Dynamic Analysis Report |
Classification: Riskware, Wiper, Trojan, Ransomware |
d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9 (SHA256)
tcpsov.exe
Created at 2019-02-10 19:09:00
Notifications (2/2)
The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.
The overall sleep time of all monitored processes was truncated from "5 minutes" to "10 seconds" to reveal dormant functionality.
Virtual Machine Information
Name | win10_64_th1 |
Description | - |
Architecture | x86 64-bit |
Operating System | Windows 10 Threshold 1 |
Kernel Version | 10.0.10240.16384 (c68ee22f-dcf6-4778-95c5-4a862be16567) |
Network Scheme Name | def |
Network Config Name | def |
System Information
Computer Name | LHNIWSJ |
User Domain | LHNIWSJ |
User Name | CIiHmnxMn6Ps |
User Profile | C:\Users\CIiHmnxMn6Ps |
Temp Directory | C:\Users\CIIHMN~1\AppData\Local\Temp |
System Root | C:\Windows |
Sample Directory | C:\Users\CIiHmnxMn6Ps\Desktop |
Software Information
Adobe Acrobat Reader Version | 18.009.20050 |
Microsoft Office | Microsoft Office |
Microsoft Office Version | 16.0.11126.20196 |
Internet Explorer Version | 11.0.10240.16384 |
Chrome Version | 58.0.3029.110 |
Firefox Version | 53.0.3 |
Flash Version | 25.0.0.148 |
Java Version | 8.0.1310.11 |
Microsoft Project Version | 16.0.11126.20196 |
Microsoft Visio Version | 16.0.11126.20196 |
Randomly Created Artifacts
This section provides information about processes and files that were created before the analysis was started. This is one of many steps designed to make the analysis system look more realistic and prevent evasion by environment aware malware. The number of randomly generated artifacts can be changed in the configuration.
Filename | PID | GUI |
---|---|---|
C:\Program Files (x86)\Common Files\recommendation-jack-accepting.exe | #1808 | |
C:\Program Files (x86)\Internet Explorer\hazardsbusinessacrobat.exe | #2780 | |
C:\Program Files (x86)\MSBuild\tank-specialties-facial.exe | #1596 | |
C:\Program Files (x86)\Mozilla Firefox\article_unusual.exe | #1716 | |
C:\Program Files (x86)\Windows Multimedia Platform\needs-radar-underground.exe | #2792 | |
C:\Program Files (x86)\Windows NT\ham.exe | #872 | |
C:\Program Files (x86)\Windows Sidebar\vbles.exe | #2920 | |
C:\Program Files\Common Files\baseball.exe | #2220 | |
C:\Program Files\Common Files\regulatory_chevy.exe | #2376 | |
C:\Program Files\Internet Explorer\pipes reaches processing.exe | #1272 | |
C:\Program Files\MSBuild\controllers_producing_shoe.exe | #612 | |
C:\Program Files\Uninstall Information\commandsxeroxrelationship.exe | #2620 | |
C:\Program Files\Uninstall Information\tokyo.exe | #1976 | |
C:\Program Files\Windows Media Player\beginners.exe | #480 | |
C:\Program Files\Windows NT\decorative_wit_bikes.exe | #2648 | |
C:\Program Files\Windows NT\inventory.exe | #2320 | |
C:\Program Files\Windows Photo Viewer\terminal recorder.exe | #236 | |
C:\Program Files\Windows Portable Devices\explaining.exe | #436 | |
C:\Program Files\Windows Sidebar\castle.exe | #2244 | |
C:\Program Files\WindowsPowerShell\korea.exe | #2840 |
Filename |
---|
C:\Users\CIIHMN~1\AppData\Local\Temp\-mtoSNdsrEMqIKXIJgdJ.gif |
C:\Users\CIIHMN~1\AppData\Local\Temp\4b3GaiCI.gif |
C:\Users\CIIHMN~1\AppData\Local\Temp\5QTF58f.swf |
C:\Users\CIIHMN~1\AppData\Local\Temp\5eNUlFpo95gij.swf |
C:\Users\CIIHMN~1\AppData\Local\Temp\A0i7nbWiShKEtaslPXz.avi |
C:\Users\CIIHMN~1\AppData\Local\Temp\ExsdAwcovRt.mp3 |
C:\Users\CIIHMN~1\AppData\Local\Temp\FOb VysgrS.gif |
C:\Users\CIIHMN~1\AppData\Local\Temp\FTBqstMBajQ0wuJ3t.mp4 |
C:\Users\CIIHMN~1\AppData\Local\Temp\IlVm-hbOXgr7WpliH1IX.pptx |
C:\Users\CIIHMN~1\AppData\Local\Temp\L8MwkQXThny0oJT.csv |
C:\Users\CIIHMN~1\AppData\Local\Temp\LRJTpb7GLNsu8oQ_h.docx |
C:\Users\CIIHMN~1\AppData\Local\Temp\RITP CSr7 _-s1U.ots |
C:\Users\CIIHMN~1\AppData\Local\Temp\VidxC.ots |
C:\Users\CIIHMN~1\AppData\Local\Temp\WV3LHAjjDc0ztwoYcq.gif |
C:\Users\CIIHMN~1\AppData\Local\Temp\Z5WbHz9WcIhIF6i.swf |
C:\Users\CIIHMN~1\AppData\Local\Temp\al 41Q_3gXphveaT.avi |
C:\Users\CIIHMN~1\AppData\Local\Temp\bUvzBXL3Zs1epw.ppt |
C:\Users\CIIHMN~1\AppData\Local\Temp\hwrF2C1HedVgCZ.mkv |
C:\Users\CIIHMN~1\AppData\Local\Temp\ki1bwXws.mkv |
C:\Users\CIIHMN~1\AppData\Local\Temp\ltklqmLKjBY4R2.swf |
C:\Users\CIIHMN~1\AppData\Local\Temp\mkckMhQL5q9gr9AwJ5.avi |
C:\Users\CIIHMN~1\AppData\Local\Temp\sFC- 1JscwM.wav |
C:\Users\CIIHMN~1\AppData\Local\Temp\xqC4pyH.gif |
C:\Users\CIIHMN~1\AppData\Local\Temp\yrExE.jpg |
C:\Users\CIIHMN~1\AppData\Local\Temp\znfZi9svFq.jpg |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\13e7i.swf |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1P58qI3M SaAl5d.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\2h2iGjx76AD6ZsS9.bmp |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3gH7yk pNxGEuO-7l.wav |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5_ajLAhhlGKHbw 77.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5aLk1t4XlW6lJC.flv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\BE25.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Bf-XZ5Xp6-qaDizC31AV.mp4 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\EYk8-3Xq2FP.wav |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\FWttYqJtFIS0TMaD.mp4 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\LA8FK4rdYF0ss.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\PRZ05l.flv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Qj2Bjfax.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RMHZM0 Gdp7MAqyjTAG.wav |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RptNz6u ynWaZci.avi |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RxDuXNbgnOF.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\S1n9omw0.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\TEuaHd0Pxx5BwObFRqkL.mkv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\UU vx.jpg |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\XQMDIzfGXuWhuPnn.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\_dGzny0R0S.mp3 |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\atucMycdek.pptx |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\cqVCexHNJjCp.gif |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\daDWwG2N2pNJ.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\eU0O.flv |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\i9Mg.pps |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jjmBlL.bmp |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ki1LInLCB7Fc0o1.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\lSEN6RBl-v63sYBLZ.m4a |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\r5MZW4TW-NF0QaMyyq.docx |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\rwt33QW.bmp |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\uBxwQb0.ots |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vJlGE.pps |
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\xl8kXF73s GfQllvCw.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\-W1ANSK7kJ9rC2R Vp-0.avi |
C:\Users\CIiHmnxMn6Ps\Desktop\-iMb6We3lfA1Z-Fb.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\-uqdFL.swf |
C:\Users\CIiHmnxMn6Ps\Desktop\28exXMRcr1nP4Rj3.mp4 |
C:\Users\CIiHmnxMn6Ps\Desktop\2hw0VHoOhU P3sOPU0.docx |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\3cM9klXep32Nuxcrw.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\3rZJbwvUH5.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\8E6wl_qLQCNpnO.png |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\ObwlO7BZUXGUQwB0pQ.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\UCjyyB8w66Rfl6SR.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\VzugFdG5q8.avi |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\EmFSG8fVo9kfhE4JVd\d2eT4JK8.mp4 |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\e4VC-WbG.pptx |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\mLjbzi.wav |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\q3vEzMh.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\tgt23cY kRsq.mkv |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\vHN4y WQ89shIcD.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3 |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\1GuphSZyRIMnQ5w0EQ.avi |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\H4KR8e.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\5-VS 8B3\xMyQQvGf.doc |
C:\Users\CIiHmnxMn6Ps\Desktop\843Dy1Ix8Wm9w9PNS\wXmwHJbln-GpgybDik\wHBG1 KhJkOY8rUr-B.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\9rQFVz_dAB30dr89aphB.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\AawVwHL.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\AdgNJLl.avi |
C:\Users\CIiHmnxMn6Ps\Desktop\BLH3rhTCDoUHvqqP.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\JK-lp.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\Jl0vZzRw qEogGC.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\Jqmw2bG-TElFXFN.swf |
C:\Users\CIiHmnxMn6Ps\Desktop\KZdjrOBP38df.wav |
C:\Users\CIiHmnxMn6Ps\Desktop\LIpP.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\NyBrpQ_xx-AQ74dNO8U.mp4 |
C:\Users\CIiHmnxMn6Ps\Desktop\Q4seUw4PucaI98v.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8 |
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\YxwGk89V20MALzff.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\cBP N0kdCH8mn.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\RLLU ZUe1iZ8\vIuuzBVEyKDY.mkv |
C:\Users\CIiHmnxMn6Ps\Desktop\UErVBDjTS99ZAVVf.mp4 |
C:\Users\CIiHmnxMn6Ps\Desktop\VUe3zwqA.bmp |
C:\Users\CIiHmnxMn6Ps\Desktop\XX4thRNGxg6Fuju-.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\YPIwdbokYQ4R 4UIuz5l.swf |
C:\Users\CIiHmnxMn6Ps\Desktop\jzlaMjeyc.m4a |
C:\Users\CIiHmnxMn6Ps\Desktop\kgA8vkn8D.png |
C:\Users\CIiHmnxMn6Ps\Desktop\m9Pz1Hmu.jpg |
C:\Users\CIiHmnxMn6Ps\Desktop\sQOzkBJ4zBYE1.ots |
C:\Users\CIiHmnxMn6Ps\Desktop\ubOb0lDCzgG80Xvp.gif |
C:\Users\CIiHmnxMn6Ps\Desktop\v-4HDop8QcfjvXfepmKD.mp3 |
C:\Users\CIiHmnxMn6Ps\Desktop\vJHGxh-.png |
C:\Users\CIiHmnxMn6Ps\Documents\14kl1Er.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\4SQu-fJUP.docx |
C:\Users\CIiHmnxMn6Ps\Documents\8DvWP6ns6FP |
C:\Users\CIiHmnxMn6Ps\Documents\8DvWP6ns6FP\J_Vwl9NS GSlilh3.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\8DvWP6ns6FP\Pf5s.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\C9pybbi0Zh.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\Clmhq I4B3M.docx |
C:\Users\CIiHmnxMn6Ps\Documents\DsfHkC.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\8kg0IG69BiIcd.docx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\UX5mx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\UX5mx\8SX1g3.doc |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\UX5mx\E75Fxx_cgr k VZyZ3C.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\UX5mx\_H-reDrjkm WhRlTA.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY - |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\7F47m0EgZ8dZX.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE\1u VuGRqsOCB-2L.odt |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE\3KCgg__pR4GeK9.doc |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE\Km_upF9iIXS.doc |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE\Wupb86z6Pa0.xls |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\AwDQE\kIdtRNQOq.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\BkxO-9zU.ppt |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\SnK e |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\SnK e\9OrodtmjDBhJuLbe.odt |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\SnK e\gw68E5_1iMvW.doc |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\SnK e\qBCxbe.ppt |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\SnK e\rpKGMxBzvuG8S7r.csv |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\W9uW3N-W |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\W9uW3N-W\-E1aKX93RP1R2RZCF.odt |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\W9uW3N-W\AZWb4p.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\aG6cpfo6A.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc- |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\6CfoN474.ods |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\V-vBHSCHMG |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\V-vBHSCHMG\AdUtqYa.odp |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\V-vBHSCHMG\CStc4myNkSQF.pps |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\V-vBHSCHMG\VmgqdDjMR.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\V-vBHSCHMG\wkW7onXNpxl.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\XBio.xls |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\aM6z6 cgA0Quu2XuDG.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\eCi AYbWD8kQP9nkJc-\uXIZP98-W.csv |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\hi1upTBMaVjFQdLT.doc |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\iz9v0wyvDnaP.csv |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\lCYx |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\lCYx\_5KPV Mpd_NwFiLzpDkO.odt |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\lCYx\bgvy1.rtf |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\aZE8uqtTY -\lCYx\otlBHpdEhxfRKBbdEC.csv |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\eNh-BKvkTFiJI0o.pdf |
C:\Users\CIiHmnxMn6Ps\Documents\Eit kzzgSFE5N1bK8WiA\ynVCH9Q0.csv |
C:\Users\CIiHmnxMn6Ps\Documents\GmII-LgB.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\LD_X_UkqzQQjJgKTAdI1.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\Nj_573dGvcXm.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\NycH_RCh0bZXJ.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\QL9El1VrJ-hA.docx |
C:\Users\CIiHmnxMn6Ps\Documents\S1YhzhWqOh3uV.docx |
C:\Users\CIiHmnxMn6Ps\Documents\VWjfkVKtH68R-5QamicE.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\Z9plc4.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\ZEgz.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\a4Du0dq2.docx |
C:\Users\CIiHmnxMn6Ps\Documents\gTwWOFPV2SYXm4cHig.xlsx |
C:\Users\CIiHmnxMn6Ps\Documents\rauGKXkey87iDzqE zZR.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\u_H05r1.pptx |
C:\Users\CIiHmnxMn6Ps\Documents\w4npV7s7TJ2.docx |
C:\Users\CIiHmnxMn6Ps\Documents\wMy1ej.csv |
C:\Users\CIiHmnxMn6Ps\Music\8piPYcptlBDCxT.wav |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\34rCIUFwM9qcN4m.wav |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\4pDPr0y-.wav |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\8Kr7ps-rFJPwWR.wav |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\CQZU2kYru8C.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\Ccjm3.wav |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\Tj3GeedAdNiy.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\rSDLAIVloPx.wav |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7 |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\BFWrZsm78.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\D1Muduzt_rUlyemvsJQ.m4a |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\PxprpzuLI.wav |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\U3nFCBc2rdYw4-v2.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\cu1ph3CGwErEMg7rm.wav |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\f-LYZrjgEaU8RDknsCA.wav |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\lU bQtkzZSCqQK-4QT.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\sYiYP7\neunX1NaE7qHKUt.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\BeVGhqGMzLZJWj\ss5DlR_0y-.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\Bhp0golMNrXsNA.m4a |
C:\Users\CIiHmnxMn6Ps\Music\CCsUW.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\QzF7fMmnPAX1UspXI2OT.wav |
C:\Users\CIiHmnxMn6Ps\Music\XjUK7.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\lorBd.m4a |
C:\Users\CIiHmnxMn6Ps\Music\mLyzUln t O.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\peQ0.mp3 |
C:\Users\CIiHmnxMn6Ps\Music\sBwshSMWZl1CCOl938ow.mp3 |
C:\Users\CIiHmnxMn6Ps\Pictures\-pIL7 |
C:\Users\CIiHmnxMn6Ps\Pictures\Bujeen.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\PEn2SpL9GX4B3.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\a92ON6tXS3b-0BytKd7q.png |
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf |
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\24b2j.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\Dy7IEBNO7xRwaN9xgSY.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\F-nPn 203du.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\Ie-qLVk1rYuhk5L.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\Ja72_h.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\UKmJhYHC35r.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\Y9M41tsbUrdxwHTVlDAD.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\a0PIkysSn7Xp1_ SzIlF.png |
C:\Users\CIiHmnxMn6Ps\Pictures\bOFCaHtkhPayf\wJdfMc.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\cXmt |
C:\Users\CIiHmnxMn6Ps\Pictures\cXmt\9Te_uhKRq.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\J3feoRb5vhUg0kkWPDP.png |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\JICGr9nusfpGswKD |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\JICGr9nusfpGswKD\QECD50592wNNZ.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\JICGr9nusfpGswKD\sJX8t_3 |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\JICGr9nusfpGswKD\sJX8t_3\jqEpOoeS3K9JLr8.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\MSu_I.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\S0T1mj_pQUHqGfwoIng |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\S0T1mj_pQUHqGfwoIng\LmZgbb11VSFvs5ATNBg.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\S0T1mj_pQUHqGfwoIng\OE78o.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\S0T1mj_pQUHqGfwoIng\bnoXBWIDrdBzRCYnLOh5.bmp |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\pvYQth8tLjQvU\S0T1mj_pQUHqGfwoIng\lHUNW863.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\sa6ykd8hCmyAGoPEG.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\8OmI5kASi-2_gH\sr_viouXB4hTq2Xh.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\SNmk0R2dk6.jpg |
C:\Users\CIiHmnxMn6Ps\Pictures\fWgusW3dfT\mRdRtl9oi58nOnhgZH.gif |
C:\Users\CIiHmnxMn6Ps\Pictures\ie1buAANsi7 |
C:\Users\CIiHmnxMn6Ps\Pictures\ie1buAANsi7\BpV_YB3Y_d20EsN6BsJ.png |
C:\Users\CIiHmnxMn6Ps\Videos\27bKO.swf |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\5kSoICo6Wa.flv |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\7xhQ.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\ATGAksmDVhJ-I.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\FpQXW1Y-LAb8YO4vR |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\FpQXW1Y-LAb8YO4vR\EFB9kLXhIY z6QimjGU.avi |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\FpQXW1Y-LAb8YO4vR\Jhmo0ps7j.flv |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\FpQXW1Y-LAb8YO4vR\LbRqYSwSmec.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\L48N.avi |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\iq5vdAa6kn4ni.avi |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\HcKsiyeihGkwz\jyZGwzJW.swf |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC\- xXGXnYoD3B4nSv55.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC\DKLkABrmCFH.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC\TOW8VxN7d4qg-u_.swf |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC\gzaO96SZyxla E2JoW2.swf |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\K41POC\ynOni _soZgvyxoweNI.swf |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\WaX-o |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\WaX-o\A6KlRAIHTbS.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\WaX-o\b4l01u.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\3qQlq68N577STPGt\ZD1qInA.avi |
C:\Users\CIiHmnxMn6Ps\Videos\5vNb5U7n-3jWILg |
C:\Users\CIiHmnxMn6Ps\Videos\8b0wWXFjaRhP8zonR4v.swf |
C:\Users\CIiHmnxMn6Ps\Videos\KIB8.avi |
C:\Users\CIiHmnxMn6Ps\Videos\tXOm7d8FMl.mkv |
C:\Users\CIiHmnxMn6Ps\Videos\uy5ZzpXqS |
C:\Users\CIiHmnxMn6Ps\Videos\uy5ZzpXqS\0zgYnmkP7veXN.swf |
C:\Users\CIiHmnxMn6Ps\Videos\uy5ZzpXqS\X259pgWC6QIqfdB1S2G.swf |
C:\Users\CIiHmnxMn6Ps\Videos\uy5ZzpXqS\nSWv fNLEiiwv-WQJ5.mp4 |
C:\Users\CIiHmnxMn6Ps\Videos\uy5ZzpXqS\wYOJ.avi |