlUsEaMGxDGuOh.ots
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\QOPzrF-O.ots
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\WwndQdhCd5EDQtS.pdf
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\ZgJEvDc8GkxO_bIa.ods
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\a35Vhov3AU scg0Gd4.odp
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\akk0fiybc.xlsx
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\eYl-8DG.xlsx
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\mBx6uPx7SB0eVq8ZE3O.csv
C:\Users\Nd9E1FYi\Documents\lJaUntuyJf-w\wOIu9pf8.xlsx
C:\Users\Nd9E1FYi\Documents\mXPe7LYwuV9k-.odt
C:\Users\Nd9E1FYi\Documents\mf3xZjmJ27kK7R3PU.pdf
C:\Users\Nd9E1FYi\Documents\mkm7NUkVx3Pm6ey.doc
C:\Users\Nd9E1FYi\Documents\nn-IByv.pptx
C:\Users\Nd9E1FYi\Documents\oIII3s6-o3wx-lYprR8.xlsx
C:\Users\Nd9E1FYi\Documents\oIzGCEZnPe-a.pptx
C:\Users\Nd9E1FYi\Documents\oVos_5ivVjnJb.xlsx
C:\Users\Nd9E1FYi\Documents\pNnGlg0JGp7ittSAi FW.csv
C:\Users\Nd9E1FYi\Documents\pzYcRljzhGaVd.docx
C:\Users\Nd9E1FYi\Documents\rOKrZwVBYUxm9DMUa.pptx
C:\Users\Nd9E1FYi\Documents\rwNyJ1z c-E.docx
C:\Users\Nd9E1FYi\Documents\sK zJHIeJAR.pptx
C:\Users\Nd9E1FYi\Documents\v32sY7rMc.xlsx
C:\Users\Nd9E1FYi\Documents\wGVa.xlsx
C:\Users\Nd9E1FYi\Documents\wLDWdZSYmzRQ6Zzoq.pptx
C:\Users\Nd9E1FYi\Documents\xJwClQ7_bmGagM6rZ84s.docx
C:\Users\Nd9E1FYi\Documents\xrXT-v7yaice5H2T.pptx
C:\Users\Nd9E1FYi\Music\BnGUzS ja.m4a
C:\Users\Nd9E1FYi\Music\C_bQN2zVMN0mQ.wav
C:\Users\Nd9E1FYi\Music\Ge_YfxFBPHmlr.mp3
C:\Users\Nd9E1FYi\Music\HUJYV4bpvjfW_CS6Y7qM.wav
C:\Users\Nd9E1FYi\Music\Hwll8oc.mp3
C:\Users\Nd9E1FYi\Music\IPaRcXitJ3.wav
C:\Users\Nd9E1FYi\Music\VFb46v3OjJywtgg.m4a
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\Msg9Nf45z.wav
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\Q7vYpJMqhuL.mp3
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\XdzDP8q25Vz CZLm.wav
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\Xg3hy1auA VtJ.m4a
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\bO 5.m4a
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\jfian_u9 qPSU.m4a
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\jysR.wav
C:\Users\Nd9E1FYi\Music\ZLgwWSjLHzh2S\uvAqtWa_xDxz4W.mp3
C:\Users\Nd9E1FYi\Music\hbpy.wav
C:\Users\Nd9E1FYi\Music\iRp3XvDwnMzhq7Tph.m4a
C:\Users\Nd9E1FYi\Music\pG60.m4a
C:\Users\Nd9E1FYi\Music\xCs0cAQI.wav
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\67DBSEJ4BMZoo.m4a
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\9hx4KltHzwaV96eWM7m.m4a
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\J3xY.mp3
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\JbyIDPua.m4a
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\Riiyc.wav
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\ed9xd5h-2gIGAMMRx.m4a
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\fO0jUWY20lwF4-tkPpDy.wav
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\kc1rJ3AmL0bAH2.m4a
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\oU0oJhKYwfkG.mp3
C:\Users\Nd9E1FYi\Music\y8oEot1 VHEKfcmbAu\skofRHUf9.wav
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\G_VX1o.png
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\ahss.jpg
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\g4rNKN5n8p.jpg
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\lOBaZ7mU2Cce7Pt 6UPd.bmp
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\sijWeDuP.jpg
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\xr3EZlrsZI83yt_kWu2.png
C:\Users\Nd9E1FYi\Pictures\B LCCsMcT\yuu nzR1J5HR.gif
C:\Users\Nd9E1FYi\Pictures\R pocsiOj-Noc_UJ
C:\Users\Nd9E1FYi\Pictures\R pocsiOj-Noc_UJ\B1J4ZvBs7Wnw.bmp
C:\Users\Nd9E1FYi\Pictures\R pocsiOj-Noc_UJ\VpvEpX7uKz2G.gif
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\5HCHzFiu.bmp
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\BpgiceQ9WSR-wV.bmp
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\CYB3ALTRf kkHXAUjv.jpg
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx\80XWeeA-OkvHp6t0DdgT.gif
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx\CZ3ODbncGDB.jpg
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx\RC7q6ya8K2F.bmp
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx\bRdboP8JZofbuP1oQ.gif
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\MerKbvVkOx\xbEDb3t2WV1m rm.jpg
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\N3bKwo IiWo.bmp
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\QUfOoQudq5ii_wCW3.gif
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\TIpbZsRVl1tyKIlDnofS.bmp
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\fsLYBH3B.jpg
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\h2CjEax2s R4.gif
C:\Users\Nd9E1FYi\Pictures\gD2xGmoUJ\wsbNjomrrUiKMLM2.jpg
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn\O7IW Th4-RysY0CoQ.jpg
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn\UlB6szohpLtW0I.jpg
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn\r2q91y63Ga3lOrxq4.jpg
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn\vcmpruQhTyQ.gif
C:\Users\Nd9E1FYi\Pictures\k20apc3n0hdn\xBiYGqKPS7CGTRAfT.bmp
C:\Users\Nd9E1FYi\Pictures\v0c0LRwMUG.png
C:\Users\Nd9E1FYi\Videos\5E4po1Toia47cL.avi
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H\-zXXD.swf
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H\W1SqyZC79Zk0cdIYEsL.avi
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H\dl1wIih1Fb.avi
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H\lc6YKaTk.mp4
C:\Users\Nd9E1FYi\Videos\7zdy5QD3hQ72rU1H\piNaQi.mp4
C:\Users\Nd9E1FYi\Videos\CbpZhe6J.avi
C:\Users\Nd9E1FYi\Videos\_kIfbJ Ajj5JPTOsZS.mp4
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\89E5Wqz.swf
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\C1UnGMo1MAV6S GGH P.mp4
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\OeA4fzH8q8e.flv
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\Z4b0MlWeheQcknS.mp4
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\mrWuVDH8p.mkv
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\vuynfRjXmLvWSF54.avi
C:\Users\Nd9E1FYi\Videos\go6rLQQDF5CqbL1D\wlkRiMxe.flv
C:\Users\Nd9E1FYi\Videos\i2M-KX.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\4z rRuj6jH3RlDbDeHiC.flv
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\7xUhVhF1E9l_.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\894rkdBTDbCdD n.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\BCpV3I5plzD64fPa5S.swf
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\FomvQAmQ01NetI-.mkv
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\PfBs A.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\UORmAJ4MrpoHL_P.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\_qyy_L5cd4eBwclSvVO.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\d1kmtw_-4m8GXeCZU1E2.mkv
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\fHxT4TCOfw5y _zpcC.flv
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\jDJq2x.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\o-9E0ZdKYO2a.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\ryA59W2_kDpU3gWzH1U.avi
C:\Users\Nd9E1FYi\Videos\iPX9u_vug-87iaY1xDYQ\wtr4vSqW9H3G.swf
C:\Users\Nd9E1FYi\Videos\kN3yN_HbUU.flv
C:\Users\Nd9E1FYi\Videos\oThtl_W_1BO-Foou
C:\Users\Nd9E1FYi\Videos\oThtl_W_1BO-Foou\152 T56dJsjX30Bev.flv
C:\Users\Nd9E1FYi\Videos\oThtl_W_1BO-Foou\CVIliyOoXGUc-BWT8Olv.swf
C:\Users\Nd9E1FYi\Videos\oThtl_W_1BO-Foou\xd3 C6qv.flv
C:\Users\Nd9E1FYi\Videos\pmjIPvL38n_s bVO.swf

Virtual Machine Information

System Information

Software Information

Randomly Created Artifacts

Before

After