d0cde86d...45b9 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Riskware, Wiper, Trojan, Ransomware

d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9 (SHA256)

tcpsov.exe

Windows Exe (x86-32)

Created at 2019-02-10 19:09:00

...

Notifications (2/2)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "5 minutes" to "10 seconds" to reveal dormant functionality.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xe88 Analysis Target High (Elevated) tcpsov.exe "C:\Users\CIiHmnxMn6Ps\Desktop\tcpsov.exe" -

Behavior Information - Grouped by Category

Process #1: tcpsov.exe
782 0
»
Information Value
ID #1
File Name c:\users\ciihmnxmn6ps\desktop\tcpsov.exe
Command Line "C:\Users\CIiHmnxMn6Ps\Desktop\tcpsov.exe"
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:42, Reason: Analysis Target
Unmonitor End Time: 00:04:52, Reason: Terminated by Timeout
Monitor Duration 00:04:10
OS Process Information
»
Information Value
PID 0xe88
Parent PID 0x57c (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x E8C
0x E90
0x F7C
0x F84
0x C38
0x C7C
0x C88
0x C84
0x C80
0x C78
0x CAC
0x CB4
0x CBC
0x CB8
0x CB0
0x CA8
0x CA0
0x C9C
0x C90
0x CA4
0x C8C
0x 36C
0x 7A0
0x 68C
0x 150
0x 340
0x 270
0x C28
0x D0
0x A44
0x 98C
0x C20
0x 618
0x 75C
0x 7FC
0x AF4
0x F0
0x 200
0x 278
0x 128
0x A60
0x 4B8
0x 554
0x 888
0x A84
0x 2BC
0x B24
0x 2F4
0x 61C
0x 1A4
0x 838
0x AD8
0x C14
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
private_0x0000000000020000 0x00020000 0x00023fff Private Memory rw True False False -
private_0x0000000000030000 0x00030000 0x00030fff Private Memory rw True False False -
pagefile_0x0000000000040000 0x00040000 0x00053fff Pagefile Backed Memory r True False False -
private_0x0000000000060000 0x00060000 0x0009ffff Private Memory rw True False False -
private_0x00000000000a0000 0x000a0000 0x0019ffff Private Memory rw True False False -
pagefile_0x00000000001a0000 0x001a0000 0x001a3fff Pagefile Backed Memory r True False False -
private_0x00000000001b0000 0x001b0000 0x001b1fff Private Memory rw True False False -
private_0x00000000001c0000 0x001c0000 0x001fffff Private Memory rw True False False -
private_0x0000000000200000 0x00200000 0x00200fff Private Memory rw True False False -
private_0x0000000000210000 0x00210000 0x0030ffff Private Memory rw True False False -
private_0x0000000000310000 0x00310000 0x00310fff Private Memory rwx True False False -
private_0x0000000000320000 0x00320000 0x00334fff Private Memory rw True False False -
private_0x0000000000320000 0x00320000 0x0032ffff Private Memory rw True False False -
private_0x0000000000320000 0x00320000 0x00335fff Private Memory rw True False False -
pagefile_0x0000000000320000 0x00320000 0x00327fff Pagefile Backed Memory rw True False False -
mpr.dll.mui 0x00320000 0x00320fff Memory Mapped File r False False False -
pagefile_0x0000000000330000 0x00330000 0x00330fff Pagefile Backed Memory rw True False False -
private_0x0000000000340000 0x00340000 0x00359fff Private Memory rw True False False -
pagefile_0x0000000000360000 0x00360000 0x00367fff Pagefile Backed Memory rw True False False -
private_0x0000000000360000 0x00360000 0x00360fff Private Memory rw True False False -
private_0x0000000000360000 0x00360000 0x00363fff Private Memory rw True False False -
private_0x0000000000370000 0x00370000 0x0037ffff Private Memory rw True False False -
private_0x0000000000380000 0x00380000 0x003bffff Private Memory rw True False False -
private_0x00000000003c0000 0x003c0000 0x003fffff Private Memory rw True False False -
private_0x00000000003c0000 0x003c0000 0x003c0fff Private Memory rw True False False -
private_0x00000000003d0000 0x003d0000 0x003d0fff Private Memory rw True False False -
tcpsov.exe 0x00400000 0x0043cfff Memory Mapped File rwx True True False
...
locale.nls 0x00440000 0x004fdfff Memory Mapped File r False False False -
private_0x0000000000500000 0x00500000 0x005fffff Private Memory rw True False False -
private_0x0000000000600000 0x00600000 0x0069ffff Private Memory rw True False False -
private_0x0000000000600000 0x00600000 0x00600fff Private Memory rw True False False -
crypt32.dll.mui 0x00610000 0x00619fff Memory Mapped File r False False False -
private_0x0000000000620000 0x00620000 0x00620fff Private Memory rw True False False -
private_0x0000000000690000 0x00690000 0x0069ffff Private Memory rw True False False -
private_0x00000000006e0000 0x006e0000 0x006effff Private Memory rw True False False -
pagefile_0x00000000006f0000 0x006f0000 0x00877fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000880000 0x00880000 0x00a00fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000a10000 0x00a10000 0x01e0ffff Pagefile Backed Memory r True False False -
private_0x0000000001e10000 0x01e10000 0x01f0ffff Private Memory rw True False False -
private_0x0000000001f70000 0x01f70000 0x01f7ffff Private Memory rw True False False -
sortdefault.nls 0x01f80000 0x022b6fff Memory Mapped File r False False False -
private_0x00000000022c0000 0x022c0000 0x023bffff Private Memory rw True False False -
private_0x00000000023c0000 0x023c0000 0x024bffff Private Memory rw True False False -
kernelbase.dll.mui 0x023c0000 0x0249efff Memory Mapped File r False False False -
private_0x00000000024a0000 0x024a0000 0x0259ffff Private Memory rw True False False -
wow64cpu.dll 0x5baa0000 0x5baa7fff Memory Mapped File rwx False False False -
wow64win.dll 0x5bab0000 0x5bb22fff Memory Mapped File rwx False False False -
wow64.dll 0x5bb30000 0x5bb7efff Memory Mapped File rwx False False False -
dpapi.dll 0x743c0000 0x743c7fff Memory Mapped File rwx False False False -
userenv.dll 0x743d0000 0x743e8fff Memory Mapped File rwx False False False -
rsaenh.dll 0x743f0000 0x7441efff Memory Mapped File rwx False False False -
cryptsp.dll 0x74420000 0x74432fff Memory Mapped File rwx False False False -
browcli.dll 0x74440000 0x7444efff Memory Mapped File rwx False False False -
netutils.dll 0x74450000 0x74459fff Memory Mapped File rwx False False False -
cscapi.dll 0x74460000 0x7446efff Memory Mapped File rwx False False False -
bcrypt.dll 0x74470000 0x7448afff Memory Mapped File rwx False False False -
wkscli.dll 0x74490000 0x7449ffff Memory Mapped File rwx False False False -
davhlpr.dll 0x744a0000 0x744aafff Memory Mapped File rwx False False False -
davclnt.dll 0x744b0000 0x744c9fff Memory Mapped File rwx False False False -
ntlanman.dll 0x744d0000 0x744e1fff Memory Mapped File rwx False False False -
winsta.dll 0x744f0000 0x74533fff Memory Mapped File rwx False False False -
drprov.dll 0x74540000 0x74548fff Memory Mapped File rwx False False False -
mpr.dll 0x74550000 0x74566fff Memory Mapped File rwx False False False -
comctl32.dll 0x74570000 0x74601fff Memory Mapped File rwx False False False -
apphelp.dll 0x746b0000 0x74740fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74750000 0x747a8fff Memory Mapped File rwx False False False -
cryptbase.dll 0x747b0000 0x747b9fff Memory Mapped File rwx False False False -
sspicli.dll 0x747c0000 0x747ddfff Memory Mapped File rwx False False False -
crypt32.dll 0x74880000 0x749f4fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x74a00000 0x74aabfff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x74ab0000 0x74abbfff Memory Mapped File rwx False False False -
shlwapi.dll 0x74da0000 0x74de3fff Memory Mapped File rwx False False False -
msctf.dll 0x74df0000 0x74f0ffff Memory Mapped File rwx False False False -
imm32.dll 0x74f10000 0x74f3afff Memory Mapped File rwx False False False -
kernel32.dll 0x74f40000 0x7502ffff Memory Mapped File rwx False False False -
gdi32.dll 0x75030000 0x7517cfff Memory Mapped File rwx False False False -
profapi.dll 0x75180000 0x7518efff Memory Mapped File rwx False False False -
kernelbase.dll 0x75190000 0x75305fff Memory Mapped File rwx False False False -
shell32.dll 0x75310000 0x766cefff Memory Mapped File rwx False False False -
windows.storage.dll 0x76790000 0x76c6cfff Memory Mapped File rwx False False False -
user32.dll 0x76c70000 0x76daffff Memory Mapped File rwx False False False -
msvcrt.dll 0x76f20000 0x76fddfff Memory Mapped File rwx False False False -
msasn1.dll 0x77070000 0x7707dfff Memory Mapped File rwx False False False -
powrprof.dll 0x77260000 0x772a3fff Memory Mapped File rwx False False False -
sechost.dll 0x772b0000 0x772f2fff Memory Mapped File rwx False False False -
shcore.dll 0x77300000 0x7738cfff Memory Mapped File rwx False False False -
combase.dll 0x77390000 0x77549fff Memory Mapped File rwx False False False -
advapi32.dll 0x77550000 0x775cafff Memory Mapped File rwx False False False -
ntdll.dll 0x776b0000 0x77828fff Memory Mapped File rwx False False False -
private_0x000000007fead000 0x7fead000 0x7feaffff Private Memory rw True False False -
pagefile_0x000000007feb0000 0x7feb0000 0x7ffaffff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd5000 0x7ffd5000 0x7ffd7fff Private Memory rw True False False -
private_0x000000007ffd8000 0x7ffd8000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdb000 0x7ffdb000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7ffc57b4ffff Private Memory r True False False -
ntdll.dll 0x7ffc57b50000 0x7ffc57d11fff Memory Mapped File rwx False False False -
private_0x00007ffc57d12000 0x7ffc57d12000 0x7ffffffeffff Private Memory r True False False -
Hook Information
»
Type Installer Target Size Information Actions
IAT private_0x0000000000310000:+0x483 3. entry of tcpsov.exe 4 bytes advapi32.dll:RegOpenKeyExA+0x0 now points to private_0x000000007fff0000:+0x72c4f202
...
IAT private_0x0000000000310000:+0x483 10. entry of tcpsov.exe 4 bytes kernel32.dll:FindClose+0x0 now points to private_0x0000000000210000:+0x4e5e8
...
IAT private_0x0000000000310000:+0x483 11. entry of tcpsov.exe 4 bytes kernel32.dll:HeapDestroy+0x0 now points to private_0x000000007fff0000:+0x68f18b00
...
IAT private_0x0000000000310000:+0x483 17. entry of tcpsov.exe 4 bytes kernel32.dll:CloseHandle+0x0 now points to private_0x000000007fff0000:+0x68e3db6c
...
IAT private_0x0000000000310000:+0x483 23. entry of tcpsov.exe 4 bytes kernel32.dll:VirtualAlloc+0x0 now points to private_0x00000000001c0000:+0x2abe8
...
IAT private_0x0000000000310000:+0x483 24. entry of tcpsov.exe 4 bytes kernel32.dll:GetCommandLineA+0x0 now points to private_0x000000007fff0000:+0x55a5900
...
IAT private_0x0000000000310000:+0x483 25. entry of tcpsov.exe 4 bytes kernel32.dll:TerminateProcess+0x0 now points to private_0x000000007fff0000:+0x684b75c0
...
IAT private_0x0000000000310000:+0x483 27. entry of tcpsov.exe 4 bytes kernel32.dll:GetStartupInfoA+0x0 now points to private_0x0000000000060000:+0x5fe8
...
IAT private_0x0000000000310000:+0x483 30. entry of tcpsov.exe 4 bytes kernel32.dll:SetUnhandledExceptionFilter+0x0 now points to private_0x000000007fff0000:+0xae90040
...
IAT private_0x0000000000310000:+0x483 32. entry of tcpsov.exe 4 bytes kernel32.dll:GetStdHandle+0x0 now points to private_0x0000000000060000:+0x21e8
...
IAT private_0x0000000000310000:+0x483 34. entry of tcpsov.exe 4 bytes kernel32.dll:FreeEnvironmentStringsA+0x0 now points to private_0x000000007fff0000:+0x76e90000
...
IAT private_0x0000000000310000:+0x483 35. entry of tcpsov.exe 4 bytes kernel32.dll:GetEnvironmentStrings+0x0 now points to private_0x000000007fff0000:+0x68010005
...
IAT private_0x0000000000310000:+0x483 38. entry of tcpsov.exe 4 bytes kernel32.dll:GetEnvironmentStringsW+0x0 now points to private_0x000000007fff0000:+0x685a0000
...
IAT private_0x0000000000310000:+0x483 43. entry of tcpsov.exe 4 bytes kernel32.dll:TlsGetValue+0x0 now points to private_0x000000007fff0000:+0x40340000
...
IAT private_0x0000000000310000:+0x483 44. entry of tcpsov.exe 4 bytes kernel32.dll:TlsAlloc+0x0 now points to private_0x000000007fff0000:+0x68086ac3
...
IAT private_0x0000000000310000:+0x483 47. entry of tcpsov.exe 4 bytes kernel32.dll:InterlockedIncrement+0x0 now points to private_0x000000007fff0000:+0x40340000
...
IAT private_0x0000000000310000:+0x483 49. entry of tcpsov.exe 4 bytes kernel32.dll:GetCurrentThreadId+0x0 now points to private_0x000000007fff0000:+0x2be90000
...
Created Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ObwlO7BZUXGUQwB0pQ.m4a.Clop 59.06 KB MD5: 1d67932d2b327a847466658a4b307ff2
SHA1: 843ce381dad0cfd32843cb3a4af7c44ca1099cd7
SHA256: f2c9959d4e4ce4fbf15cdf7e7ddd1fc05752fb597b5641c7e984fe9164948396
SSDeep: 1536:kYx7Pyqh9z4U5nX6WGettI38KrLHc/+4opFTh8qpMn4Hv+L2:kYx7hdNGet5K3c/LopFd1p+4P+L2 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\desktop.ini.Clop 0.41 KB MD5: 1e6e268eef3bfb18e78fa5792796e43d
SHA1: e09600107364aec3c9c60ac2db4d463ee2cb66bd
SHA256: 4f2048b6b11e4361c73fa21d25cf943d6611c744637909f6b4ba939109f5df6a
SSDeep: 6:xhL3TKPD+42G/VtzCjEi59BXr/jt2jho5fKqRoibqW4JrJKcY6dlG+gOUjROZ9kz:L9ozC/r/J2jhtqNd4JrJjpXkEyDM6Ln 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\vJHGxh-.png.Clop 33.23 KB MD5: 467557d48f057f663f7b24a73a0f3ba1
SHA1: 32452427ff40d3e7c668ddf69eadd64755830636
SHA256: 7617c2c969dc137fa182311a54bf263675b22e757ebb585f36ea99cae5e59361
SSDeep: 768:URP1PBndruKakbARgFESoZUjyvXqGL/IR9MiWltdptj:ULpZul0KO0X+ILtdptj 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\9rQFVz_dAB30dr89aphB.jpg.Clop 85.59 KB MD5: afb81957c55807fdbd64f1bde6c4dc65
SHA1: 8ae3735f2433f4a243c749cecaf9b5e192459aff
SHA256: bad1445160d39a14195958bdd0b0d9dc8e2681b9f963885dd9dc47ccff4e180e
SSDeep: 1536:SBPEQKPs073H85gxwHakM3UmM0rvimw0RQgkeBCfAl9UJA+WHJOWqv:+EQKPsU38OxwaxlZWmB6eBCj9Wqv 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\vHN4y WQ89shIcD.mp3.Clop 85.03 KB MD5: b35d836c67caeaa69106b3a69fff23ea
SHA1: f9dae125fec7ca10c6872a397d9cde2bef73001a
SHA256: 624b8e9a58e1511243864c1303665e5ce35301ee87b41c547c7d6cb57e772e8f
SSDeep: 1536:F6Uvz8pPLeceRhYf3eFFpkfNlORA5RxQxWaS7BX8N93KJrQAj8SR/FFa8EFcxto:F/+Tf22vuIfn5ZxGli/gaFa8EFcxto 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\1GuphSZyRIMnQ5w0EQ.avi.Clop 12.24 KB MD5: bba227e9d7b6360d79223402f84cbedd
SHA1: 0505791777172524f1525eebde9baac193acd028
SHA256: 2f5e73f3830000a1608daddb0879e692e5c1707e12ef9d11f4e6564cc2aefd85
SSDeep: 384:0xC8xiOXGeq+Fe8m8HSaFZ7GhShUTlWmG:0U6GeBjNFUSKlNG 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\BLH3rhTCDoUHvqqP.mp3.Clop 80.26 KB MD5: 0acfd772f1125301348a066031630962
SHA1: b44f5c29d44108991562c9d79525ae2066e91f8e
SHA256: 804c945b62a0fea3d2cf05d786b328eb21e885f51de2495d86dbd191b29fb5d3
SSDeep: 1536:ALm2g/SxTW7S6ZP5yf6JnbsYB9Lx4y5gmtJD/GsXlHe4j0RD:OgaY7l5U6RD9Lx4YJbGkhj0RD 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\-W1ANSK7kJ9rC2R Vp-0.avi.Clop 88.31 KB MD5: 8e0e8bda21df4fd5e0500fc17b5604d6
SHA1: e41cbe6f6082f28813ba11ca99aa43e6fe6e65c0
SHA256: b9ff7bf55ec44354eefdb010d9366dd7e18054e48dfb7f3347a43ccd50975463
SSDeep: 1536:8Ob0nC/XI3fthXX7O6kGYS4N1fn6J8tq8zeQUElBQI7pe3j9h9QHr0TWRiR9Mtd5:8O9MthnK6hYSKf7gLElBPe9hmHr0JMtj 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\-iMb6We3lfA1Z-Fb.m4a.Clop 50.33 KB MD5: e4b304b18ff31e923134f7be40fad570
SHA1: 3ae966e825a379da7f16539e0b0a196bf16d7375
SHA256: 269d03e90bf7d8050eda8ca88046767e306bdab1670ca84832a37719d12a820d
SSDeep: 1536:hHg126b4KUXeiHYpuXScuU7B4Z/sk6oghUeveiY:OA6NUbHxScuUy/sZocup 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\2hw0VHoOhU P3sOPU0.docx.Clop 12.52 KB MD5: e3d2470ea8f613e452f82052f82f5784
SHA1: deba232c4e861de0ab778d66965e600d687c3c6a
SHA256: 96d1e5f49e1712dd2f1ae7f33043ce9d949f571e95c2bfe33be50d9054e5f546
SSDeep: 192:NnR+q2lw2e4Fjkk4leQ1FDdAwTyDqBDPfARabh5GGtNNFzcAHO7QFjh2bwakPmB7:NR+q2lzdKkSz6LADnJtNUI0bjycD 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\UCjyyB8w66Rfl6SR.bmp.Clop 78.07 KB MD5: 2830f754fff75f6a1c18de2110596073
SHA1: 1a15111135d9338cf98606ab07e1940a8d69e361
SHA256: 462839483b830c75dee42549f3d5e39790e86b2a0d391e70c810557da80b25d6
SSDeep: 1536:vttWxoQt69+9G1u2KR/UlczZVn4bdHSiRfd2bIgjNnLaF9L0eynXc53jeXe:vtAaW21u2u+4UdtATN2bVdeXe 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\NyBrpQ_xx-AQ74dNO8U.mp4.Clop 20.98 KB MD5: a8656c345b95d76bf5e634cd1390e344
SHA1: 5f2ee5d680c0610611c5febb11098a3c74534b9b
SHA256: 1c50034ce3b940a1c6d733be58f0a1582751860d0be955e282ba85ce5d55cc23
SSDeep: 384:hi5fddkmzZkb8t9Yl7VVHp6LABTE87afW/8sJs7l541AIfm+eQ:hcdRk7I0BTvx/8sJClO1A4 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\d2eT4JK8.mp4.Clop 63.11 KB MD5: 8c4cb31e19c4b4b905648e5e1fcb0636
SHA1: 320ae5543b9884ab680e84cb57aa1e6c0770a6a1
SHA256: 0007b78f6ec82fb5706bc72e647a3bf97d1f42d87431029ed1c3dad5133c6886
SSDeep: 1536:pwAHIF7qPWb4RAbpmp2jI23hOiPH7RAFO7Gp7PtqRr4fRR:SAwqu4Rgmp2jI23E2H7GFbpDtmr0R 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\UErVBDjTS99ZAVVf.mp4.Clop 94.02 KB MD5: cf6e5d671db4d4ed93bf067a10c5bd75
SHA1: e905e03291daa14ada3254d8c1230a80fc1f7a6a
SHA256: ba36c1bfd8721c2f77a29b1f62361e1360f739ececfdbc5c13c9112a8c6c7e44
SSDeep: 1536:epygoMMvxpJmSO5hPQXCckwoT7owOEm9uufqhnp38MwwcS9kzBb9QSi4y74RmhjY:eUjMMZpkSO5hw+wwCEuUnpMMwwcSezBF 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\VUe3zwqA.bmp.Clop 6.79 KB MD5: 5bfaef65977f89e3de590dd184279a47
SHA1: 4bc44d301afd8364bf5d858d7d89fbe32e6b31a8
SHA256: d83002f32f0f74afadcf7266ff8cd6ba542c6723853feaa982fc2ebffb373708
SSDeep: 192:EEmD+jFYpJ/GKE9bTE3Bom9dg5/18HJkqINF0QzSqGPiISntZ:EEmD8irpE9THmIQa44CPzSntZ 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\q3vEzMh.jpg.Clop 43.38 KB MD5: a2d4e22f194585958bb391b5e3ebce77
SHA1: e4b36df03859530a93e91643068b8bc552dc2d51
SHA256: 62aacd04faad4aaedc45d5a4679cca37efc67b94285f963a05b4d3db8a083c0f
SSDeep: 768:1wfGDpQpqVHM6rImIlO+5dvsaFCG3NmZBMGKTCZexNY4Keqaz0DWWBI7C7fnJPJ9:WVpn6rIr93sDcmZ6HmkvY4KeqaQDWO/R 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\AdgNJLl.avi.Clop 14.17 KB MD5: be25284326c18e777611de4d4ee5ae66
SHA1: 158a3a196800d3dff675259c10ec146d9327ea21
SHA256: 0353bc2c011aebcd4534823efd1d521a8119a940b87caab51315db5b2c382d47
SSDeep: 384:B860rhrb2whOV1oubldg9d4WqlnvOzNm3gBqYi0X:O6ahe4OrZbldBRvOpm3gI0X 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\e4VC-WbG.pptx.Clop 21.81 KB MD5: 78f396b3e4d01987ca5a7ff90dc39166
SHA1: ca54efea2d1e0419a1af0ddc21d0600fb0f82efd
SHA256: 4a84aee19c22eb193684ad3d8ae58bd264823c13253d55f57dae01e8e2bd4014
SSDeep: 384:2AgeXrWizGbEhOZk3CuTTo2Mf9SI1xWnlxU1AhJ1QPgUScQxqrXIdt:JXiKh+qC4DMFhnyq1AhJmfQgDI7 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\JK-lp.gif.Clop 89.77 KB MD5: 17f6c21c800eff04819329c5cc275496
SHA1: 2f1c1256f3684038eba8313c11afe9d720c35bda
SHA256: ad6c5dd51936b0c0b9e532ccb1546d949895cad680b8d6789903aaa14edd5bc6
SSDeep: 1536:IIiZf1GrhEtAPUSl7T2xNTeAb4WrkkeNylBDuI8PPRmyDP8hJf8sJW6rvPrW8HnC:In1Gt0yl7weAb4WLeNyzid8ylsJW6zLi 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\wHBG1 KhJkOY8rUr-B.jpg.Clop 7.16 KB MD5: be8745b228033104efe4eebdeae1a6e7
SHA1: 9590b2335678b68fb42438b9b1679cc9df722fad
SHA256: fd8aa6cdc9b3429054ed73f6d16312952fe2e9b78547b6b10f18454de836eef5
SSDeep: 192:um3fzSr2hNrnloZf1jxn6Rzi6pPG4gmZXUkRS4:umfOrn1ARzTG4g4XU6 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\28exXMRcr1nP4Rj3.mp4.Clop 68.71 KB MD5: b319e866a1fcaf52dc8223daea404d56
SHA1: 48be9d2438f7e59b2fb2c89b47a7166048dd5c85
SHA256: 190d927bdd29bcde8a759123af5398d672bc34ccec2ffe436f5ab20f026b1df5
SSDeep: 1536:WGJR6jrA8lKrnszaQFLTbaFcan1EUAdHUuKUljPf3aVLSqh4fgkeA0oa:tSbK+9z29AzRaV2qhppdx 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\8E6wl_qLQCNpnO.png.Clop 4.79 KB MD5: bb7f7910c5aafbcf98cbbce1c891873c
SHA1: 4ff06cc976442463cf196b169ea509407f90a52c
SHA256: 987b65974a432106b7506f959a9ef3f8c336269b53b302b45182590a35b52612
SSDeep: 96:5rAtnvo9lmAvx+JhHpij7RvTfqsebtUOygxBx/oBVl5PIaRR:5rmvo9lmA51Nbyx5p/xBx/U/5lRR 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\KZdjrOBP38df.wav.Clop 39.97 KB MD5: ec62aae29d02ab9b15d0a8318d10ae9b
SHA1: f8ab530230f81e60f16d0e18b3041648aa9988e5
SHA256: c310a0f84a2a824ee25c4530541a5b18c1aa9ccdad626ec201f2d83322870dbe
SSDeep: 768:o9/Hoo1ulubTiSL1H8dcZ+XkmiWJsPPxrCxxBHhQmrQyKUhY1jMmPMDr:4/HoIu4beSLV+XRiDrCxPhtQcYimMr 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\3rZJbwvUH5.mp3.Clop 45.72 KB MD5: b5a0eb641a0796474cff7a15e9f3f52c
SHA1: bc489f3c12d6195c1aa7448e6ff2f4a8b06466ea
SHA256: abd83ab7b869b4442b7b117cc522d528cc8baf3c2cf27efda988fba32fb6343f
SSDeep: 768:FNXv/In87ksjGWJ/TkVz3J5Nr9MYojIGaAGsctbmpzDEafTzzVPO2LrFadmks3:TXnInfsSlHDyIjBtb2vEa7zzVF+mk6 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\vIuuzBVEyKDY.mkv.Clop 41.97 KB MD5: 8e2265ad731a4e97adbc4a3c91c4d526
SHA1: 0a2ee3c3cf33c7768861df3fd4b6206af4198d83
SHA256: c18b345fc5bcfdb1618f85f7b7ca137007cd3eecd66707f2c62c45baafa1e0b9
SSDeep: 768:Bw4IgSayvMxLM/TQh3zWBQbFLERuVHNCT2TCDDbp5CMH3jU6xh2917Sr:Bw4VxoaLQ43zWBQbFQRa7s/p3g6aRa 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\m9Pz1Hmu.jpg.Clop 44.67 KB MD5: c89d39066fba369a5c9aaef681cb142f
SHA1: c4087a3f4f44da0ed8edb1bcb0baa6ecb8399b02
SHA256: 9ea5ef6263fc83838cf60f7bd77193739c6a5f855f5221c4062c070c22b432c3
SSDeep: 768:wBtAs++xOnkqTDroJ+4ndW75KqOXqwHTefibba:wwsvuTXU+4A75Kj3HT3ba 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\xMyQQvGf.doc.Clop 97.92 KB MD5: 0bd480901251f1864f94041b7165c5d2
SHA1: 709d9c2ac9f712120ff010fa8e1875e415bfb187
SHA256: 9a5f07453a6868ec24a6c932fa7f7530b6eeb54cb9065dcedef5e97796ae4b70
SSDeep: 3072:wtnsIvZQ9hFlaMNrADyu17kdYmaByN4YOAf:MZ6x4vK2VODdf 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\YPIwdbokYQ4R 4UIuz5l.swf.Clop 16.36 KB MD5: 5d7cf7eb233e84b1fae5ac81805883fe
SHA1: 9fcb1a82701c8ea771762f7fff9da65c5555a7a7
SHA256: 394f8834e8663b56507b0968c9d81c7c3a33985cb44ec5a008f1b755b6626f5f
SSDeep: 384:CqX1G3RQr5mvD8xyBK4VkXjH54LeULbJ2xBG7T:CqlACVmvDQyBNkTuSGJK8T 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ubOb0lDCzgG80Xvp.gif.Clop 17.93 KB MD5: 416ac9881204d1fd18f95315c6d4d76a
SHA1: 4a1477900653a664306f509fac4b0d9cfa47d9e9
SHA256: 464701d3f45a0b62931aaba31796995aa2db0537af4e40668698984ec1482f39
SSDeep: 384:KAhDkysyVbPBpgf+YACi7OlSRxkHHBSSJ/LVCjW/z1kkySZp/0b:KCDkyVbPbgGYAlNkHhSSkW/z1kTSX/2 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\mLjbzi.wav.Clop 42.58 KB MD5: d7271c97af5ae3045edea7e4151e6030
SHA1: a0765d959707ef3441b05b87bef58dbe02b9c3fd
SHA256: abf81bbf87c5895fc82e0a479f10bbdb955c57d53878d08576a60a32aaf88580
SSDeep: 768:FPCPEE0yJmcaE2QKTG+oN4v9GtlVHyY6ux0rUkqZ8ex2HwZJE1/6Q3gE:FKEpRSsG+bvotltF6ikNQZJEoggE 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\Q4seUw4PucaI98v.bmp.Clop 32.72 KB MD5: 37c9befbae9d3b1fa9c9de7f4ab7e906
SHA1: d5bd5e3a4fcdbb1e80dc52c85ae152a4fabcc70d
SHA256: a21d214f13632e4f5ddd56d54253a5bb4de962e91b3562aa4df71f584c707620
SSDeep: 768:ERVyqfqLjJcEVIRZpmZ8rN7Kl7gy9de1+WBy+A+QuJ5Wk5lI:ERVyqCHJcEORvmKrNKl7gy/GaIQ2WaI 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\cBP N0kdCH8mn.mp3.Clop 22.24 KB MD5: af46ed7b82a1b2a8b0ce50e3ce220748
SHA1: 122845a3d3f7914f7cac8e78fbf844c5bbf8d626
SHA256: 59c1e5aff839b648dea4a1206127a80a4dcc5e51d0f0cb61ce6a41bbfdd446c5
SSDeep: 384:ZksKcU/OBlVv6zSmNECH3JVZ3Ih49C/Q+PHB+UEt4jsoitDdZC4fSNmmD4wcZJVv:VKcU/2ld23ZVZc490foMjsfCLNfDn+Jd 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\3cM9klXep32Nuxcrw.m4a.Clop 66.54 KB MD5: fc25177320c1ce47da4d05ef3ec65039
SHA1: e3a5d73c1250ef8f6700f44fb18e97a1d31258c2
SHA256: 0a7e77fe8f6fde23771f643ef0274a23bb728d9099341827710fe11b96021022
SSDeep: 1536:x3ZUrsdPo9jDDk7wYPNpeI1CpxFQq9EQwOP9c4poRF87lc:srgQ9fDYN51CjyqlDmHF 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\v-4HDop8QcfjvXfepmKD.mp3.Clop 19.04 KB MD5: c05deb9bbb6f4762fbdfb209612af1d6
SHA1: 4992babf1f46512961a893de61a84e8dea6f8f3d
SHA256: a71946eab2c38a462872e53abf143d2347a6a7d0b4fe303643f45655ff7586a0
SSDeep: 384:Pa9swMN50pC+gj/huNkBYoYfqA4qr3HrY5kuA:S9sJg8YoBMDLYQ 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\kgA8vkn8D.png.Clop 95.55 KB MD5: a361984a529dd2af604b5d8ff4e35a6c
SHA1: 43c2e10f26ef4eb15c416f27307a6f8a7f2f9e73
SHA256: bbb5e7a76810728a03dd9c1ee7e20399d9588815be45b3574b32814e7b3c73b8
SSDeep: 1536:Z41DekD/F4nLvHQe6WtrkxgsID9tsgQqoBX/8ctsPBnxL86aD+XWkDeiRBviDSyp:Z41ekxYrkxgdDXQ/x/AJxLG6GkDJvkSA 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\tgt23cY kRsq.mkv.Clop 50.81 KB MD5: 88e53e78e3504f1bedfc998fcbb30d54
SHA1: 9d0f08240ad171aaea69eab2e21944a676c8990b
SHA256: 9f29ff7a6b8208002c2a569f95c2226405837af4a56de4b74da05f1225047745
SSDeep: 1536:R221kGt3ewgFeAkKFzM7+wmR5idPuE8ETKjQX:R2et3edkK6bmR5TE8dQX 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\jzlaMjeyc.m4a.Clop 13.82 KB MD5: 832722fa0e44e40b3001b6e741614750
SHA1: 3f11a644e771a91e18dee4ccb3c15a8b3775f09c
SHA256: f769c29a7ee1c1cbda6c6b704f29fbe5e1dd9a1a2c5e6b63b722b20d80e9ea8f
SSDeep: 384:vyV0qUPoZFvlEneYZG1F4AybbJ0WwxOl9nxi:S0LiFdEneYZG1F4fUl 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\H4KR8e.gif.Clop 99.03 KB MD5: 62174952268d22d24078e525971a97d6
SHA1: 8b1f4341db3ef58be60e37dabe5495993141f2ea
SHA256: ca5932c07a15647300874152d8aa3c025f2c15594d89445b98f3d8b18d97a496
SSDeep: 3072:cBEZLw7m1YY3btpqKEZ9tXJep42yN4cGx567v:cGLw7mPppdEBEdE4cGx56D 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\VzugFdG5q8.avi.Clop 43.20 KB MD5: ab30a538c5735fc760185572d7648ea2
SHA1: f7154fc4752bb449aec8675b576e322859a8b18f
SHA256: 77219985ac11c887e33b217d675b797b8dad0430db1e297511f882267409566a
SSDeep: 768:cqNaj6Jue2F4H9mc5d70w50yoQ8KStcKfygGOeKbibAC8xPNmh3o2hMB+FP/vkdj:cqgWP+69xmw5tovKShikUvyeoCtPXk2y 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\-uqdFL.swf.Clop 44.68 KB MD5: 32c1fb0741beaa0360bb4812f47e2307
SHA1: 5c263518c0cf7e13604c6f8b492afc82301ec2a6
SHA256: 48b1a726a39ed6b0b1429db168e15cf936a626a8a74d7066371265a92003f23f
SSDeep: 768:0NLCn0HFFt+1/XadKzhOAfSQM/6nRLfkyD5jMuEt/G3HCW7oqLgL1D3i9Gm+RiD7:0NLx723c/6nRLfTmu6/kiWsJ7i4mhKVo 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ClopReadMe.txt 1.43 KB MD5: da76cdbc83863176e9da51b1c9224139
SHA1: fc71801db718efd836c93b6b95dceaa155050290
SHA256: e79dfc0bbdefca3815ffb349139a512e7090403a1e4d80414b97b3e567c7c1ad
SSDeep: 24:iVeUHysW9F2Ob/87gPso73gMqvPrvccLb1+y3TqXUNGCUTxtpwRrCwE3lCobabvX:xUSsW9FjMF4xsqkUfpjwsl1b8qD2Wg 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\Jl0vZzRw qEogGC.mp3.Clop 18.13 KB MD5: 794ce45f1c0cdb9078e8acbf3e59427a
SHA1: 0cbfc6c30d4b1d53c302aa65bde387eb8a7028be
SHA256: 49a9279f790f5a6efb77d6674d71bbe6f7c73b3128b18c053b84f111878b19ce
SSDeep: 384:oHfjW7gRHoVzKdbp7vXkxV805XaboRFMw7h:obWsVoNgBkxV8Kqc17h 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\AawVwHL.m4a.Clop 70.05 KB MD5: 7e1ec47a67e040c1eb37fc7530d0c276
SHA1: d1038abf5c1d9f1a715631c8f8c372f022b7e656
SHA256: 265eb6912865eb4e7bdc617e6faa5e5f16eb88dff34b37ec21c92dfd1cb36c0a
SSDeep: 1536:Lp3B3h5KkyDBukFsnxB+8voXvPZBHP0k8pGMVotbCjCekFg7:d97E4HBwD8IMVotbeki 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\LIpP.mp3.Clop 11.65 KB MD5: 460806eb2106fa1fe37bf5a0dea47113
SHA1: 6732032d36389015d4a47bc94cb6423492087c21
SHA256: 4c136e6d2095ff9371330a88c1cd6f932e719c4e2fe9571ce9572cde888691cc
SSDeep: 192:1JnKRggC5E2koYSLvahucidnizqoyxanrHtHLUSuH5TisNvCrDTpWd+4ojbsSiNG:1Fagr5uoYSLvaE2zqMnd4SI5W6va4ojH 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\XX4thRNGxg6Fuju-.gif.Clop 75.69 KB MD5: 43dd80057e963d955e4a6c052306e7b3
SHA1: 95d850e7a4f75456a5f65e9ca18406857c2865dd
SHA256: 6f978b9b487fb1f7e42dd6c3ed7f7d505281f2af97b1f260c17a6be0dc9e6468
SSDeep: 1536:7Bbv7E/K18wuuvxHu8JMrNPmZZdQ9GidvX/vv6eT/YMZpO:dbY/YNuW57MrhynQM6vvH6EvLO 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\sQOzkBJ4zBYE1.ots.Clop 39.72 KB MD5: cd91dbf7b669e72524a7ddcba25fa320
SHA1: 8cb46cbede529f7a543876e00a2c37addf3433a5
SHA256: 4909626c0e398c3eb9fcc62e480652f979c1c9506ce838f808687cd02b146510
SSDeep: 768:CzBjrA5TnGM73TQiRRSmRnqWx1ZNwQwb2SXroFU/p5CXpQwscb4U:cxAdGMnhEWqGwQiroFU/bCXpQVIT 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\YxwGk89V20MALzff.bmp.Clop 22.77 KB MD5: 5cc761dcc5d867fdc552b8022f79c5df
SHA1: 781d32b3ff043cbbd6fcaf4b45394296cd2bfad8
SHA256: f20375b30895233d1a904270872b1b0e8ab7802ccbbeb2b01bbdd0cdd8c6110a
SSDeep: 384:EYdbqZF1lN/xpY8z+T9fSEDOIsrtaj+v+8lgKPxVGdSGFBV6SH8LSJmcB3bKafi3:hdbkF1ldrYrwIOI0t4ikazGdSGFBVqam 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\Jqmw2bG-TElFXFN.swf.Clop 57.83 KB MD5: ffa46eb343318cae92542f277a40d1b5
SHA1: 56dfe799131832cd891d3587f8f1735da2c0b74a
SHA256: 62fb07ca8245a4f64673781ae1e238ae6921adcc533148fd05fa4d98d5d5ab8f
SSDeep: 1536:0yoq4QP5KKuulvfHlHOpO+wuiy4LeXpL6+bo7XwYQuvZDnA/:3oq4E5I+v/lHOpoLEL6OmTQuvc 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: c3f1257305f138605ff1242aa2f2638f
SHA1: f995b363adc1030777276885d125f03826681f51
SHA256: 73150d16b20b8624f6069c7ba4ff65a5842ff827902539206895b76b0bfd04cb
SSDeep: 24:ewtO4VB9USSS5JXrlSEX0GS+xNqaC8ACp7MMXM1kI7j+b0nS4rwJUQ:xtO4/9USSS/9X0GjLqaCep75xI+ajuUQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 305472d014220a408dd7b6d3a1c5c7ce
SHA1: b5fec63179be4c108ee82cd186f243638ff8ca34
SHA256: 726e393cdc2778907dfe2483e47febaba9c58acb2d9c9bce0b903b817df6f98d
SSDeep: 24:ewtOkTp9BUj96P1/C1FiivpQS1xvpNpkFnlkJr7IiL1RG1Nqpre90t6Y:xtO05Uma/1vyS8n+G1NEreoz 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 79bd0175efbcd41bf9a2520e31844bac
SHA1: f0a87f6b4247439b4352340ec6d2437844fca32e
SHA256: 9a35da40f6a44a857ce50f4bdbe80587d498bd416da77a9786edcba69de52d09
SSDeep: 24:ewtOYXkUqxOo7DujpH+z3+GwbHQYHXP9kW2eo5HChOyswbUNSVsy:xtOYXkUGv+EhqHV2W2eo5HyOyh4w1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 740a0d46a517efa041eeea9cab602b27
SHA1: 56684d3758272ddd1d0e3167d0454f8deab822ab
SHA256: 25182bf166a5a5f20fd2a11f2aad7e6a99b6a1e3551525e284bd307de5797aa7
SSDeep: 24:ewtOdrSzxhU9/NHNfiTyAnr6ppAxmfGQsACHUHopbozwYLUVBQ8:xtOMLUNNtaTy66Yx2HsnFpUsYLUh 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 0fae47efe63d32d6682c018f643e0899
SHA1: 6cf264f539ec322a836b45b281f54a7a5f7daa54
SHA256: ad29ccf6cefe4674351a1073b5c78e8df93b43c69109a0a5558724cfbc8ae469
SSDeep: 24:ewtO1/kLU2w1Eg9FjUkaZZJmqFSnQkcf+tux1LU7VuTWxq9wUJWgjZm:xtO1qU3FChFgcf+t41Q74T4gBPZm 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f1b61304f269d9928c4a071eb5c1c823
SHA1: 9d56702baea990638f4f7086b1b2b21f48489108
SHA256: 411e719dd6662572866d0a9a879738cb9e2f1ed952d821ad0403dd69dc782a07
SSDeep: 24:ewtOsWUSFLwUxVjsuryPUAMyqZM5P9FNns6uEdYRQ/+FZ+u3:xtOJUiLwUxVjs9PUFyqZMxnZEO+H+u3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6c008f351c249350db565486225e327d
SHA1: a12223e00fc4dbcc7955d38cb34ad7e0aba5d7f6
SHA256: da64e3b3c936c9647f048f7617b004657779768ca6bf65568d619053268c3bb8
SSDeep: 24:ewtOaZDcdWOTUFen9oi0xi5Mz051yEZrP22txKvH/wEWmLcg3/SPX:xtOa5TOTU4ZT51yw7txEfwEWmYg3av 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: dab7824b6e218b0a463dca975b151a57
SHA1: 4192d3ab1e9491a950e56b96c4d2e288d016a14d
SHA256: 81086adcaf8c42142001d1d35e918401126d0fca1c67360fb831c39b2045a47b
SSDeep: 24:ewtOSSbFoUml4UU9ZhbDT+tKREXCCjXJHaVy5o6n+V5Yb:xtOSoFoUnUGfgXCCrwAok+Veb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: d06a82b1c1f59ccf2c7810a182113726
SHA1: bfcaf698c6b81bf9903286bc3d68ce6293b77c45
SHA256: d8819e3d1e82bb51e4d1c5e00ba60e77c427661075ac739bfe01ba3f34c1d7cf
SSDeep: 24:ewtOW7sUvRokOUZaQSsw46MbsQbnCv+zdi22wXZtA5Gl759sa9icUBXE:xtOQ4U8F4HsQDNdi2D/n9sa9icUBXE 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: ad9b1d8375d2e0896b57253c9e0b7d86
SHA1: 78d50a8309ff6afa6c276b614c4c3584a3da7fa2
SHA256: 02bc3f5a1c4db8c318c042d8b4c505778fb06ba6c3500e3266f521c0faabacfa
SSDeep: 24:ewtO6/H2lcm6jDUVxpKj/7N8qKdqE6OHjaEsyXl0Ujuhk5hGzpVeoPeL4WdkVe5a:xtO0+8UVxpM/pedqGjaEsyXl0Uuk5EzN 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: ea3dc1d1699c25efb8c2b5601f956224
SHA1: 9989a6a1b283ea11fc122912f2a1560f82cd0db2
SHA256: 7adcf6f87f71e774b84e8d2f18c26822653949524c2d6fbabf205e0e585a579f
SSDeep: 24:ewtOnKZukaCGOUKlWtpVW8eLidJSjXFMltJuhNjls4UC/iS6f0oU8SGR7x5d:xtOKUSpUKAPILifgXFMltJuhNj9UCQjf 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 0453e0e9d4278c097ce38aa4688d3dbf
SHA1: 9a12fe1d2bff90cf746d401bba75460cddc15dac
SHA256: 12c00d7eee37cb0062cf904bf751e9606744133d2c2197547f727b48e4822ef7
SSDeep: 24:ewtO5K26M9xhdgU57qbybm8GEO7OChJ4d81Q+t+2zOj+w7WobCs170qZHnOZsTPP:xtOmyxzgUZbmLv4dQQz2zjwCox1AqoZY 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 61802f68e2e23173b1ea497ab75b91c6
SHA1: 627423eb7ad373ed3ab595645619f6875e0046ba
SHA256: e2e43a833ef8ab56507e600223512d04d6d9ee12b6c8dd3a10d72b72fe956c37
SSDeep: 24:ewtOIxFYW7S2UoYzY5/UJWmCbOL77aRyWcCNsw40ScUTBPpGfQNgoZMCEareG:xtOIxFzVUoYE5UJ9vmRcCNsx0XUTWfQN 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: d2fa3b422b43584b235e235076d010aa
SHA1: 0a6e435062673a94ea292b1918ddfa88aea3cecb
SHA256: dcdab6b64c4ac6eebcd37db4a1e6ce2d17066e37c0bb8c29bf59e7d90a129c08
SSDeep: 24:ewtONrEPpUJULOo7UYwi1o6ohnADoGK1Ko+4Ppznd6uGyhpPtb3gbeHyzb/T0k:xtON4PpiULOgUYw9BnAeKo3z4uGyhpPY 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 2d134402a9fc3f1ef45a2412693800f4
SHA1: 31aec7b0563d18400c416b4331f1d16400f81656
SHA256: c49ab8fc9b9b1e0be626de7a0c52edfe989d8aee7352c6f58fec2ecb72928eb7
SSDeep: 24:ewtOoFCuUEUpH1kkSJ0N/W7yH4U3F+XphimukQf5AW0o1mPZaQSC5UTR43w/tQ2:xtOm5UEUpVw2ZW2H4U3F+5hCZf5wo1qA 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 548f812902ae0b058864f8440407e4b4
SHA1: 369f2aaec32c136e8705e35d6533f21ae01076b8
SHA256: 13ea06c81c31c9a209f0233d9f5a8d9d7bb47e0c750d9338c81d4e8e84b49278
SSDeep: 24:ewtOFsVwRAOUSzdH3Q0fhlfxF4luIFdInoNuDFQOOsOg2eKWPsmPNWc0gO:xtOZRAOUSzG0fhBvjwDNuJqsPUWNP10T 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 427fc77efafb488a2a481af0d2305ac8
SHA1: 88c171b1a6d7db56a082e185ca003d5991859302
SHA256: 50f24839427d3897169908476da17ce0b1eb3473863d5d8625c2aa7626e94893
SSDeep: 24:ewtOY37ROU5V3js87Jz2vyd8/U1DvSN4Wh3HMOC8pxucYV2T8S:xtOUMUzn7Jqqd8/U1DE4WhzCjcYV2z 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f1473e016149f96414f837e776c75c98
SHA1: 5415bba810ba15eadb0cf2a72816440203f19ac6
SHA256: e92d1e9f900dd8233679743e3cf0417353d88161a5061db55cb558df073b7908
SSDeep: 24:ewtO7saV0+KIUofcJ6EOalQqvF4WIkLUfYoo1iJ68I93rKy2FcMyIIuyQBVPYD7m:xtOAaV0+KIU/J6ETlQ0TLQGqINrm9lII 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 2dc1a1f7489acc6a7961112256f931ab
SHA1: c6ad461733a229769db5398f68cac298cbb1a12e
SHA256: 15b14780585bbab378d3a661da7c385f9f9f4e5987d7a50e5d8dfd3659014417
SSDeep: 24:ewtOCf8ReUGxngoUHSvFItQ8GGaAkdzj0HeqgqwFYJCl4CcE20ig3:xtOCf8ReUweHSy/+5n01gAJCulEug3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 993590406a546210282694e1a0151a15
SHA1: ab2c9db0d146eb6d104f96c6ee41cb0611af2a7a
SHA256: a8d65b652734ba1cdf4042ba47e552c0051f178c49cafccd2ec0bf205e796798
SSDeep: 24:ewtOVp2/Dw//3er54V6UxooMymUdNpFba5N44KYlKghlInNmQJnbg6y+2APPHVkH:xtOgDa3O54UUxoozFSd57SN/Nbg5APPa 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: a9e3669ec84e784de899baa9420e4ec6
SHA1: 44be22dbfbc524ba30cb0520e29e5b049e79d5fa
SHA256: db32bc23920bb6412bd7a3fbfa747a7d88cafc23461b6c9a67526ec35f4f4205
SSDeep: 24:ewtOXdqragUqqjZ5NH1NZFYAt0HYGtwhyJYcGUk3nXsu69IES6YL8yOjhdn:xtONcxUXV15YAt04EIYYAk3nXszXiL8j 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 5e32da4f23c80f84a34f5c9bf5a74107
SHA1: d8a0164f6562a3437ed6919aa77dc34babda391d
SHA256: 2a9f87fff922e35f7e217a178253bf6d0963cd323bf1b22a27aef55ca70b439a
SSDeep: 24:ewtOiQYg7AKXWU5gfXXKq+B5VP1708eXYXnmkI+WmYvYc+1+C0WHWUFTWGGUsUGJ:xtOi5g7AKmU+XKq+B5VPe8eIXmksmXcP 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6f737aa63bb99148d44256ee31385daf
SHA1: 8af38e2327c796cc040fcf95b79a91fe092451eb
SHA256: a7acedf90235c6e7fa46ef7528db1a5d2547a151cde01ec6eefa78ba7ccde42b
SSDeep: 24:ewtOoRUPJ/gUDuG7CtucZrY5Jzu2d2FvQAmfyz1bKs6wVuLNvEpz:xtOoOOUDueHBZd2FvQA461bKHwUx8pz 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 538b5efe026f6b68ce870dfbef0e74ec
SHA1: 23e9f1ae37f4035b7f181df41433e6ba909ddb51
SHA256: 0d837b3dcb250fad172f1960cf397f9a33831615c386577f6eab1ccc9087dfaf
SSDeep: 24:ewtOifGOProxFRUeqMnP8N8bGXI6z8WcPctbT8rGKYrDDAjxx7Iq8jzP29CX0WxF:xtOijPrmFRUeqoP48bx6zy0bTfDklx7o 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 235a87b1eee14a550e74556d7e750c4c
SHA1: 36baaf080195416b3a2067dddd217cb5c721ad8c
SHA256: 40fc49ee920dd33a42a563735608a655e01a1ca6967bcdeb3456bfab884cc18d
SSDeep: 24:ewtOtofKs/rBVHtUtEnX67qVXM3kflQEFh3f2RJyvy2E3PPljvxE4J0uFAScxn:xtObszBVNUOnKUEktQ4eRJy5E3nlvJJQ 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 04ba61df6c291370f6698196ae954970
SHA1: aa72ea02bff156a344269df5745888d4d6aae349
SHA256: 2a7eff60327b444983b31ced2ed7a29062c4f04d4a2fc0bc07dc9f3eca519c17
SSDeep: 24:ewtORwX/5s/fPUyTP0uEMeKG6MdX86j/6evoyNY2vNO41u/DU+QHnh7LDsZNLamq:xtOk2Uq8MeKPm83eQsYsNO41yD4h7LDb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 8cd2fb2c6599896768e0de02916321ed
SHA1: 8bf0b3e256c7e25cc6840a482fc15bc0b6e23232
SHA256: 3e49d412a6d35003fc41ec03a3f6043e5abe95b786001c96fc9b8279481b599e
SSDeep: 24:ewtOLFuIUChfh9v43dmoWhFXUgdN6cI7saZjt:xtOZnU+zEmos5i4aH 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f80c3e6c94aa866d94e4e226880f47b3
SHA1: 109d1cb1c84925a5c28f32bc5f6ac8f053eae12e
SHA256: 33452a922a17f681ef280926b22cd19b9b7eacae22e9f611247c6bdbdc5cda6c
SSDeep: 24:ewtO7POUnP3FkErwTg13SAF2N2/PNAFpmTFzbYEL3bpf5Qsr:xtO72Un/FkErGQSAPmFpkdnbpKc 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: e5fbaa12817828e744d29cd0fe063c79
SHA1: 54ab55c91f9828911e0da77e1ac5209486e547ca
SHA256: 7da3b84df5d4d92854f83005dbdc0a99142c06607a64a6ae38ffa2450f446770
SSDeep: 24:ewtOniUE86TuswFnpYBxw0ggX+hEedM9mavXLcs:xtOniUP6THunpYboq+6eK4avXL1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 6f7a497981346004aeae009922ac35d2
SHA1: a78f9010846e3d4684a75f8f4fc492624619cb81
SHA256: a3de6b6a968eb7632ef229c6f8689e64bdabdd6865dd69c77bbf2cefaba68a2e
SSDeep: 24:ewtOFtRUqNbKLYt1Si7Cj/YqFXPtX/N6fVIye42drJd8NBY8UbROwbg/x0jVBn:xtOFjUqN+i7Cj/YgXP5/N9jJd8D9kg/M 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: de399b71de1e5e1e9581ad5b1657bcfe
SHA1: 4828f87eeadef5d5bd06398816e3db4f50c5b6bd
SHA256: cbfbd69d1324d4532b6982dd538a40de0ee3e5ecb01abd7e01c0777322e70f38
SSDeep: 24:ewtOz6od9wGugUYc+1anojshIV5t7r3V8OJVAkZ7+Coyld3wOsO44:xtO1d/xUr+xjqA5t33V8Os470yld33O4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: f19675d1b3dc788039f23b1ded349ccc
SHA1: 1218aa6133f59f185127dc51d56dd09770d6ed47
SHA256: ca150c3fc16507862d7246f7a86268eda57c58109cc789c856afb75878652dc3
SSDeep: 24:ewtO/j6RkPUGS4QbOGQ+N5OGlZcU9lXSCN/EeQjrcghxMO6CVc/0jl8+b:xtOmRWUGDXVQD3x9l1/zMIgvMO6Vqu+b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: a03e93162cacf33d9226a89ab49adad0
SHA1: a83a90481658c3aecb0aacaea3b2a7e9b1237364
SHA256: 5278d3d9ff6221ce576e31f3977bd14a132f82875e354e1497cff29e54c858c6
SSDeep: 24:ewtODABFc6TU+HHfDWlY5ffiivBB2qF+liGtsV/xQpcHiH3DcagRKR/UHyp3Ef:xtOcrUMfDWl8nTvr6mqpcmonMR/UHypu 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 062fd1b8a8fdf70075532a0f41a1bf68
SHA1: 1141676750749e301a02bfd9fbb047928d10af3a
SHA256: e1e8d0afc4e8915027a8cdd7d8c55e6e95e7ca2f11db2068463c7c2473533bdf
SSDeep: 24:ewtOK1lGw8f6tU5Q245NRnMKfmJj/1VKmFR0tliB0CVac64kuZkqTn3wK23+QR1:xtOK1lzq6tU4v6KfmJj/jKmkl20jc6CS 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 5d1c1c0787c4062b1194fb524dba986f
SHA1: aa2c70eefa8e51d1e7115634bcf21c3a0ee39195
SHA256: e0262320db764ace7df459c39f02e7436f9edbb6a2c4c8a6dc6dfacb20db8a9a
SSDeep: 24:ewtOFrM8dN2ULTrE20VTAn2KDrHE87zvWvpLdRO1tH0HgjATjfiATuZi:xtO5M+2ULHvMUnHvTv0pJv6UjfiACs 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 613b55aa1ea6f0a800b3356d594c6aa2
SHA1: ada182989559128f85ee1ad1d9268c5c63aff94b
SHA256: 0370435973e24dd0805961dc1c163bccc13346320a30a92d76737aef032e5709
SSDeep: 24:ewtOJAU49hr4pcDWTk8PLw1SQOTjcUwF4ckPIpmilnsFlid+V6jUdnq5o8:xtOJAU4mcDWTk8PMBujcUwfkA5fjW8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 679b15931f20dc4f569fd07785da8cbe
SHA1: 2e9ef6973b39d371b86f854bec12067e58ab4c22
SHA256: 8a206cc127248c30780ce8fc0ebb8d679a39b769dd521193673e50aff80a27e1
SSDeep: 24:ewtOE9bUeWxGKab5FAvnlLo6VILwu9P7D8ZVDHskr+fgvNQ5IlPFHcPumr0e:xtOkbUeWxU3oyuIM2TDODvr7++PF8PuM 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: b6af6907693d5d48a9f0243db0fc6b0d
SHA1: 03992e36ff6d305fa219fdd693958a5f258453cb
SHA256: c87b6ae850fa57fd313ee7b8738f30be987a877d98dd5f69107cdc504e4fcba3
SSDeep: 24:ewtOz7u4y+OUIUUz0LX9nZ1+da+0WVnxzdntjyVKVzQxTNXwbjPRNj5rKw8f5tua:xtOzaIbIUUzuX9Z17pWRDntlQRNXwbjA 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 1f484272a34430052bc0265f3bdd1e4f
SHA1: 78eea106a8566c8b4357e0dbf22173b4802f36d4
SHA256: 6ca453647bf82af976925c5ee5990fe7af615d7595f3ebd0fa600dc0a0f2c4ac
SSDeep: 24:ewtOlmljZmIUOe5OxkBBr455f+eHulc0zdnW7hPic3Xj56UMIXlWdGZdqzseuGVE:xtOl6lmIUTom45hhnqizzhjl7Db 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: d56fc65401ce83e2a57b9a15b8a14be7
SHA1: 958b6714195f71c631433bea1dd81324aad8007f
SHA256: d0bd30ac141b23ce72689e5a09b38edbc4c84f9adf17bb783771ccf14c242a77
SSDeep: 24:ewtOClcBXUvx/NdUhi0EqrUX6I0o/ZHTxTlsNKNCaLVc2ayb+:xtOHE/PUhPEwUXX0ohz/C2Ba 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: a3dcdd075b2cfaa64bc77472eefec42d
SHA1: 8d88462d037e191eeb8d741dc465bd4106e714ae
SHA256: 7abb5d9bf9e94e2ac9efa359a98521e6c879a13252bd902cf22ebd839164043f
SSDeep: 24:ewtOT5Nud5xU7zebYfG6PRKKmEpGVXEMOFPYOL4IFgmfIN:xtONNu9URffRKtEotQFQIFNA 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 9c0867dc930bed74b4f694558a7ec4e0
SHA1: 7ce4f4e69a61cbf0557f7a908885de8498ea688f
SHA256: 56c12de6cae6258caba0901e96ef333c5d7948669502f252ca0e65201eaaff9d
SSDeep: 24:ewtOoIVDLh4yUorUY+P+UE1rUDwfa3d/fV1Kv33z1nL/hX7DDK0YYV:xtOoyh9UorUxP+VCJ/fV1mTX7PpV 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 0094d59981bc055b4eebe041a49fdbf3
SHA1: e2197068f7ed59d13be02dadf0430294b515d2fd
SHA256: 99eea2dc596306e8d8fd9a6ae6021f4f73ff65f2d0cbf2acab022313a5a25f61
SSDeep: 24:ewtOGwF059Uphj7RdhDBp6x9FOikolnoaVbKK8DaZ0leFlQrklux/m:xtOb0DUXdDcsgoa4e0lUW6u5m 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: d5a1890778e3d1981bceb1716eff9fa6
SHA1: 73191eefbbc7ed99ef35790365f1d61a6cc60386
SHA256: 05a71d65431bf25746f3699b7ce12f83ab04b48cd639086dba2029a4d08d6638
SSDeep: 24:ewtOaLmzWgDNFUQcWI9XkYeSIrkIIFw/vzmNaYb98QDLnmxaYrRC6eGFY3d2:xtO22UQcPb8IQrmNxR8QLnmEYrRCf0e2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 8a35d0a0a34f054ab4dc62b1fd91d040
SHA1: 1308389dca450e3333ca6198843655065f013287
SHA256: 6ad9843dcd7e2c0ec16e68898abc623de7d55d322cbe0ac5eba023d7572be36c
SSDeep: 24:ewtO4yOC+ljlIUzzdBSVAOjFrtWACKmbnjZrTBNqaAtkJw5xDurRE7tiv3:xtO4yOV6UbyRt9enlhBACwCygv3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 335eadf9877661fc620e5223c7124073
SHA1: a79bb63feab3e8f60ab16a33ecdf2e12070c875b
SHA256: eb426d47f2dd134ed8973793503d2fa3a14cef848e0d40a95ab3289fe203559e
SSDeep: 24:ewtOiUpygbSg2UbAqB/SV4j9yVjm/AfKvdxSrN5QMOoxq7BNqt9UXxQwgStrkDc:xtO57bD2ULBqVAmC/AZR5TOFlxQOL 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 1.40 KB MD5: 49fd50b170dd42726d20966c2ebd6b61
SHA1: 0e4519e8fa4a4a8e74a05794242c964421fb6054
SHA256: 9b0f03fc083b36aca68e0c6cc8d421f7ae225e77678c3cf302866facc32ff88a
SSDeep: 24:ewtO+u4s4TY8rltUlEza/KYkMdLyon1N1/WorcAv2SVS2XCzXowjFDQLNa:xtOn4hpXUl//KdMdLyO13/TrnS22osFh 		False
...
Host Behavior
File (356)
»
Operation Filename Additional Information Success Count Logfile
Create popup.txt share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE False 1
Fn
Create D:\ClopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create D:\ClopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-iMb6We3lfA1Z-Fb.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-iMb6We3lfA1Z-Fb.m4a.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-uqdFL.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-uqdFL.swf.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-W1ANSK7kJ9rC2R Vp-0.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-W1ANSK7kJ9rC2R Vp-0.avi.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\28exXMRcr1nP4Rj3.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\28exXMRcr1nP4Rj3.mp4.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\2hw0VHoOhU P3sOPU0.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\2hw0VHoOhU P3sOPU0.docx.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\9rQFVz_dAB30dr89aphB.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\9rQFVz_dAB30dr89aphB.jpg.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\AawVwHL.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\AawVwHL.m4a.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\AdgNJLl.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\AdgNJLl.avi.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\BLH3rhTCDoUHvqqP.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\BLH3rhTCDoUHvqqP.mp3.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\desktop.ini desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\desktop.ini.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\JK-lp.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\JK-lp.gif.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Jl0vZzRw qEogGC.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Jl0vZzRw qEogGC.mp3.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Jqmw2bG-TElFXFN.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Jqmw2bG-TElFXFN.swf.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\jzlaMjeyc.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\jzlaMjeyc.m4a.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\kgA8vkn8D.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\kgA8vkn8D.png.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\KZdjrOBP38df.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\KZdjrOBP38df.wav.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\LIpP.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\LIpP.mp3.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\m9Pz1Hmu.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\m9Pz1Hmu.jpg.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\NyBrpQ_xx-AQ74dNO8U.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\NyBrpQ_xx-AQ74dNO8U.mp4.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Q4seUw4PucaI98v.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Q4seUw4PucaI98v.bmp.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\sQOzkBJ4zBYE1.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\sQOzkBJ4zBYE1.ots.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ubOb0lDCzgG80Xvp.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ubOb0lDCzgG80Xvp.gif.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\UErVBDjTS99ZAVVf.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\UErVBDjTS99ZAVVf.mp4.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\v-4HDop8QcfjvXfepmKD.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\v-4HDop8QcfjvXfepmKD.mp3.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\vJHGxh-.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\vJHGxh-.png.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\VUe3zwqA.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\VUe3zwqA.bmp.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\XX4thRNGxg6Fuju-.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\XX4thRNGxg6Fuju-.gif.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\YPIwdbokYQ4R 4UIuz5l.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\YPIwdbokYQ4R 4UIuz5l.swf.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ClopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ClopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\3cM9klXep32Nuxcrw.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\3cM9klXep32Nuxcrw.m4a.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\e4VC-WbG.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\e4VC-WbG.pptx.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\mLjbzi.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\mLjbzi.wav.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\q3vEzMh.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\q3vEzMh.jpg.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\tgt23cY kRsq.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\tgt23cY kRsq.mkv.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\vHN4y WQ89shIcD.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\vHN4y WQ89shIcD.mp3.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\ClopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\ClopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\3rZJbwvUH5.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\3rZJbwvUH5.mp3.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\8E6wl_qLQCNpnO.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\8E6wl_qLQCNpnO.png.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\d2eT4JK8.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\d2eT4JK8.mp4.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ObwlO7BZUXGUQwB0pQ.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ObwlO7BZUXGUQwB0pQ.m4a.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\UCjyyB8w66Rfl6SR.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\UCjyyB8w66Rfl6SR.bmp.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\VzugFdG5q8.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\VzugFdG5q8.avi.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ClopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ClopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\wHBG1 KhJkOY8rUr-B.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\wHBG1 KhJkOY8rUr-B.jpg.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\ClopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\ClopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\1GuphSZyRIMnQ5w0EQ.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\1GuphSZyRIMnQ5w0EQ.avi.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\H4KR8e.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\H4KR8e.gif.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\xMyQQvGf.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\xMyQQvGf.doc.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\ClopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\ClopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\cBP N0kdCH8mn.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\cBP N0kdCH8mn.mp3.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\vIuuzBVEyKDY.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\vIuuzBVEyKDY.mkv.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\YxwGk89V20MALzff.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\YxwGk89V20MALzff.bmp.Clop desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\ClopReadMe.txt desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\ClopReadMe.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_WRITE True 1
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open STD_OUTPUT_HANDLE - True 2
Fn
Open STD_ERROR_HANDLE - True 2
Fn
Read C:\Users\CIiHmnxMn6Ps\Desktop\-iMb6We3lfA1Z-Fb.m4a size = 51405, size_out = 51405 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\-uqdFL.swf size = 45617, size_out = 45617 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\-W1ANSK7kJ9rC2R Vp-0.avi size = 90295, size_out = 90295 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\28exXMRcr1nP4Rj3.mp4 size = 70226, size_out = 70226 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\2hw0VHoOhU P3sOPU0.docx size = 12687, size_out = 12687 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\9rQFVz_dAB30dr89aphB.jpg size = 87512, size_out = 87512 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\AawVwHL.m4a size = 71594, size_out = 71594 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\AdgNJLl.avi size = 14370, size_out = 14370 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\BLH3rhTCDoUHvqqP.mp3 size = 82051, size_out = 82051 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\desktop.ini size = 282, size_out = 282 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\JK-lp.gif size = 91793, size_out = 91793 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\Jl0vZzRw qEogGC.mp3 size = 18429, size_out = 18429 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\Jqmw2bG-TElFXFN.swf size = 59080, size_out = 59080 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\jzlaMjeyc.m4a size = 14012, size_out = 14012 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\kgA8vkn8D.png size = 97705, size_out = 97705 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\KZdjrOBP38df.wav size = 40793, size_out = 40793 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\LIpP.mp3 size = 11796, size_out = 11796 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\m9Pz1Hmu.jpg size = 45608, size_out = 45608 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\NyBrpQ_xx-AQ74dNO8U.mp4 size = 21345, size_out = 21345 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\Q4seUw4PucaI98v.bmp size = 33366, size_out = 33366 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\sQOzkBJ4zBYE1.ots size = 40543, size_out = 40543 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\ubOb0lDCzgG80Xvp.gif size = 18222, size_out = 18222 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\UErVBDjTS99ZAVVf.mp4 size = 96142, size_out = 96142 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\v-4HDop8QcfjvXfepmKD.mp3 size = 19363, size_out = 19363 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\vJHGxh-.png size = 33892, size_out = 33892 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\VUe3zwqA.bmp size = 6815, size_out = 6815 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\XX4thRNGxg6Fuju-.gif size = 77376, size_out = 77376 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\YPIwdbokYQ4R 4UIuz5l.swf size = 16614, size_out = 16614 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\3cM9klXep32Nuxcrw.m4a size = 67999, size_out = 67999 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\e4VC-WbG.pptx size = 22202, size_out = 22202 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\mLjbzi.wav size = 43464, size_out = 43464 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\q3vEzMh.jpg size = 44281, size_out = 44281 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\tgt23cY kRsq.mkv size = 51893, size_out = 51893 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\vHN4y WQ89shIcD.mp3 size = 86940, size_out = 86940 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\3rZJbwvUH5.mp3 size = 46682, size_out = 46682 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\8E6wl_qLQCNpnO.png size = 4775, size_out = 4775 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\d2eT4JK8.mp4 size = 64487, size_out = 64487 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ObwlO7BZUXGUQwB0pQ.m4a size = 60341, size_out = 60341 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\UCjyyB8w66Rfl6SR.bmp size = 79811, size_out = 79811 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\VzugFdG5q8.avi size = 44099, size_out = 44099 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\wHBG1 KhJkOY8rUr-B.jpg size = 7201, size_out = 7201 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\1GuphSZyRIMnQ5w0EQ.avi size = 12403, size_out = 12403 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\H4KR8e.gif size = 101269, size_out = 101269 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\xMyQQvGf.doc size = 100139, size_out = 100139 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\cBP N0kdCH8mn.mp3 size = 22638, size_out = 22638 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\vIuuzBVEyKDY.mkv size = 42841, size_out = 42841 True 1
Fn
Data
Read C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\YxwGk89V20MALzff.bmp size = 23182, size_out = 23182 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\-iMb6We3lfA1Z-Fb.m4a.Clop size = 51405 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\-iMb6We3lfA1Z-Fb.m4a.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\-iMb6We3lfA1Z-Fb.m4a.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\-uqdFL.swf.Clop size = 45617 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\-uqdFL.swf.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\-uqdFL.swf.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\-W1ANSK7kJ9rC2R Vp-0.avi.Clop size = 90295 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\-W1ANSK7kJ9rC2R Vp-0.avi.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\-W1ANSK7kJ9rC2R Vp-0.avi.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\28exXMRcr1nP4Rj3.mp4.Clop size = 70226 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\28exXMRcr1nP4Rj3.mp4.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\28exXMRcr1nP4Rj3.mp4.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\2hw0VHoOhU P3sOPU0.docx.Clop size = 12687 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\2hw0VHoOhU P3sOPU0.docx.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\2hw0VHoOhU P3sOPU0.docx.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\9rQFVz_dAB30dr89aphB.jpg.Clop size = 87512 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\9rQFVz_dAB30dr89aphB.jpg.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\9rQFVz_dAB30dr89aphB.jpg.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\AawVwHL.m4a.Clop size = 71594 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\AawVwHL.m4a.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\AawVwHL.m4a.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\AdgNJLl.avi.Clop size = 14370 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\AdgNJLl.avi.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\AdgNJLl.avi.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\BLH3rhTCDoUHvqqP.mp3.Clop size = 82051 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\BLH3rhTCDoUHvqqP.mp3.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\BLH3rhTCDoUHvqqP.mp3.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\desktop.ini.Clop size = 282 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\desktop.ini.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\desktop.ini.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\JK-lp.gif.Clop size = 91793 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\JK-lp.gif.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\JK-lp.gif.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\Jl0vZzRw qEogGC.mp3.Clop size = 18429 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\Jl0vZzRw qEogGC.mp3.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\Jl0vZzRw qEogGC.mp3.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\Jqmw2bG-TElFXFN.swf.Clop size = 59080 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\Jqmw2bG-TElFXFN.swf.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\Jqmw2bG-TElFXFN.swf.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\jzlaMjeyc.m4a.Clop size = 14012 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\jzlaMjeyc.m4a.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\jzlaMjeyc.m4a.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\kgA8vkn8D.png.Clop size = 97705 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\kgA8vkn8D.png.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\kgA8vkn8D.png.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\KZdjrOBP38df.wav.Clop size = 40793 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\KZdjrOBP38df.wav.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\KZdjrOBP38df.wav.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\LIpP.mp3.Clop size = 11796 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\LIpP.mp3.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\LIpP.mp3.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\m9Pz1Hmu.jpg.Clop size = 45608 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\m9Pz1Hmu.jpg.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\m9Pz1Hmu.jpg.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\NyBrpQ_xx-AQ74dNO8U.mp4.Clop size = 21345 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\NyBrpQ_xx-AQ74dNO8U.mp4.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\NyBrpQ_xx-AQ74dNO8U.mp4.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\Q4seUw4PucaI98v.bmp.Clop size = 33366 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\Q4seUw4PucaI98v.bmp.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\Q4seUw4PucaI98v.bmp.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\sQOzkBJ4zBYE1.ots.Clop size = 40543 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\sQOzkBJ4zBYE1.ots.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\sQOzkBJ4zBYE1.ots.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\ubOb0lDCzgG80Xvp.gif.Clop size = 18222 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\ubOb0lDCzgG80Xvp.gif.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\ubOb0lDCzgG80Xvp.gif.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\UErVBDjTS99ZAVVf.mp4.Clop size = 96142 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\UErVBDjTS99ZAVVf.mp4.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\UErVBDjTS99ZAVVf.mp4.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\v-4HDop8QcfjvXfepmKD.mp3.Clop size = 19363 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\v-4HDop8QcfjvXfepmKD.mp3.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\v-4HDop8QcfjvXfepmKD.mp3.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\vJHGxh-.png.Clop size = 33892 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\vJHGxh-.png.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\vJHGxh-.png.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\VUe3zwqA.bmp.Clop size = 6815 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\VUe3zwqA.bmp.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\VUe3zwqA.bmp.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\XX4thRNGxg6Fuju-.gif.Clop size = 77376 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\XX4thRNGxg6Fuju-.gif.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\XX4thRNGxg6Fuju-.gif.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\YPIwdbokYQ4R 4UIuz5l.swf.Clop size = 16614 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\YPIwdbokYQ4R 4UIuz5l.swf.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\YPIwdbokYQ4R 4UIuz5l.swf.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\ClopReadMe.txt size = 1465 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\3cM9klXep32Nuxcrw.m4a.Clop size = 67999 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\3cM9klXep32Nuxcrw.m4a.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\3cM9klXep32Nuxcrw.m4a.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\e4VC-WbG.pptx.Clop size = 22202 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\e4VC-WbG.pptx.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\e4VC-WbG.pptx.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\mLjbzi.wav.Clop size = 43464 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\mLjbzi.wav.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\mLjbzi.wav.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\q3vEzMh.jpg.Clop size = 44281 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\q3vEzMh.jpg.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\q3vEzMh.jpg.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\tgt23cY kRsq.mkv.Clop size = 51893 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\tgt23cY kRsq.mkv.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\tgt23cY kRsq.mkv.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\vHN4y WQ89shIcD.mp3.Clop size = 86940 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\vHN4y WQ89shIcD.mp3.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\vHN4y WQ89shIcD.mp3.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\ClopReadMe.txt size = 1465 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\3rZJbwvUH5.mp3.Clop size = 46682 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\3rZJbwvUH5.mp3.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\3rZJbwvUH5.mp3.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\8E6wl_qLQCNpnO.png.Clop size = 4775 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\8E6wl_qLQCNpnO.png.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\8E6wl_qLQCNpnO.png.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\d2eT4JK8.mp4.Clop size = 64487 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\d2eT4JK8.mp4.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\d2eT4JK8.mp4.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ObwlO7BZUXGUQwB0pQ.m4a.Clop size = 60341 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ObwlO7BZUXGUQwB0pQ.m4a.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ObwlO7BZUXGUQwB0pQ.m4a.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\UCjyyB8w66Rfl6SR.bmp.Clop size = 79811 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\UCjyyB8w66Rfl6SR.bmp.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\UCjyyB8w66Rfl6SR.bmp.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\VzugFdG5q8.avi.Clop size = 44099 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\VzugFdG5q8.avi.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\VzugFdG5q8.avi.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ClopReadMe.txt size = 1465 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\wHBG1 KhJkOY8rUr-B.jpg.Clop size = 7201 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\wHBG1 KhJkOY8rUr-B.jpg.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\wHBG1 KhJkOY8rUr-B.jpg.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\ClopReadMe.txt size = 1465 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\1GuphSZyRIMnQ5w0EQ.avi.Clop size = 12403 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\1GuphSZyRIMnQ5w0EQ.avi.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\1GuphSZyRIMnQ5w0EQ.avi.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\H4KR8e.gif.Clop size = 101269 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\H4KR8e.gif.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\H4KR8e.gif.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\xMyQQvGf.doc.Clop size = 100139 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\xMyQQvGf.doc.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\xMyQQvGf.doc.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\ClopReadMe.txt size = 1465 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\cBP N0kdCH8mn.mp3.Clop size = 22638 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\cBP N0kdCH8mn.mp3.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\cBP N0kdCH8mn.mp3.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\vIuuzBVEyKDY.mkv.Clop size = 42841 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\vIuuzBVEyKDY.mkv.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\vIuuzBVEyKDY.mkv.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\YxwGk89V20MALzff.bmp.Clop size = 23182 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\YxwGk89V20MALzff.bmp.Clop size = 7 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\YxwGk89V20MALzff.bmp.Clop size = 128 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\ClopReadMe.txt size = 1465 True 1
Fn
Data
Delete C:\Users\CIiHmnxMn6Ps\Desktop\-iMb6We3lfA1Z-Fb.m4a - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\-uqdFL.swf - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\-W1ANSK7kJ9rC2R Vp-0.avi - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\28exXMRcr1nP4Rj3.mp4 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\2hw0VHoOhU P3sOPU0.docx - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\9rQFVz_dAB30dr89aphB.jpg - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\AawVwHL.m4a - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\AdgNJLl.avi - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\BLH3rhTCDoUHvqqP.mp3 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\desktop.ini - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\JK-lp.gif - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\Jl0vZzRw qEogGC.mp3 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\Jqmw2bG-TElFXFN.swf - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\jzlaMjeyc.m4a - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\kgA8vkn8D.png - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\KZdjrOBP38df.wav - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\LIpP.mp3 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\m9Pz1Hmu.jpg - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\NyBrpQ_xx-AQ74dNO8U.mp4 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\Q4seUw4PucaI98v.bmp - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\sQOzkBJ4zBYE1.ots - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\ubOb0lDCzgG80Xvp.gif - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\UErVBDjTS99ZAVVf.mp4 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\v-4HDop8QcfjvXfepmKD.mp3 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\vJHGxh-.png - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\VUe3zwqA.bmp - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\XX4thRNGxg6Fuju-.gif - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\YPIwdbokYQ4R 4UIuz5l.swf - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\3cM9klXep32Nuxcrw.m4a - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\e4VC-WbG.pptx - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\mLjbzi.wav - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\q3vEzMh.jpg - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\tgt23cY kRsq.mkv - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\vHN4y WQ89shIcD.mp3 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\3rZJbwvUH5.mp3 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\8E6wl_qLQCNpnO.png - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\d2eT4JK8.mp4 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ObwlO7BZUXGUQwB0pQ.m4a - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\UCjyyB8w66Rfl6SR.bmp - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\VzugFdG5q8.avi - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\wHBG1 KhJkOY8rUr-B.jpg - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\1GuphSZyRIMnQ5w0EQ.avi - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\H4KR8e.gif - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\xMyQQvGf.doc - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\cBP N0kdCH8mn.mp3 - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\vIuuzBVEyKDY.mkv - True 1
Fn
Delete C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\YxwGk89V20MALzff.bmp - True 1
Fn
Module (246)
»
Operation Module Additional Information Success Count Logfile
Load user32.dll base_address = 0x76c70000 True 1
Fn
Load KERNEL32.dll base_address = 0x74f40000 True 1
Fn
Load USER32.dll base_address = 0x76c70000 True 1
Fn
Load GDI32.dll base_address = 0x75030000 True 1
Fn
Load ADVAPI32.dll base_address = 0x77550000 True 1
Fn
Load SHELL32.dll base_address = 0x75310000 True 1
Fn
Load SHLWAPI.dll base_address = 0x74da0000 True 1
Fn
Load CRYPT32.dll base_address = 0x74880000 True 1
Fn
Load MPR.dll base_address = 0x74550000 True 1
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x75190000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x75190000 True 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x75190000 True 1
Fn
Get Handle c:\users\ciihmnxmn6ps\desktop\tcpsov.exe base_address = 0x400000 True 8
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x74f40000 True 2
Fn
Get Handle c:\windows\syswow64\kernelbase.dll base_address = 0x75190000 True 26
Fn
Get Filename - process_name = c:\users\ciihmnxmn6ps\desktop\tcpsov.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\tcpsov.exe, size = 260 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x74f5a330 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x74f57580 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x74f59910 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x74f5f400 True 1
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = EncodePointer, address_out = 0x7770f190 True 9
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = DecodePointer, address_out = 0x7770a200 True 17
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x75242e70 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetWindowContextHelpId, address_out = 0x76cc8df0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x74f58b70 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualProtect, address_out = 0x74f58c50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x74f5d8d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x74f58c70 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualQuery, address_out = 0x74f58c90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x74f7d320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x74f59600 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x74f661b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x74f5e320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFree, address_out = 0x74f63a70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x74f65f20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x74f59700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileExW, address_out = 0x74f5a820 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x74f7d410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileMappingW, address_out = 0x74f591e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MapViewOfFile, address_out = 0x74f58c10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpW, address_out = 0x74f578d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = BeginUpdateResourceA, address_out = 0x74f92aa0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EraseTape, address_out = 0x74f8b350 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstVolumeW, address_out = 0x74fa3dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProfileSectionW, address_out = 0x74f7a9e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x74f52da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x74f52d80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CancelDeviceWakeupRequest, address_out = 0x74f7ede0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x74f5fbc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalUnWire, address_out = 0x74f7d1c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleTitleW, address_out = 0x74f669e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumResourceNamesW, address_out = 0x74f5fc40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x74f65fe0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenFile, address_out = 0x74f7c910 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemCodePagesW, address_out = 0x74f80d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CancelThreadpoolIo, address_out = 0x776e6930 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalDeleteAtom, address_out = 0x74f59430 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryMemoryResourceNotification, address_out = 0x74f81e40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetACP, address_out = 0x74f58770 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x74f592b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstVolumeMountPointA, address_out = 0x74f88e90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindActCtxSectionStringA, address_out = 0x74f8ca00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x74f67510 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x74f577b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x74f66510 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleAliasesLengthW, address_out = 0x74fa5940 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x74f66180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x74f66170 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DefineDosDeviceA, address_out = 0x74f7add0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemFileCacheSize, address_out = 0x74f81380 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThread, address_out = 0x74f575c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemDirectoryA, address_out = 0x74f5f5c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x74f5ee30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalFindAtomW, address_out = 0x74f52320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueueUserAPC, address_out = 0x74f5fb00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalSize, address_out = 0x74f63930 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindAtomA, address_out = 0x74f5e640 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x74f674f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x74f598f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTime, address_out = 0x74f64a60 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalUnlock, address_out = 0x74f52a10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeW, address_out = 0x74f66300 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileTransactedA, address_out = 0x74f7b220 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateTimerQueue, address_out = 0x74f80ae0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SizeofResource, address_out = 0x74f58cb0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LockResource, address_out = 0x74f57a50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadResource, address_out = 0x74f578f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindResourceW, address_out = 0x74f63a50 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x74f59660 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DecodePointer, address_out = 0x7770a200 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteConsoleW, address_out = 0x74f66920 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x74f66540 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleMode, address_out = 0x74f66870 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetConsoleCP, address_out = 0x74f66860 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushFileBuffers, address_out = 0x74f662a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapReAlloc, address_out = 0x776ebae0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapSize, address_out = 0x77704f40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x74f52db0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnmapViewOfFile, address_out = 0x74f594b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x74f66110 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x74f664a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x74f661d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x74f63a30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x74f66530 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetErrorMode, address_out = 0x74f58bf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x74f57910 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStringTypeW, address_out = 0x74f579b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileType, address_out = 0x74f66390 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x74f66590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x74f66290 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x74f66250 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x74f5c9b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetStdHandle, address_out = 0x74f826a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = UnhandledExceptionFilter, address_out = 0x74f828e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetUnhandledExceptionFilter, address_out = 0x74f5a2c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x74f59680 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = QueryPerformanceCounter, address_out = 0x74f52dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessId, address_out = 0x74f51d90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentThreadId, address_out = 0x74f51b90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimeAsFileTime, address_out = 0x74f52b90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSListHead, address_out = 0x77711fc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x74f5a790 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x74f5a080 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RtlUnwind, address_out = 0x74f59a80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetLastError, address_out = 0x74f52af0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x776f5e80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x776f5e00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x77709920 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionAndSpinCount, address_out = 0x74f66020 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsAlloc, address_out = 0x74f59a70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsGetValue, address_out = 0x74f51ba0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsSetValue, address_out = 0x74f51da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TlsFree, address_out = 0x74f59930 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x74f57940 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x74f57920 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStdHandle, address_out = 0x74f5a060 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x74f5a040 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x74f52d60 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WideCharToMultiByte, address_out = 0x74f575a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleExW, address_out = 0x74f59fa0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x74f525e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x776eda90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileExA, address_out = 0x74f66220 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileA, address_out = 0x74f66270 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidCodePage, address_out = 0x74f5a090 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetOEMCP, address_out = 0x74f5fd10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCPInfo, address_out = 0x74f59fc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineA, address_out = 0x74f5a3c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x74f5a4b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentStringsW, address_out = 0x74f5a3b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeEnvironmentStringsW, address_out = 0x74f5a0f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringW, address_out = 0x74f59a40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = RaiseException, address_out = 0x74f59ec0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = EqualRect, address_out = 0x76c9ca20 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = DestroyIcon, address_out = 0x76c8d670 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = EnumWindows, address_out = 0x76c9a0b0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharUpperBuffW, address_out = 0x76ca3140 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetDesktopWindow, address_out = 0x76c81520 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetWindowTextW, address_out = 0x76c94710 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfW, address_out = 0x76c9ddf0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetLastActivePopup, address_out = 0x76ca03f0 True 1
Fn
Get Address c:\windows\syswow64\gdi32.dll function = CreateDIBPatternBrush, address_out = 0x750e1920 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGenKey, address_out = 0x77573fd0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptExportKey, address_out = 0x7756f8f0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptEncrypt, address_out = 0x77585bd0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x77570730 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyKey, address_out = 0x7756fc10 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x77570ad0 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderPathW, address_out = 0x7549edb0 True 1
Fn
Get Address c:\windows\syswow64\shlwapi.dll function = StrStrW, address_out = 0x74db81d0 True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptImportPublicKeyInfoEx, address_out = 0x748b0cc0 True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptStringToBinaryA, address_out = 0x748c8040 True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptDecodeObjectEx, address_out = 0x748b4470 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74553810 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x745532d0 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74553710 True 1
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = InitializeCriticalSectionEx, address_out = 0x75243ae0 True 2
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = FlsAlloc, address_out = 0x75246530 True 2
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = FlsSetValue, address_out = 0x75243770 True 2
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = FlsGetValue, address_out = 0x7523a7b0 True 1
Fn
Get Address c:\windows\syswow64\kernelbase.dll function = LCMapStringEx, address_out = 0x75233690 True 1
Fn
System (37)
»
Operation Additional Information Success Count Logfile
Sleep duration = 50 milliseconds (0.050 seconds) True 2
Fn
Sleep duration = 5000 milliseconds (5.000 seconds) True 4
Fn
Sleep duration = 100 milliseconds (0.100 seconds) True 26
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 1
Fn
Sleep duration = 300000 milliseconds (300.000 seconds) True 1
Fn
Sleep duration = -1 (infinite) True 1
Fn
Get Time type = System Time, time = 2019-02-10 19:10:30 (UTC) True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 2
Fn
Data
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image