Gandcrab v3.0.1 Payload with Missing Features | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: win10_64 | exe
Classification: Trojan, Downloader, Ransomware

5ab28933afa89bd0924ed45538b753cd260d0a6cec76eeca30d040476cf6d363 (SHA256)

sample_file.exe

Windows Exe (x86-32)

Created at 2018-06-04 11:29:00

...

Notifications (1/1)

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xec Analysis Target High (Elevated) sample_file.exe "C:\Users\CIiHmnxMn6Ps\Desktop\sample_file.exe" -
#2 0xaec Child Process High (Elevated) wmic.exe "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete #1
#4 0xafc Child Process High (Elevated) cmd.exe "C:\Windows\System32\cmd.exe" /c shutdown -r -t 60 -f #1
#6 0xaa0 Child Process High (Elevated) shutdown.exe shutdown -r -t 60 -f #4
#7 0x378 RPC Server System (Elevated) svchost.exe C:\Windows\system32\svchost.exe -k netsvcs #2
#9 0xc94 Child Process System (Elevated) sc.exe C:\Windows\system32\sc.exe start wuauserv #7
#12 0x1e4 Created Daemon System (Elevated) services.exe C:\Windows\system32\services.exe #9
#26 0xc10 Child Process System (Elevated) sppsvc.exe C:\Windows\system32\sppsvc.exe #12

Behavior Information - Grouped by Category

Process #1: sample_file.exe
7149 38
»
Information Value
ID #1
File Name c:\users\ciihmnxmn6ps\desktop\sample_file.exe
Command Line "C:\Users\CIiHmnxMn6Ps\Desktop\sample_file.exe"
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:20, Reason: Analysis Target
Unmonitor End Time: 00:02:20, Reason: Terminated by Timeout
Monitor Duration 00:02:00
OS Process Information
»
Information Value
PID 0xec
Parent PID 0x5dc (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 278
0x B18
0x 8C4
0x 3F8
0x 908
0x 7C8
0x B3C
0x 1F4
0x B04
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
sample_file.exe 0x008b0000 0x008d5fff Memory Mapped File Readable, Writable, Executable True True False
...
private_0x0000000000f20000 0x00f20000 0x00f3ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000f20000 0x00f20000 0x00f2ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000f30000 0x00f30000 0x00f33fff Private Memory Readable, Writable True False False -
private_0x0000000000f40000 0x00f40000 0x00f40fff Private Memory Readable, Writable True False False -
pagefile_0x0000000000f50000 0x00f50000 0x00f63fff Pagefile Backed Memory Readable True False False -
private_0x0000000000f70000 0x00f70000 0x00faffff Private Memory Readable, Writable True False False -
private_0x0000000000f70000 0x00f70000 0x00f70fff Private Memory Readable, Writable True False False -
private_0x0000000000f70000 0x00f70000 0x00f7ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000f70000 0x00f70000 0x00f76fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000f80000 0x00f80000 0x00f80fff Private Memory Readable, Writable True False False -
private_0x0000000000f80000 0x00f80000 0x0107ffff Private Memory Readable, Writable True False False -
private_0x0000000000f90000 0x00f90000 0x00f90fff Private Memory Readable, Writable True False False -
private_0x0000000000fa0000 0x00fa0000 0x00fa0fff Private Memory Readable, Writable, Executable True False False -
private_0x0000000000fb0000 0x00fb0000 0x010affff Private Memory Readable, Writable True False False -
private_0x0000000001080000 0x01080000 0x01093fff Private Memory Readable, Writable True False False -
pagefile_0x0000000001080000 0x01080000 0x01086fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000001080000 0x01080000 0x01080fff Private Memory Readable, Writable True False False -
private_0x0000000001090000 0x01090000 0x01090fff Private Memory Readable, Writable True False False -
crypt32.dll.mui 0x01090000 0x01099fff Memory Mapped File Readable False False False -
private_0x00000000010a0000 0x010a0000 0x010a0fff Private Memory Readable, Writable, Executable True False False -
pagefile_0x00000000010b0000 0x010b0000 0x010b3fff Pagefile Backed Memory Readable True False False -
private_0x00000000010c0000 0x010c0000 0x010c1fff Private Memory Readable, Writable True False False -
private_0x00000000010d0000 0x010d0000 0x010e3fff Private Memory Readable, Writable, Executable True False False -
private_0x00000000010f0000 0x010f0000 0x0112ffff Private Memory Readable, Writable True False False -
private_0x0000000001130000 0x01130000 0x01130fff Private Memory Readable, Writable True False False -
private_0x0000000001140000 0x01140000 0x01140fff Private Memory Readable, Writable True False False -
private_0x0000000001150000 0x01150000 0x0124ffff Private Memory Readable, Writable True False False -
imm32.dll 0x01250000 0x01279fff Memory Mapped File Readable False False False -
private_0x0000000001250000 0x01250000 0x01250fff Private Memory Readable, Writable True False False -
private_0x0000000001260000 0x01260000 0x01260fff Private Memory Readable, Writable True False False -
private_0x0000000001270000 0x01270000 0x01270fff Private Memory Readable, Writable True False False -
private_0x0000000001280000 0x01280000 0x0128ffff Private Memory Readable, Writable True False False -
locale.nls 0x01290000 0x0134dfff Memory Mapped File Readable False False False -
private_0x0000000001350000 0x01350000 0x0144ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000001450000 0x01450000 0x015d7fff Pagefile Backed Memory Readable True False False -
private_0x00000000015e0000 0x015e0000 0x017bffff Private Memory Readable, Writable True False False -
pagefile_0x00000000015e0000 0x015e0000 0x01760fff Pagefile Backed Memory Readable True False False -
private_0x0000000001770000 0x01770000 0x017affff Private Memory Readable, Writable True False False -
private_0x00000000017b0000 0x017b0000 0x017bffff Private Memory Readable, Writable True False False -
pagefile_0x00000000017c0000 0x017c0000 0x02bbffff Pagefile Backed Memory Readable True False False -
private_0x0000000002bc0000 0x02bc0000 0x02cbffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x02cc0000 0x02ff6fff Memory Mapped File Readable False False False -
private_0x0000000003000000 0x03000000 0x03000fff Private Memory Readable, Writable True False False -
private_0x0000000003000000 0x03000000 0x0303ffff Private Memory Readable, Writable True False False -
private_0x0000000003010000 0x03010000 0x03010fff Private Memory Readable, Writable True False False -
private_0x0000000003020000 0x03020000 0x03020fff Private Memory Readable, Writable True False False -
private_0x0000000003030000 0x03030000 0x03030fff Private Memory Readable, Writable True False False -
private_0x0000000003040000 0x03040000 0x03040fff Private Memory Readable, Writable True False False -
private_0x0000000003040000 0x03040000 0x03049fff Private Memory Readable, Writable True False False -
private_0x0000000003050000 0x03050000 0x03050fff Private Memory Readable, Writable True False False -
private_0x0000000003060000 0x03060000 0x0306ffff Private Memory Readable, Writable True False False -
private_0x0000000003060000 0x03060000 0x03073fff Private Memory Readable, Writable True False False -
pagefile_0x0000000003060000 0x03060000 0x03066fff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000003060000 0x03060000 0x03060fff Private Memory Readable, Writable True False False -
pagefile_0x0000000003070000 0x03070000 0x03070fff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x0000000003080000 0x03080000 0x03086fff Pagefile Backed Memory Readable, Writable True False False -
ole32.dll 0x03080000 0x03168fff Memory Mapped File Readable False False False -
counters.dat 0x03080000 0x03080fff Memory Mapped File Readable, Writable True True False
...
private_0x0000000003090000 0x03090000 0x030cffff Private Memory Readable, Writable True False False -
private_0x00000000030d0000 0x030d0000 0x031cffff Private Memory Readable, Writable True False False -
private_0x00000000031d0000 0x031d0000 0x031d2fff Private Memory Readable, Writable, Executable True False False -
private_0x00000000031d0000 0x031d0000 0x031e7fff Private Memory Readable, Writable, Executable True False False -
private_0x00000000031d0000 0x031d0000 0x031d0fff Private Memory Readable, Writable True False False -
private_0x00000000031e0000 0x031e0000 0x031e2fff Private Memory Readable, Writable, Executable True False False -
private_0x00000000031e0000 0x031e0000 0x031e0fff Private Memory Readable, Writable, Executable True False False -
private_0x00000000031f0000 0x031f0000 0x0322ffff Private Memory Readable, Writable True False False -
private_0x0000000003230000 0x03230000 0x0332ffff Private Memory Readable, Writable True False False -
private_0x0000000003330000 0x03330000 0x0336ffff Private Memory Readable, Writable True False False -
private_0x0000000003370000 0x03370000 0x0346ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000003470000 0x03470000 0x03470fff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x0000000003480000 0x03480000 0x03481fff Pagefile Backed Memory Readable True False False -
mswsock.dll.mui 0x03490000 0x03492fff Memory Mapped File Readable False False False -
pagefile_0x00000000034a0000 0x034a0000 0x034a1fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000034b0000 0x034b0000 0x034bffff Pagefile Backed Memory Readable True False False -
private_0x00000000034c0000 0x034c0000 0x034c0fff Private Memory Readable, Writable, Executable True False False -
private_0x00000000034d0000 0x034d0000 0x034d0fff Private Memory Readable, Writable, Executable True False False -
private_0x00000000034d0000 0x034d0000 0x034d8fff Private Memory Readable, Writable, Executable True False False -
private_0x00000000034e0000 0x034e0000 0x034e0fff Private Memory Readable, Writable True False False -
private_0x00000000034f0000 0x034f0000 0x034f0fff Private Memory Readable, Writable True False False -
private_0x00000000034f0000 0x034f0000 0x034f1fff Private Memory Readable, Writable, Executable True False False -
private_0x0000000003500000 0x03500000 0x03500fff Private Memory Readable, Writable True False False -
private_0x0000000003510000 0x03510000 0x03513fff Private Memory Readable, Writable, Executable True False False -
private_0x0000000003520000 0x03520000 0x03552fff Private Memory Readable, Writable, Executable True False False -
private_0x0000000003560000 0x03560000 0x03562fff Private Memory Readable, Writable, Executable True False False -
private_0x0000000003560000 0x03560000 0x03560fff Private Memory Readable, Writable, Executable True False False -
private_0x0000000003570000 0x03570000 0x03570fff Private Memory Readable, Writable True False False -
private_0x0000000003580000 0x03580000 0x0367ffff Private Memory Readable, Writable True False False -
private_0x0000000003680000 0x03680000 0x03780fff Private Memory Readable, Writable True False False -
wow64.dll 0x59300000 0x5934efff Memory Mapped File Readable, Writable, Executable False False False -
wow64cpu.dll 0x59350000 0x59357fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x59360000 0x593d2fff Memory Mapped File Readable, Writable, Executable False False False -
comctl32.dll 0x74050000 0x74258fff Memory Mapped File Readable, Writable, Executable False False False -
fwpuclnt.dll 0x74260000 0x742a5fff Memory Mapped File Readable, Writable, Executable False False False -
rasadhlp.dll 0x742b0000 0x742b7fff Memory Mapped File Readable, Writable, Executable False False False -
urlmon.dll 0x742c0000 0x7441ffff Memory Mapped File Readable, Writable, Executable False False False -
dnsapi.dll 0x74420000 0x744a3fff Memory Mapped File Readable, Writable, Executable False False False -
mswsock.dll 0x744b0000 0x744fdfff Memory Mapped File Readable, Writable, Executable False False False -
winhttp.dll 0x74500000 0x745a6fff Memory Mapped File Readable, Writable, Executable False False False -
winnsi.dll 0x745b0000 0x745b7fff Memory Mapped File Readable, Writable, Executable False False False -
iphlpapi.dll 0x745c0000 0x745effff Memory Mapped File Readable, Writable, Executable False False False -
ondemandconnroutehelper.dll 0x745f0000 0x74600fff Memory Mapped File Readable, Writable, Executable False False False -
iertutil.dll 0x74610000 0x748d0fff Memory Mapped File Readable, Writable, Executable False False False -
userenv.dll 0x748e0000 0x748f8fff Memory Mapped File Readable, Writable, Executable False False False -
rsaenh.dll 0x74900000 0x7492efff Memory Mapped File Readable, Writable, Executable False False False -
bcrypt.dll 0x74930000 0x7494afff Memory Mapped File Readable, Writable, Executable False False False -
cryptsp.dll 0x74950000 0x74962fff Memory Mapped File Readable, Writable, Executable False False False -
wininet.dll 0x74970000 0x74b93fff Memory Mapped File Readable, Writable, Executable False False False -
apphelp.dll 0x74c40000 0x74cd0fff Memory Mapped File Readable, Writable, Executable False False False -
bcryptprimitives.dll 0x74ce0000 0x74d38fff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x74d40000 0x74d49fff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x74d50000 0x74d6dfff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x74d70000 0x74eaffff Memory Mapped File Readable, Writable, Executable False False False -
crypt32.dll 0x74eb0000 0x75024fff Memory Mapped File Readable, Writable, Executable False False False -
profapi.dll 0x75070000 0x7507efff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x75080000 0x750c3fff Memory Mapped File Readable, Writable, Executable False False False -
windows.storage.dll 0x750d0000 0x755acfff Memory Mapped File Readable, Writable, Executable False False False -
shell32.dll 0x755b0000 0x7696efff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x76970000 0x76ae5fff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x76ca0000 0x76decfff Memory Mapped File Readable, Writable, Executable False False False -
kernel.appcore.dll 0x76f60000 0x76f6bfff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x76f70000 0x7708ffff Memory Mapped File Readable, Writable, Executable False False False -
combase.dll 0x77090000 0x77249fff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x77250000 0x77292fff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x775e0000 0x7760afff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x77670000 0x7775ffff Memory Mapped File Readable, Writable, Executable False False False -
powrprof.dll 0x777f0000 0x77833fff Memory Mapped File Readable, Writable, Executable False False False -
shcore.dll 0x778a0000 0x7792cfff Memory Mapped File Readable, Writable, Executable False False False -
ws2_32.dll 0x77930000 0x7798bfff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x77990000 0x77a0afff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x77a10000 0x77acdfff Memory Mapped File Readable, Writable, Executable False False False -
nsi.dll 0x77ad0000 0x77ad6fff Memory Mapped File Readable, Writable, Executable False False False -
msasn1.dll 0x77ae0000 0x77aedfff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x77af0000 0x77b9bfff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x77ba0000 0x77c31fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77c40000 0x77db8fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x000000007eb27000 0x7eb27000 0x7eb29fff Private Memory Readable, Writable True False False -
private_0x000000007eb2a000 0x7eb2a000 0x7eb2cfff Private Memory Readable, Writable True False False -
private_0x000000007eb2d000 0x7eb2d000 0x7eb2ffff Private Memory Readable, Writable True False False -
pagefile_0x000000007eb30000 0x7eb30000 0x7ec2ffff Pagefile Backed Memory Readable True False False -
pagefile_0x000000007ec30000 0x7ec30000 0x7ec52fff Pagefile Backed Memory Readable True False False -
private_0x000000007ec55000 0x7ec55000 0x7ec57fff Private Memory Readable, Writable True False False -
private_0x000000007ec58000 0x7ec58000 0x7ec5afff Private Memory Readable, Writable True False False -
private_0x000000007ec5b000 0x7ec5b000 0x7ec5dfff Private Memory Readable, Writable True False False -
private_0x000000007ec5e000 0x7ec5e000 0x7ec5efff Private Memory Readable, Writable True False False -
private_0x000000007ec5f000 0x7ec5f000 0x7ec5ffff Private Memory Readable, Writable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x000000007fff0000 0x7fff0000 0x7ffc03e6ffff Private Memory Readable True False False -
ntdll.dll 0x7ffc03e70000 0x7ffc04031fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x00007ffc04032000 0x7ffc04032000 0x7ffffffeffff Private Memory Readable True False False -
For performance reasons, the remaining 269 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
»
Filename File Size Hash Values YARA Match Actions
c:\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\$recycle.bin\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\$recycle.bin\s-1-5-18\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\$recycle.bin\s-1-5-21-1462094071-1423818996-289466292-1000\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\perflogs\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\program files\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\program files (x86)\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\recovery\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\recovery\windowsre\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\collab\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\forms\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\jscache\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\crlcache\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\assetcache\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\assetcache\nahqnpmn\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\flash player\nativecache\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\headlights\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\linguistics\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\logtransport2\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\logtransport2\logs\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\sonar\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\sonar\sonar1.0\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\identities\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\identities\{ca8ca1bb-f2a6-4e9c-b7cc-fb56671763e8}\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\#sharedobjects\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\#sharedobjects\dqqhjz8c\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\access\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\addins\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\credentials\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\1033\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\1033\16\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\excel\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\excel\xlstart\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\userdata\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\internet explorer\userdata\low\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\mmc\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\16\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\16\en-us\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\connections\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\connections\pbk\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\onenote\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\onenote\16.0\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\outlook\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\powerpoint\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\proof\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\publisher\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\publisher building blocks\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\speech\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\certificates\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\crls\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\systemcertificates\my\ctls\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\document themes\1033\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\user\smartart graphics\1033\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\uproof\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\vault\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\word\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\word\startup\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\extensions\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\crash reports\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\crash reports\events\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\bookmarkbackups\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\crashes\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\crashes\events\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp\winnt_x86-msvc\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-gmpopenh264\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-gmpopenh264\1.6\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-widevinecdm\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\minidumps\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\saved-telemetry-pings\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\sessionstore-backups\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\chrome\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\chrome\idb\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.files\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\journals\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\skype\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\skype\roottools\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\sun\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\sun\java\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\sun\java\deployment\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\contacts\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\local\microsoft\windows\inetcookies\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\ddejn6h\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\dv-r\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\dv-r\tiny70xvq\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\no6q\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\56opooa0ipfxzv0\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\dy3xta\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\erf8\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\pictures\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\my shapes\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\my shapes\_private\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\videos\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\onenote notebooks\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\onenote notebooks\my notebook\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\outlook files\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\697f9no2fryq7uqinjkd\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\gjhxkmlsykkgxbav\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\downloads\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\favorites\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\favorites\links\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\links\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\1--8xdi7df1\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\k_vexripfdsg\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\k_vexripfdsg\gd-br4mvnsrkoekqv3me\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\k_vexripfdsg\khcadehfsq_-bqjbrwlf\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\k_vexripfdsg\msvctvzrrhie\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\l40xtt1txjimm1rw1lab\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\ok1g2ycvnekbogktj3\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\xgxniqtynb3u\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\xgxniqtynb3u\d 4ygq\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\music\xgxniqtynb3u\d 4ygq\7du38r0\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\windows\network shortcuts\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\onedrive\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\pictures\camera roll\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\pictures\emdw-2vvmbkywpg\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\users\ciihmnxmn6ps\pictures\saved pictures\crab-decrypt.txt 3.20 KB MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		False
...
c:\recovery\windowsre\boot.sdi.crab 3.02 MB MD5: 7a237f3353eda0ba828b569e686b7c97
SHA1: e801257d250983b379443f93d3170ffd9a131c1e
SHA256: 3544dc443222861738812bb749661c502e6f4e4e0c5dd4f2b5393ee9989bb3fb 		False
...
c:\recovery\windowsre\reagent.xml.crab 1.54 KB MD5: dc39c52957e09d73eed415855ac2a06e
SHA1: d17a1c9a65043eaa376558794daaf05235b18bae
SHA256: 41813e403a7ec43ae65f7505a9ff50cada89f98bc3cb4b817825d7e1f14e963e 		False
...
c:\recovery\windowsre\winre.wim.crab 10.00 MB MD5: ae08574c2b3883679f0904b58c1636ea
SHA1: 14d290d42b0eddf5f4d7ba8252ed3cc8c1b0add2
SHA256: 8bf6bc6d2ff563c444b7debec31ec94b8d95e7fc9fe1da0049281f19baa58d1c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\-aptbxd6mslmy.m4a.crab 44.87 KB MD5: 583a3dadef7630423a891a081a07c92d
SHA1: e9326e60e6ad2cf09d365158125a13f9b8b830bb
SHA256: 32f0e7c3a0247edb8980311441e00864fa08c0e486ae5c68cb1158985ea500ca 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\1gkbehrpxrolx-zy_-u.wav.crab 15.40 KB MD5: 3132a36e16468a4e1d573833c73eb652
SHA1: f009acce7fff4c75414ff9909fad57e80018cb56
SHA256: 4cb3ac1a22a95b0e1a5e20c5d7be5eda3c8ae1a80142a08dfac119d442a5bdde 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\3dl71al.ots.crab 38.77 KB MD5: fc63f20dfa8df6e60794185a7ef647a1
SHA1: 376fc4217b883bf537b43559ef96165adc9d9066
SHA256: 4b2554c99c1748baca4a1aa55834fe1974abca41499eeb302e8b12106bc642b8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\5_yssmldetbcv.m4a.crab 62.66 KB MD5: 2d9fe0a1b875f85185a8a6447e574bb9
SHA1: 89c95978085825e1abc1a2b1567e4c7008d6e97f
SHA256: dc4d8c50a4adb8d570ef11773d35eeeb2f2f00167a3c655412c41a2dc960461c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\7zmdj.mp3.crab 73.20 KB MD5: 93da27562ba93473e6dba5813c6b87bf
SHA1: b63900b0859c71041564da491735089d6ac48a7d
SHA256: 52e3a28c4b739bf46008b39b5b6877b32720c5abe54523e57781beb0a8c93f3b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\jscache\globdata.crab 0.54 KB MD5: 5971b59bc556839a308be8dacaeb15bb
SHA1: 0cf911a3b688f49cc94789a7ecdc4b121dda822e
SHA256: 1b66557e4c072561229bd10d9740fa1f0ec465cbffe72a1575c63599351dd445 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\jscache\globsettings.crab 0.54 KB MD5: 8b21b4cf96406fee7a38ee1933cfa1e0
SHA1: 602da7c4257053bc62c1ba671aa0b66235896efd
SHA256: 5a98350d39474d53c510550f6baa46d87337ed39b232b53c797186f153b74442 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\addressbook.acrodata.crab 11.15 KB MD5: 34227a6d50cd6b352846eaaee44b3d76
SHA1: a081a5ebd9a6dd2dafb44396a84320777570ace6
SHA256: cc045afab387d7c74d8558548640155475f25b08f669b028246b525a0936b5c4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.crab 1.13 KB MD5: 2bb1cfd26315d154f23396192caee26e
SHA1: cad07fb1cd33e6d174013a089546c432736854b9
SHA256: d330de106bed126a53dd30d4a3bc727460dbbfffa3a16f3b965745175e1aca53 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.crab 0.93 KB MD5: 4512abb0dfb9a50a9c7ec5299f6d60dd
SHA1: 65078a08209b1a9cb36202f8a22e73363b4a4c28
SHA256: 0cd4c85344c9ac325c3c7fb08fc3ac76723f5607b11976944436a0340edd20d0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\logtransport2\logtransport2.cfg.crab 0.73 KB MD5: f93a4f0cdb9bed63c9be4a659a8cbd34
SHA1: 58874ae581953e49fdb140e989ccb4ba97cb2d9e
SHA256: e6770a279c734bfd88677ae75db96210725768877f843003cdc2700a72d2da8d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\adobe\sonar\sonar1.0\sonar_policy.xml.crab 18.84 KB MD5: 94746141884d5add4e2a0bb81276c4f0
SHA1: 4ec93243bc2702639864dad8317e0032cc49a78d
SHA256: 5d3761ece1830ce132b0721cc5476d6b49b9055dd2a8918a0a13a6a9927f83a2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\bwtdtmskwygrcn.swf.crab 58.71 KB MD5: 12e52e23628570f93192aa091e496b09
SHA1: 506e4c91bac88f3c8577f28f8e2f3f9eeeee6ad1
SHA256: a640b2f43fb787cd84d378b05cc7f607b9011eac552dda26b1e7c7a2db40d91d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\c3frj774x4nv0skeq.wav.crab 51.65 KB MD5: e93ed9fa25f3c8256549a92da75b9d00
SHA1: f0e994ad7fd27c684d75a1ee247f3711f8851cfa
SHA256: 2931f5ff1340860279b17b6b68b137ec210a00ef346551e02d5c4d2c23ed69ed 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\cflak.avi.crab 92.32 KB MD5: 724228df3c31f939181f4ebbddaae064
SHA1: cee37b6a778704de2d260432110b5f9c2c995ad6
SHA256: ef07e7ede465bf592e568bc0bab2b6248ca0cc6381a27dc8a30d8f41c5fed3ef 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\dgarqqgdb9gtuf.xls.crab 93.49 KB MD5: 29984b1fb48b1ecc6e1fd81fef925c59
SHA1: 442f0009a8583179727c5fe85b764605b6379d48
SHA256: 9a2d50258c435aec4328907cb005f68f5506c25a2904cf653bf7e3f8e699641c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\ejmezc3s3hpf0.m4a.crab 51.10 KB MD5: 6bcd11a61133b89de99274d5eac167fc
SHA1: f3b5f03966c5e4a326301db1e256417bebdcc6ca
SHA256: 929abbe1e3a5f83ddaa06804e74693c24285440995a016d99f2081d1bafbf410 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\ih3vihu3-9reh6aq8.bmp.crab 91.21 KB MD5: 9c1dac470754fa49573fb915fd54b351
SHA1: 510345554a658e1b7df5341117543638fbbc5674
SHA256: 0a152b8ac4d9d18f55f8b12eecfff893b97f436605f3abacd926fe684c8fbe83 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\ipqxaxhkprttgje.doc.crab 14.30 KB MD5: 52698fa61fc66b11d63381ec69927515
SHA1: 03855b9f022823a658496ff18745583f262919a8
SHA256: 1f8d6c945d9ca14b862e6184c239d7831b586cf4f8e4871a82139428d8f483a3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\k5j5al mwprjcswi.gif.crab 56.34 KB MD5: c3fb66979fd7258ced16b3f8cbba56ca
SHA1: 0bec0f04ec6741ebb8f2359721b912e02b94d053
SHA256: 6b08e47745401dc64dba856d7dd823e27c4ebb27441445a41d0fdaa5d1443c8f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\ko3t80orcuc8i.png.crab 39.66 KB MD5: 9f0f0dc3347f63fb85b3251fa1d31ab7
SHA1: d7527512b4b9e717cb59b5ffb37b09a76d924283
SHA256: f8e34c2bb6a72591f5dddfa6d1987f453476556842d390ade981a11355e6f2ec 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol.crab 1.01 KB MD5: aa9f9ee029748e2ffd8f865c364ae96b
SHA1: 8b34899838bea117e55f5b1af5e9598c94967002
SHA256: 1c1095671b54dcb381960bc834df40e7200e30305caae871928a6dcd9a3d90c8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\access\accesscache.accdb.crab 196.51 KB MD5: fa0560113bb33e26e312cb23afc5077a
SHA1: 847df324fdedc581f0cfb9efeaf7978f856a7037
SHA256: ede6ae6725bd44cdfe9d806fd26d741069f9891d018c24cdf2b5e5a4a22dd2be 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\access\system.mdw.crab 124.51 KB MD5: 63d0cbd88501fe22e7a2d27141393108
SHA1: 4635728b4b99f208e6f1f8d3588f39534fd31e96
SHA256: 7242ef6f910c9b52891b3b667197f391929a78064914a96ada374d63624f4030 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\apasixtheditionofficeonline.xsl.crab 326.30 KB MD5: ba8f18b6a05b23a14ad68547fbd41794
SHA1: 8d5c96b22b30a795058f3ee107a2300a536668fc
SHA256: f80b7d1c5f7921e64b994e38f6b3fa575e73ce397bbacf9c2ac821045e140099 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\chicago.xsl.crab 290.57 KB MD5: 0121bbe8e6f8886e57cfb52c697cb654
SHA1: 5352a988c5a028b3519216c35c917f87f5eb0f0e
SHA256: d956fa9d01a7df1c881fa3fc5a3bcace0409ccc13bd59ed3fbc6fcebb7a9ebcd 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\gb.xsl.crab 262.88 KB MD5: 5dcc307d4c773293d2383967eac29d78
SHA1: 948dd602adcb5461b779791eaa001967c7eeeb8e
SHA256: 34be2d4f143edbc8e9248001d3c3fc1cdf4ca057fd5626c043223dbda3c6ece1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\gostname.xsl.crab 250.87 KB MD5: 9d7523d8985ea32a8aa8b013ca645ec4
SHA1: 3659133c2c0e585b4452bfb101e817b9cdd66539
SHA256: d39e58b74548bf14946a00b2a09b311f04a1cff9ebebbe978adbd8dfd1756959 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\gosttitle.xsl.crab 246.07 KB MD5: 12ee407530c9b4a877565e079b710c5d
SHA1: f13f8cecc0447a4ffd13cad3079cb8fb083ca31b
SHA256: 8096feac8437c40a9b4a6b3fafe3b374101c0e70ad9ceeb2062a45273f27abd4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\harvardanglia2008officeonline.xsl.crab 278.65 KB MD5: 6952adb611a7ef508f3184c6a7264b01
SHA1: a30d1d1936041402f252cb1ac14cc498e8129b26
SHA256: 84bbfbdd8f367299b315ba0be6e468f4a5f0871599160d6c385792f3f760b165 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\ieee2006officeonline.xsl.crab 288.13 KB MD5: ca4049199db257aab955ef3312c1a79f
SHA1: 3bceeef2e11c9b9f754fbcde31d3a30256e195c0
SHA256: 75d3d90a08df23c1053c742953644d5667386d60f3851aad7f9d5cca1a338bbf 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\iso690.xsl.crab 264.82 KB MD5: c8c39e0104c423d2d562b21186ad7fe1
SHA1: 8fc58eb2e0dac80e280cf7efb907c519bac6fc25
SHA256: a4ae3b9b8cb0d292f7b93e44f24afa9bbb07a9ca6b9ac75b19d200ab5ba93ee5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\iso690nmerical.xsl.crab 212.99 KB MD5: 129d0f4605cd5f7024ac35f90f5c036d
SHA1: 6306fcaba6b2b38c91815b685ac28168265ea0f2
SHA256: d6789c64b49f1041a6cc5c5c4af92c29f4a14123cd5177f27d4e068da2df04c3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl.crab 249.76 KB MD5: 9fc561b2c0e5332544c6bd652ecddc2f
SHA1: 78f3b83d07ead8c840a219076ff671e475bb4446
SHA256: 53170f4ff70ab69238146d534d498ef2b1487b70120c7ee159b721380c922dd3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\sist02.xsl.crab 245.96 KB MD5: 91f9e6ecc04e0eeb217f9d48be2e873a
SHA1: 174efc8cc3872c7aa59a249710b0698b4cc52699
SHA256: 366ea2dd7f29f447e2e2b25528a9b8ed9b8a2f949fb25ebd98f519be8b5db17c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\bibliography\style\turabian.xsl.crab 337.10 KB MD5: 1f9c0fe0579361aaf6ac60303b8a8a76
SHA1: a1b0fa2b0ea32b26901c243b10a59a247fc8d668
SHA256: aeb6b5b260f3e76270d2ec5dbf0388e7eacc9414fa53f10e217f2e3fd2db1193 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b.crab 0.55 KB MD5: 32f2ac69358d5256c9da1cf1825aac18
SHA1: a2bdd9452161218f3cce7a90f064fa813f2e20d9
SHA256: e58a4d8d61e1401c080f86049c3a1e4e5d1084c6e9bad5d180b3d000e23826fb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\document building blocks\1033\16\built-in building blocks.dotx.crab 3.53 MB MD5: a09db423aabe07a2144556727a30a733
SHA1: dcbc3a583897a32594434fddb6ef96a172d0b0c5
SHA256: c10e1056a19d03dee8cedf2ce1d0c6731f520cab14147cfedefaec91782711db 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\ms project\16\en-us\global.mpt.crab 1.21 MB MD5: f80639740213b70cc82901d070058c46
SHA1: f1f4e665fd3657cf41597ce746a561f241bb957d
SHA256: f5390595cdc16f6af4988300aa1665b9d040515c0e2469d23d5c5591669dc60a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\mso1033.acl.crab 37.37 KB MD5: 5445cbc5c3457cc68430930abd56b56f
SHA1: e2e1ce911e40105014c95afba8bebbba0b47be07
SHA256: 4efd505503b4ecd7afef328164608d2a2f01fc84b5add19b37c5ae8d59686f0e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\database1.lnk.crab 1.60 KB MD5: bbfbde78010feaad99c9195a01baf5df
SHA1: a5a7654e9b76f38081d8162874ee7ecff1ccedea
SHA256: d75a379001e9bb16bb05947ba85bc7502a53c84f7b4be6b6d3d8811d38f0d268 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\documents.lnk.crab 1.45 KB MD5: 38f4c976087be3fcebca818eb9a6bfea
SHA1: 0f3a464427f93a5b6106fefcbd5abd34b8a83367
SHA256: 8deb742e6b4e75f6d6b289d7611221dc9c260fbc104e88073d74c9f9be3e0fe5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\global.lnk.crab 1.98 KB MD5: a9e5007956f8e6611fc385909235c485
SHA1: a1acef7af57029fc7825432ffed8222543c95779
SHA256: 65af3a524247900cbe04a09c0e7463006ef6e6dc2cceec032b320cea43dad7c5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\index.dat.crab 0.60 KB MD5: 4f65a217f53a60f6455d22cd60e4ef42
SHA1: ffe11e64857ce12a2c9ddbe7f949843492610d5a
SHA256: ee95b4062d0775aac6b258425875b1d6d67938d4f4e3ccb91ddc642338b91321 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\office\recent\templates.lnk.crab 1.68 KB MD5: 586ef55e59a7ca4338fd1dc8a3f01ec8
SHA1: 5e7d0d00b4348b973c9e21254b75e5562abfb8e8
SHA256: 8861c2a663a5ae5f090379522c0f17e8f364b122fb9b884de69bfb1b261f9770 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\onenote\16.0\preferences.dat.crab 5.57 KB MD5: 8178e39fc9faa6fe97cec96e389729ad
SHA1: f038c1f100873d9fc34d918132999103459fbe81
SHA256: 5668c45de866dbcecb51bd44aeb1164ae49e57419cbede1d15b87597099d4e66 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\outlook\outlook.srs.crab 3.01 KB MD5: 5ce327e7ebad5664f914562465458041
SHA1: 4d63fa605322a37b5d00457462d0ae2650790b88
SHA256: a4e27551459b1b86e0461161d1fd3e77a7a81a95e920ae4e8cfbff35512319ec 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\outlook\outlook.xml.crab 2.85 KB MD5: a54dd2b99afa5bb347c142838bce7143
SHA1: 43e7ab2e241751026437ed257a5fef4275ae76f3
SHA256: a48fe4480b036e8dfb56ad4750be47837eaa998a9c829999ca03c3d286f2799f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\credhist.crab 0.96 KB MD5: 94c6f8d5796cac3e2b87456ae08124d8
SHA1: 8ea11e2b548bc166e506b351ed6f421baf50f57f
SHA256: 59ab347e3ac4c0588dba54cdcb09355a608f442c1c64f8a6c53755a75fa34cfa 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b.crab 0.98 KB MD5: 714111163eb7dee39f31674929a121dc
SHA1: fbfab7415f4e25f031a6d5083beaa60ec1810dba
SHA256: 8c9236d5b2685e5d81a2231431574302e8c23335b7ef87a6d050e933c497956b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415.crab 0.98 KB MD5: 39d9cd7a681466e9632877e178c76229
SHA1: 2cd481d5066502957601604484e64318be6050b7
SHA256: ba745bba7f10fb7353ac431b8c7bd247304dd76eef031636eec8fa28dc35b834 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a.crab 0.98 KB MD5: b3600e1ce88a4cfa4717247de9b88225
SHA1: 703c68131341b92510f13b086cf0c01f1db5051b
SHA256: 5ddbd6b7b40c2e727b6f1b3362df989b01303bc19900f687e800c79e39f95549 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\s-1-5-21-1462094071-1423818996-289466292-1000\preferred.crab 0.54 KB MD5: 4c4a1c6dc0ec7ecbc8e2e087f2157688
SHA1: 2e066153347208406d64306025d9cd9011c9e55e
SHA256: eebb56bb0c9c63992761edd8fd235b75331d5ad5b4fdd05b8afdd365cec664d1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\protect\synchist.crab 0.59 KB MD5: 36c1d663bd5801ac1b12d0af9db8baf0
SHA1: 608accf06c927d5b9b33253672fd691774c464ee
SHA256: a8f02f8756067f38ab90748679c397d48d2c7659bdf5e32f7c511cd06cced221 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\publisher building blocks\contentstore.xml.crab 0.68 KB MD5: 06eee960819f8a9688611ede73284b32
SHA1: f721f2a1259cd7bf9ef13bbc68b2cfa47dee713b
SHA256: b8981125eb847228ce339829f91c5e3bd3f48ffd64f1648c5990bce088a7e4a5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\calendar insights.xltm.crab 893.37 KB MD5: 842468837f062f32445c06554d8c5574
SHA1: 6d1ba43287d65ebdc098985f330cdfa6c4d0462e
SHA256: 1fd96b3dc53842b98a31ff79a4d74f02c72b6f5ae42673a2ae2777a5a9c9e39c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\cashflow analysis.xltm.crab 371.62 KB MD5: 8fca4fe1f3372cec5d4fcf742ea19db1
SHA1: 4d44912441803eb977edb8d85e4aa31abeff0a7d
SHA256: c61e63d17424025817956b69d3f900c0cf58e3ec2547af27c8aa606db0b8fce5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\email insights.xltm.crab 721.29 KB MD5: a50e98f4bb2cd2cce1bd94d0188a721f
SHA1: 3a2334a9f3a1dfd4cb9b7d073b570a8665f30986
SHA256: f2ad3c3d65a67672045ea0448f1bdfe51083dab1726febe7d6cb859c61f755a5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090430[[fn=banded]].thmx.crab 549.46 KB MD5: 86e082eee32083e1be8df352dfa86bd3
SHA1: a1632ff965addd6314f0955862349ab767df1c52
SHA256: d265434f3141ff932c060a90e95ca721caef34497e4d177bc90eecfc7a391751 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090434[[fn=wood type]].thmx.crab 1.57 MB MD5: fd0833c65b7aaf89009e9225f52c08df
SHA1: a73fdbdab8602d567f4ab782b5357043bc0973b5
SHA256: 394c0c8c1c7bebfba8311c74eed6ce9f5678029f7b342f0101c3de1f795c26f8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457444[[fn=basis]].thmx.crab 545.48 KB MD5: fb03d4ed845feb857f7db84910505aa4
SHA1: 8aafb68b01b020ae5be3579cb17ace79b2bde3d5
SHA256: 4caf33b73563efc1b1dbc20fdc04efaaf1efec68b207f266809104b47e8fd7dc 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457464[[fn=dividend]].thmx.crab 558.04 KB MD5: 1d001384dc307a282f7f9ce4f1b280ac
SHA1: 96e0784cce10a59d837692ba001e5a91b4a1b841
SHA256: db6938e94e483a15f5a4b9732efce347a9442d7735afee6663bf1b8f8e2a5301 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457475[[fn=frame]].thmx.crab 511.30 KB MD5: 4cd54a20aebb59d3d0143c6a4e93db88
SHA1: 278544969ccfecd05b19ae5b7cdc8f221f848666
SHA256: a537fae644cd228a616ebd1db271c5e3931fe5e79a6af3ef5ffa0a719c064e82 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457485[[fn=mesh]].thmx.crab 2.94 MB MD5: 5bfb01c440a9c92b3b84508fd06297bc
SHA1: 59cc933e39b346ec7f59535701d88d3fcdb765fd
SHA256: acd57056448d799ad3520bb1e11b3bfd69e8d304e8addc4a16678b94d9440b42 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457491[[fn=metropolitan]].thmx.crab 759.93 KB MD5: 8cd98dc1eba44e673704446e072867d3
SHA1: cc8050d6ee99245faa8fd8955abf5ec61f5a5806
SHA256: 39fb6d9ac94d65fec16b42948a7bdb8fe589ccd0d64dc9690315437f8568a919 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457496[[fn=parallax]].thmx.crab 903.52 KB MD5: 928ec0a723c4013893fa261cb9bd0b0f
SHA1: 3b364f5a5ee4c457229bde0382b220cc53da28b3
SHA256: 2271473b6d10e966941703ca4fedefc7691d3472b0ce2859ccc2ecd626ee7d17 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457503[[fn=quotable]].thmx.crab 944.80 KB MD5: d5b4c75d9c3f2c28344576f5f02081bd
SHA1: 50427fb75a8e91fcc42189c8db70897516a16e9b
SHA256: 27b8968afd9cd9129c13f3f5e8b42d1882a6263d62be6148be2e6c03fed5596e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457510[[fn=savon]].thmx.crab 1.15 MB MD5: 78bda11eba6fdf1517dc3a6bfa247a9a
SHA1: 3cfdc8019660b74c4e894cb55315abd9ca97bfba
SHA256: 29eb80de4546a842ccd53883be6897914b6c3b055c0738f2ccf2e5dab34d1cf1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457515[[fn=view]].thmx.crab 475.71 KB MD5: 52f18fda0b5b234c1f7b003702f6d4bc
SHA1: 533834ae4176c0eae740b20e9907a912ee77d8af
SHA256: 8b88277b80623c9c74ddcf9a08f63fb6da9b166fe6c5030ed61a2f28bfc05a24 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033917[[fn=berlin]].thmx.crab 953.65 KB MD5: 24e024453f69e6813df95c87687a21a5
SHA1: 0df68ef41d5d45a656aaa8ff7dad3b5956c6e8ab
SHA256: 9a35feec26280d0b89f8113c11a0ce26e896deef1e90bbdff945e77c3bc39bb5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033919[[fn=circuit]].thmx.crab 1.40 MB MD5: 8bafea3c8320025ee91c1360ee00caa8
SHA1: 77f57defb83af2b1af214f0a1d5253c8f2213b47
SHA256: 6752e2dc7438c095680d8cb82ea067af04acfcbacf1fb610fa9fd5f90ba245a8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033921[[fn=damask]].thmx.crab 2.12 MB MD5: e455a48bdada7906ccec075386e64b8c
SHA1: 57112ae6451b033de25b1d6b1469c917ad09eb12
SHA256: 9f17408c42a62f76463d0c0b8298c13bf07f3dc393ccc971d451504bedda19c1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033925[[fn=droplet]].thmx.crab 1.67 MB MD5: 5267f8cfd9af76b1393875ac7ed86c4b
SHA1: 9772def930ad384a1c4bdbddb13e948e7f6fe8e6
SHA256: 1c49d567b12e75d78bbc8ba5fd83ba5de2765e79533cfbb0646e908db5bb3ae6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033927[[fn=main event]].thmx.crab 2.79 MB MD5: 18f19d8d613437939217bdcdae08e2a3
SHA1: 4c9a16c978939b6c84869fcba42639b2da80bf04
SHA256: 06d6e7090925e85a311779964ef1f1ec3707ff7764ae4164ede7e5bdee578f70 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033929[[fn=slate]].thmx.crab 2.25 MB MD5: ee1c6c42eb0f55bd4921f41b52d7e79b
SHA1: d35ef94b566df927fc9ce0653025d9ba4e43cf8e
SHA256: 2cfcd8297bd69a788c19a30ec12dfef4039d28d3ac76afb56678a90e0f23ba26 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033937[[fn=vapor trail]].thmx.crab 3.44 MB MD5: fcaf31dba2b99cb94558367a182385c0
SHA1: 91738892dde7e63eeafd9a758a93b50157e46934
SHA256: 21d1a19393560ca87427cf4a7bd6add9cc94ca7fd3c5674d685722dab50d4575 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001103[[fn=headlines]].thmx.crab 527.48 KB MD5: 0cc1925a90afecb3c50ce06a16285674
SHA1: 396a0a67ebfdea4cd003795f15307a1adb3d6f4b
SHA256: d2ee8b92788a45a18040a6c7d870e6835e0c911431e1fcde351e29c2e60d8515 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001104[[fn=feathered]].thmx.crab 1.96 MB MD5: bbf9bff46b07f1a384da31b090c5aca5
SHA1: 23136dc7dd8995717b06624258a42a470b77f0fe
SHA256: c56b3d53a053b8a5f749253ed1c4f1fedf8f159d4491b3ec718e0d33e0ad4e51 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001105[[fn=crop]].thmx.crab 524.54 KB MD5: a5ea3ce0df14d92c8b96406276ec56bb
SHA1: cee0b4a7ed25b9691dfb408d9e53163a4f64ffbe
SHA256: 44233fa1bf820e30445ceee83e16e0cbe9819b13901c0b972ef12bbf893c80d0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001106[[fn=badge]].thmx.crab 648.90 KB MD5: 6657f5cc0e414a88fbd31d5b82071b66
SHA1: 77a10f7fbf240be6c3ea353658a87697eba277cc
SHA256: 31493ac0eec75e5e0e2a5580e7bccc5f6ed9a6f9fa44a2c3c97dea229e4ab88f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001114[[fn=gallery]].thmx.crab 1.04 MB MD5: c73534bd0f2a14377effa69b63a5f7ab
SHA1: db2ada098b25a1edc515d3079ba16a5d3411ad71
SHA256: 3155069ee95f22121c9efe95f01b96c3e5ab5162dff2cd30c8d76a5aa32b97ce 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001115[[fn=parcel]].thmx.crab 594.38 KB MD5: 4880f6d7890b69774259a39326b57a0c
SHA1: 1f2d6d6e178ee47224c3f08749e19585e1dec8f6
SHA256: 6ea6b4b1b9fd2b393ac1c7c1a79914aeeaeca9ce097062c25649c31d59625356 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328884[[fn=architecture]].glox.crab 6.16 KB MD5: f6b755ea7ac5e8cee4a1e356843f26aa
SHA1: 45f8d3fc958f3de3e73d640c8071cee46ce19439
SHA256: 0631e6d87c8e089d12a5696f8a58fcc6456d98962b23f436c9660f5f0965c40e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328893[[fn=bracketlist]].glox.crab 4.45 KB MD5: c9ebbeacc62efd6c96e4c05cefb63e7a
SHA1: ea0855617dc05f53fdbe9be62d1aced541020dc9
SHA256: 1e2641705a5925a4a7e137dd1a316a9df20e33138835a13d942d991d2f4b67fd 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328905[[fn=chevron accent]].glox.crab 4.66 KB MD5: 83ef0b40d45b6a8d928db78e32673cc7
SHA1: 96ad59531390f6d18533349ca86edc031237d887
SHA256: 2b6962a434adec11ce8f9acf9b87fde754fc767a7ed38ca04c945d1216ca57f3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328908[[fn=circle process]].glox.crab 16.93 KB MD5: 36075fec09389bb7fda996f55544cf95
SHA1: 16a7716059eff763028e5ee17774a2eb2ce979cd
SHA256: a6af012cf9854082c8e4254c9a6dbed4c75bb8f7b8ed7ecf107ca869b2fd8d69 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328916[[fn=converging text]].glox.crab 11.63 KB MD5: 7dd4534d944b1fa534d125296a95bc0e
SHA1: ccdf12ad2a9a97da26015975c57dd90372602af8
SHA256: 9643dfeac89ae010f86ba828ae656a8401046bae81f0ed8c131b8b853b625483 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328919[[fn=hexagon radial]].glox.crab 6.40 KB MD5: b5f7c983ef7de25713235b2c235e7fd7
SHA1: 7f775c026fb9da452d755ed80e9f5dc77e0db6d2
SHA256: ddc6e8cca7f3d5954b46ade1abd7e756db7332d2019c5c8181cfde45d256832e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328925[[fn=interconnected block process]].glox.crab 9.49 KB MD5: 5654976076cde2657ff2e5e8f3939427
SHA1: a44803300ba742ee6105e755a901b7b93fc19142
SHA256: 97e4e3242574e7de5d375db2b36e63a0334152bec984eda777c1a151900b6e44 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328932[[fn=picture frame]].glox.crab 4.74 KB MD5: 0bb770c9d4774b2d38d000ed65aa0cec
SHA1: a24286a21f8a6f9ad0ee49eed69231ec22b24843
SHA256: e7a975912a0156115c579d575b4e02583eb0f34bd964c92545c863992eb215be 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328935[[fn=picture organization chart]].glox.crab 7.71 KB MD5: 6afcdbad44a5a6a76d26e7c5b3dd3e94
SHA1: 9d3debad397458050c3be2d46f64f88913d1d71e
SHA256: 4941eeed6ea88b836397dce777e3fadbdb103d35ea5db1aea931e23ab71f0354 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328940[[fn=radial picture list]].glox.crab 5.98 KB MD5: 5aa76febc871f654df6cb08b60fa99e2
SHA1: b5d350d5b0d8c53a5a07cad0ffbdc7b005218ec2
SHA256: 8180ec64cd040ba7ec1e622d3eb481b5b4f630a7d2ffe20a0d5f7f62a6b402b5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328951[[fn=tabbed arc]].glox.crab 4.12 KB MD5: 65e6cf1a8c54230088bb938773405426
SHA1: f7ac06de2b0be809d6204c56c00a4afa2f28dae6
SHA256: 34fd979565a87b4d2d649c23e3a3bc625628d62658ead8c8b96932b46003880a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328972[[fn=tab list]].glox.crab 5.29 KB MD5: 85dda123329df52ff4e52466fa588ced
SHA1: a75311d992ed4e2d0746ccbdb763f06ed78584aa
SHA256: 555677beb49c1663a7c269af083cd71c54f67d0e9ae5f4b18db50ca06e356bcb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328975[[fn=theme picture accent]].glox.crab 6.80 KB MD5: 83344bf047f246cd0538a76a17147c35
SHA1: 9a58321364209d992e5b853c9f4d4231a52ba63f
SHA256: 5f130900f5944f4c519f9692bf7d4084de3a6e81b15a19563d0c217b62df2623 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328983[[fn=theme picture alternating accent]].glox.crab 6.01 KB MD5: 9edfdc88dc79c8adca80b5362a0265e2
SHA1: cf794ee2481c22b225d571f70df5943a5a6fe257
SHA256: 4f9c401408a73cd6248fed7c39a951381f431ccabe9abd90a22a6d2e5c812fd0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328986[[fn=theme picture grid]].glox.crab 6.57 KB MD5: e4471121b10a715bf35399c1de6fe60e
SHA1: 2322847e2bd89ebf5dad936805399912db2b5034
SHA256: f29ed287db5cb6251cf98442e31db8b1fb152363b5ed6114af436a4f174fd1bf 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328990[[fn=varying width list]].glox.crab 3.52 KB MD5: 4adcbe5e1fa692c59ea73d94cdf7b5a2
SHA1: d0a89eb3711fe53176c7d962f21d9cae3a1c2f55
SHA256: c932841b400cb2e8f01de4d5f3009429b01bb7210b7b343ce7669d2bd56d02f5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328998[[fn=rings]].glox.crab 5.54 KB MD5: a635d36a9623b5ea3455ee956a3fed09
SHA1: c79f89c2b4f263971eb7be147d51d35c30582a1e
SHA256: c004618411d4e2a594a68676833085d2ad004f14383abafc9bac3c1a34e17221 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\normal.dotm.crab 18.93 KB MD5: 500494dfb2a84218fd54c509f05bedb3
SHA1: 78a7236218810c405e16fc3b227a993d83f061eb
SHA256: 092899f4adf993da8f5c8b7c740f039650b5210340ea4073693d6b3e502887e9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\process map for basic flowchart.xltx.crab 107.88 KB MD5: 071e5d5b2cbbab174dc94a721f89b2f3
SHA1: 18efafbe4db846e2f204d02b71ef9f2cb1428dfc
SHA256: ba0d11267172c3e011821255998bf3e0707596428f6bd2b35365fade79d201ae 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\process map for cross-functional flowchart.xltx.crab 141.85 KB MD5: 7f84f3039b570a9668a08feb0573a9eb
SHA1: d7c5e5aa05f67436d578d9b44ab8388541177e7b
SHA256: 43286bda965eac64fdc5f3e0bd9d7da877a3e7a86e5cbd5cf70ec3ce73d9b6bb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\stock symbols comparison.xltm.crab 1.39 MB MD5: 80a8ed120c5705e3b5e4dcae950c7cc1
SHA1: 518067a411553056ef31818b64b46e02b75e94df
SHA256: 723195e4abbdb674bfe04910d743cde71356db916b4aa0e8c1b352c51decc832 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\templates\welcome to excel.xltx.crab 483.66 KB MD5: be4f416dbb59388d7964acf84873057a
SHA1: 07264086dde5ed2253bb08ffe2cbbf54c190369f
SHA256: 36dd1a2c16358c49e28bd6ed1a49343f3f33ded706da3f1a3e566cf6962fd180 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\uproof\custom.dic.crab 0.54 KB MD5: 205991c7044a18c1897a4bc3e0abe2ab
SHA1: 608ad4cefb3fb2bdea24e99fa62351d6d5e0d11e
SHA256: 7ea3212621727fd7f8651ad6dd41311b853dee615e9d1e348382a6d7f643ba54 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\crash reports\installtime20170518000419.crab 0.52 KB MD5: bd97594df01ff447d13b7e6dbd591da0
SHA1: 8e6571bf3225ca0a8216ac39f37daaf9dbc741d5
SHA256: 2100cc2529c623bae3f079db819861e33491fa1702272b06a403d3df00e29a16 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\addons.json.crab 0.54 KB MD5: 435f9c0929e91706e04dae72b716dec3
SHA1: 8ec01e8a22a63885a30c9f6f45c450a6e0d59571
SHA256: f8a4278cb11f5426bf59bce9a0efd390b25d2507d772b3a530b91b52aa6395f0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist-addons.json.crab 450.02 KB MD5: 91a7f3fbaa34fc46dc5e5283ea5a3a8a
SHA1: 44c7b69a9f6e7ab0c0aacbc668fec3e3b3488747
SHA256: ea335046ad34c2cf7632ec76f75a6229690a2f1f2adb6ad5491de80f03dbbbe8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist-gfx.json.crab 27.82 KB MD5: c2511b5f91c88b5c98894e19edf4cdc9
SHA1: b927df73903416a55a9ee4e9388f0cd415da9dc3
SHA256: 8577e81405b7e93c2fde0542ddde34e2eff0ee8e8dcbfd2d34d956731787158e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist-plugins.json.crab 197.20 KB MD5: a9356fd30c50208eaaac4b1c1bfc1b22
SHA1: 4d56ca1bb086c0a7b4bdc223f2baec5c578fae89
SHA256: 5d4e19baa26719a902ab991f48ef97af08ecdfd422bfa648ad4183b921263489 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\blocklist.xml.crab 252.41 KB MD5: 98f25c168a81519fa9a29f6e0d777ebd
SHA1: 22f08a035830cd38c6bd15bbee0785d3d2f2a3db
SHA256: 5b375f2ee9d66dad23c87a3d8cdf2baeba9d0e47d7cf54117ac675aa9b825738 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\bookmarkbackups\bookmarks-2017-05-24_14_kl0o5i+exwq3txuldkmf9w==.jsonlz4.crab 1.85 KB MD5: 2fe1ab114999af028da3566ba02ef660
SHA1: 93aa593318ec1457c084b0803d28451b488b2315
SHA256: fd1e4e3cbb4098e47b31341380e387218ce2c7b0acfca31665d1adea00c63c5a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\cert8.db.crab 96.51 KB MD5: 26f55f63d3715f095f2d3c5c6a81f335
SHA1: dca023705873fb2a30232880bd6715abe4779188
SHA256: 9f5747c7fad2984972e634dbf0a00602c1a1f6ae4a9b4cbd8aae3cf715a335d6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\compatibility.ini.crab 0.71 KB MD5: 2f980aa895480e758f5b298dc9e1688d
SHA1: 2c9855b0c1af8ae2676a7b0574fa9300f7fbf3f9
SHA256: ce42fa72bd5a852d4e392568498edf404ce9fd01b0e0179345f66fc27e30b3d0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\containers.json.crab 1.30 KB MD5: 600d00b8aed0da38ffdc0f1e0162b345
SHA1: ccae71275da389472d87082b7b81178dc691f3c8
SHA256: a891df39338f1a1cb6a9de58db53e49a8cdcfaa58fb23626017b17c58bed41be 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\content-prefs.sqlite.crab 224.51 KB MD5: f824e422c784735f642a9e3f2e77094f
SHA1: 54c63375a6025205c453aa936e3d6931065b3ffc
SHA256: f3b6f86fdfbfaf194a028640da5000edabc7fe1f74fea6fce17ff78355377791 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\cookies.sqlite.crab 512.51 KB MD5: 99dccac1d7202363002c1f83150eeabb
SHA1: 84c5289546228d6b4e03ff1755b0a24dc3de249a
SHA256: 27b2971fda9b387ac051ba19d55d1c1ec4536afeafb0a84b673bb421901bb98b 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\crashes\store.json.mozlz4.crab 0.59 KB MD5: a367ef4b4ee7a5d2f9d3ff251fc6c933
SHA1: 90ee016c5dfd9617f4ada8943875532570d07209
SHA256: 817428070e36c3775026b4bfa37a6d6cf9baf063ed1a5513e8525a308f1a44c5 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4.crab 6.05 KB MD5: 961f15d71448719075d59755f7562d2f
SHA1: 2569271469dbadc83d5748094f529351f0231508
SHA256: 081eac9a53088c053017795bdd0b58b1dedb038f75734c471c85ce8035069065 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4.crab 5.38 KB MD5: 5a1d3edb269fc66d40c66461a518497b
SHA1: 20e3d6f98e8f7678042b74292b45f8e1e2fed89d
SHA256: 3bbb255ff21bf52421fdfe853fc0c9e742ba012cd3d85a09710669de3677ecc8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4.crab 5.52 KB MD5: 61e219dc90494b77218a6084ca9df103
SHA1: 38457704d6b8ae3086c8e94fb9935eebaee633d0
SHA256: 48dcb436937733ca3ede9c0d1832d099d69b8740e16b0ea06755a209e72a6d97 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4.crab 5.70 KB MD5: deb6954503cda6b9d425595725a28d27
SHA1: bc65a9aa02da54e69c1919fa34715201b57de364
SHA256: e64a60f99386773ccc3b3b36a6e8d165b1c9dd38b6374363a767856a1adad41d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4.crab 5.66 KB MD5: b8be6e74202d7f7fd2a465b7cfbbbc76
SHA1: 2bbfe96b67d581010ad1a000c801d9c9d7c20d4d
SHA256: 24bba5037da32050598be59e040302977364bd198f0e22f34b1ad9961786cd3e 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4.crab 6.55 KB MD5: 0a55a17cf525e2a1ffaf37761b616036
SHA1: cefc7b9438f8134c42b2aa6443b5af218d9ff502
SHA256: 6d59e75dd245a5dca0d846326f007c1ead07d7d4ad50364c110e20240a136024 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\archived\2017-05\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4.crab 5.57 KB MD5: b0b82a0c63761ea64a9b98f14f07fab7
SHA1: 8647f89ac5a114a2ed4ce26cd56a3556121cebd3
SHA256: 7d4ffdbad57b1456a7dc195810416168edf8f305f55045c3df58be086ed4e3d2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\session-state.json.crab 0.65 KB MD5: c4d4d0bc0491e3f123cec893de582a4f
SHA1: 837ae0fd0f936bac5dd76c713e23d2e972695996
SHA256: e9cc4da1a0d6d79fca311f15419d80fef67e54af85c74d16cac51d408afcaa9d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\datareporting\state.json.crab 0.57 KB MD5: a04b45be4912213199c0ede07b25c6ef
SHA1: 0cecc1d7a2d857a6a58d95a058b4d262dc649b66
SHA256: 9b46ba0f13fffe8154839e40a30e1f8cd7d7bd5255093d8b9630a1f778320a32 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\extensions.ini.crab 0.70 KB MD5: e2402423405c47ed3252a58c3cc039f4
SHA1: 86c1a11cfa86767a3b3195d20f9d9a43a3007223
SHA256: bd167b995151d2a21954178d4a17d99ec555e0be0baecd5edb08bf030404c65c 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\extensions.json.crab 6.30 KB MD5: 77bb98902442bf61d1c09434b7a6fed3
SHA1: 8c27cc201d2998c01f090b62aff9a3154a4f3106
SHA256: f26c3acc9da78088c9676d5197f6e57f854384336ef753ac5ab2e1e00c314f77 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\formhistory.sqlite.crab 192.51 KB MD5: 1044be840093e2311663aa6a8b97046d
SHA1: f6ee40410cf8bd68b50c8d825db9356928adbaf1
SHA256: 597b0c9f521a612db36bceaef01beef9f0d324f8907210c792b5dde7aa5a0b28 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-gmpopenh264\1.6\gmpopenh264.info.crab 0.63 KB MD5: 4e9ac2e37a89c19f690639e0d093aa0b
SHA1: 728003acff7699642808dfd9239c54637d3b4d79
SHA256: 869d34c37f635435fef441f27f0d6fe7a4a87af968130afaa0aecca8b4db83d1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\license.txt.crab 0.98 KB MD5: fea29dbdba30aa9c61af67e57289f816
SHA1: 0c6f383a60933a0de2f110535d0d59a58345d4f6
SHA256: 936ad2bb298309f5c0fc9c85ad64000a1393f372b7f6c02d50ed0b05bf9be881 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\manifest.json.crab 0.85 KB MD5: d935b514b9e240eed4885950eface086
SHA1: 14da032501c9abe1860a8eab1e0835f3783387bc
SHA256: aa2362620ecdc64bc97d50a70fc1928e1f361bb6488e583fc4191d631f6a997a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib.crab 2.93 KB MD5: 2502c74fcc329aef3905f38f6b918d89
SHA1: 37caf90694aa9270a7454ec4ef3404dbdc2ac516
SHA256: 731bcbc4840fc452121771923d4a8550df6cc9e79b6be214245af61fe74b0d07 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\key3.db.crab 16.51 KB MD5: 1c0d97f085ecf5832134800e6de76e36
SHA1: e64a6717588344ade7c21383153a611221d5082f
SHA256: 373346959d6ae0a86b4e8031565716bfc8c9e60f6166ad4d29b2492cd1ec92ff 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\kinto.sqlite.crab 1.00 MB MD5: ba632a067e272934a5fc3b403f27d77a
SHA1: 159900b79aaac4830f7e502cf56ebf18aa8e69d4
SHA256: e8a3ae398f8cc370a257c1a55637235d75aa1f955d143dbddac0a27455b8b27f 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\mimetypes.rdf.crab 4.30 KB MD5: 6bead77a8561388fa0ce32598422968a
SHA1: 3a3828ce9355455a5c25b66003c0df8cd60b86b1
SHA256: 2d595e800a2c8fc77d3968fd7b755fb27c2aaa3f185e35c3bcf8ab698ca22ad8 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\permissions.sqlite.crab 96.51 KB MD5: b55b95efbdce3257a9aef1b143463515
SHA1: 33d73b9a188db23ec63641409c523fb1d4c6a4a1
SHA256: fee0836f17447530a3236c96d4db81f062f54d61a06b5fed0ad9b2a1cbcf36ac 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\places.sqlite.crab 10.00 MB MD5: 406f8f779c0aaeb319b1ffafc57d2f66
SHA1: 8fd344a8e183915364a5b5052d11ada9223b9da5
SHA256: e35157a2336467b8178e0d555c3f3f6d54d74206877346e9ac42f7482c69ffba 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\pluginreg.dat.crab 1.07 KB MD5: a0f1dbcb095cb6cf94f0dd1fab29beae
SHA1: 6944859702b3b0ef39e6ecbca2d1ffda29f41735
SHA256: a7a97f675ccd9a8d8226ebec08b4f3d7a9a5980db97e6f62e325a43b6ffb22d6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\prefs.js.crab 11.71 KB MD5: 3416af306e2ee0906879af17027f9cfb
SHA1: 00615ade2b8012fdb3af09a94cd1bdb3a4593338
SHA256: 57ea9175c155f252c070c8368c7e9f3c1870ada225c98c417785d53ad7528cdd 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\revocations.txt.crab 21.43 KB MD5: 09225d9a6fb2f983a52c180f485ec4aa
SHA1: 80934a0bbd8b57b4258dcfca0dbfc88dc3ade0dd
SHA256: d0a5ff2126ee285ac9bd3c3c6c33c41bccaa47c506fae9ad1a26a097c7ccf4bb 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\saved-telemetry-pings\d896fec9-1a7a-4db1-a3a2-e46d95b631a5.crab 10.96 KB MD5: 3f0b5f8ee25e57092c5eb5bc1d05f9f8
SHA1: e0f27080e045c3b46c50fabf449ffda6bcff3075
SHA256: e2f87c7d11be383d2343fa592e8901567d2eb8cba073a07e156b1f74f6670539 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\search.json.mozlz4.crab 25.21 KB MD5: 3e3802aad6a15aec0b1b6bdd80e2aecf
SHA1: 49aa52eb073ccbd009d83b8452734c9f3a497bfe
SHA256: c990e7797c226beaef957fa99a04548dd577c9b6515cbce46a05a8f4d14bfd87 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\secmod.db.crab 16.51 KB MD5: 5095bb001078f3ea4b2fb8534f490866
SHA1: bc58899262bf9a306c377f2b91f0a0a40b5a1454
SHA256: 68110359355041fea032641e132afe24fbe8982b2042268fc52732de80816ff4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\sessioncheckpoints.json.crab 0.79 KB MD5: 386afd32b854b4f4b3818a6c90ce5e01
SHA1: 97326278a7088d57fea4ebdb6b4021259c970d0e
SHA256: 030590a696a13198c7bdc8fdafe9ca44b7a0664e906958df7188b8d61614df2a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\sessionstore-backups\previous.js.crab 167.84 KB MD5: 6807070ab640396a2ed4744e06fbce72
SHA1: 143445258c7eec3940403119d49dd0ed803d3042
SHA256: b1ccc2f9759857848b40a8232aa24e0f3426a636a0ce3aa01cc41cd2b8ac70f4 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\sessionstore-backups\upgrade.js-20170518000419.crab 42.95 KB MD5: a55152a1a9abe56bd1acdc5443c74953
SHA1: 06f4288c4e9798232c60ee9604ed4c9be678ad4a
SHA256: bd42dbbb36f9a10c4f7c86089d375ef45d8f665683404cbd8b11d34eca321c10 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\sessionstore.js.crab 1.48 KB MD5: a8d0121f1357cd7c84fb6783e90a2c25
SHA1: 87e648d725c877e4d417cf40b5bec9794db24344
SHA256: 5d35b4b798fdf34d7819617172cacaff7dfd6486184a4317a2cdebe4c5918b07 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\sitesecurityservicestate.txt.crab 2.40 KB MD5: 467a31e52a1654055ad041d46d04911c
SHA1: 4cd5809735b408f8bf8f68a7020ed310a7c0ca74
SHA256: b6bb8d18a507b4bd61f54714b804a9ae15edf5a34264fc40103f3ebbbbd13bb2 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\chrome\.metadata.crab 0.54 KB MD5: 5e7b6aaaaf0e31aa5068fd9e3d290510
SHA1: a94f6f189bd1010783bc0bc360f93129ec12997f
SHA256: 3d4d7d9888c959e26942e14666858772e6d0b7a049e6270d0593c78fe1d1a5e0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\chrome\.metadata-v2.crab 0.55 KB MD5: c27af03eda93a2a57d33f03bbbbcd79d
SHA1: 8b155cf32cb33c3d4239bd6fc6f31f93a34e93ce
SHA256: 7b4e7209de8894f0a6ef28af634a2e52d14bfdf09c15cf2423f74189e30bd3bd 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.crab 48.51 KB MD5: a575c2254c11b8d910f2953b810316bb
SHA1: 0c80963902c12342771d8bf7eb3dafdb170b0dfe
SHA256: 40c3fd11fc56ee27ffa8e9c76c31612b415ebff6c4dcb2c4a3be3f8367b0263d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata.crab 0.55 KB MD5: e12bf2cbe0ddc3d81c5a7e75c94db7e8
SHA1: 8f25b5914bb7d8b2ac61cbb2ee532a46239c101c
SHA256: 6ca679f5e67c4e328a58f530e556547d1d3444e76cf11957c1a6a05ed9e38bc1 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata-v2.crab 0.57 KB MD5: 59469b7742d8e57a6dbcfa0ba63e73c8
SHA1: 5dd790c4e005f58a010d66dfee47ac9a56f358df
SHA256: 51c11ae029089401d76a2dd31dac265b11486dadedefc83bba0bc7c8d1f9dff0 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\1.crab 517.05 KB MD5: e8336c2011474cc6a398728bd2b99bde
SHA1: 70d3715392fcda1bc5768949e3c47cbaf05068b6
SHA256: 54c169c02f75a2b90781571dfd2c7c6a01f6cf5808a309d858664a0070c43484 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite.crab 48.51 KB MD5: 44dfe45a6b7e307100ace6a34e9e1841
SHA1: a8bc7c7c34170e608ce6c48586a0ecdd3295b43f
SHA256: d3e00402a610e2774bab76b91953739ba9cfb74a505486a7d9bb38cfa3f0e3b9 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\storage.sqlite.crab 1.01 KB MD5: 1cdc0073388bad6f75fe582187137d34
SHA1: b940686bf338486b974cc839d18c3a5a12cea0e9
SHA256: 09fbab4275ed21e69b3c6999ccc8f05af1811920fe477008e867ada54779d1be 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\times.json.crab 0.54 KB MD5: e3764f9a053452c48efd9cbc26cbf38b
SHA1: fdb7ee05bffc4a2f53ae01b8e8f6e214d8663a13
SHA256: cd9a9a6f2832f0a1b16f8030502fdcae43d9ef4f56c9b2ed14cb79464f330d05 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\webappsstore.sqlite.crab 96.51 KB MD5: fadbd3c34033173b07b432dde441e996
SHA1: 84d592f4cb21eafa0bba73da56f48502b59b6978
SHA256: 8cf7a87ac861fedae6b658252ccc0184e9fa90778ac4975815edbb3a8a625e3d 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles\8i341t8m.default\xulstore.json.crab 1.32 KB MD5: 3edc393659df11f7fa4f50d695b04f49
SHA1: ef19435b41c358e22ef07cdab97c8174384971f3
SHA256: 15e29f85a3257a520ac3f8b91498d903fe49941f73f3502abdfd988a896201d6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\mozilla\firefox\profiles.ini.crab 0.63 KB MD5: a136dc519dca77cb38c62bb5d3d42ebb
SHA1: e149069deac0cf0a34de56655f990aba588c3d0c
SHA256: de940d3cab32f86877522e4bfebd075984df5f896b883b4b76eb672eef512666 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\qfraym.bmp.crab 67.05 KB MD5: bc04b346de8795e25d8ddc6bc9de616a
SHA1: ca06881ae93822f2eb7ef7f0a6c563cc682ec98c
SHA256: 78e0cc4301e69e6df3098cb965b851569e46290cfcd4a9658346e48b8861edac 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\qp-plyd.pptx.crab 40.32 KB MD5: 379bb8f532172970ff7df0d863ca7d4b
SHA1: 3ae5945af46f641917e48ae8aede23cc976aca91
SHA256: da6eb025c6a89d2476ff11244a28f82f8fdf2e4e0386b20b96880cdbb041bd08 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\riyrn82h-dm1.swf.crab 57.99 KB MD5: 6c5e7e0b57b880c9c33cde2d47100086
SHA1: 4fd8750a33bb0cc58bfbc5709e33e3f3bb7088c4
SHA256: dcb669bdb9b51b51dce49989251f9158a780cb32352dc7f458bb7fa1c891f713 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\rtueljnr_9bie.flv.crab 65.37 KB MD5: b8431d47a0b5112938b0e2409964dac7
SHA1: c0db2b9bf98e4f132671e058f2898c35c2540eeb
SHA256: 2161ef5eca0f750832f0ae94837482e18dcf520fe48203b58d03bf365a25ec89 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\skype\roottools\roottools.conf.crab 0.59 KB MD5: 06e9cca1fad0b2880cfac4fc52a219dc
SHA1: 50ff2e1e44b48a812addf4b5bfc335a78a4b7489
SHA256: ca2946ce8c6370dffdbbcbe696a123318e146aec5fc307b695d60c2effe92bf6 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\uf4gqw0x.png.crab 64.70 KB MD5: 94d344899ea87c755c7a9d22b157c1d3
SHA1: 4ad512f4a3c3ab2b20f217d9e23ec63d1a1b0f35
SHA256: e8c11e21d8afddb77044882f02e5db0ac7398576f0abd8cc4d6f442bee9cfbaa 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\upkeueyo_.wav.crab 24.96 KB MD5: 3bdaac6e19de3eb8463f9c719aba67b7
SHA1: 575d5cd8e1f0490eb9344696ec2b0ab7a0732a31
SHA256: 6e9f6808285d1b4e3104677f83bcf3ccdaac3057bf105a9d524dbd21a7921c40 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\w22v zhmhzl.m4a.crab 30.49 KB MD5: 9878fb8238abf0375a63c288f89b4c48
SHA1: bdd6aeccbe70fc548883b54c43d6697de422dc66
SHA256: d1cde8049c927fa74649167b1dad5e7eaf23dc773e13a29a9a3162319d20d7ca 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\w5hi9yxcym -rungtbmn.avi.crab 24.57 KB MD5: b11b00f47c206b03592aefe4e021132a
SHA1: 4102cac99056ced8f1fb8dd06a8399bcf8170dc4
SHA256: 3445efdea58f3eeda27515e66697324249b536b8d2671b4274bbdda0dbf14153 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\wrswd.xls.crab 8.26 KB MD5: 1ff535ed64e4461d439dbd58522417a1
SHA1: 62834504df06a239d26b5ff6a0c1e25d8095e6ee
SHA256: b4ae9039e928999a45420ddc108b72c1e158fe6ed8e49b25387a435444268e9a 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\x_unj4tpd 60im5rnf3.jpg.crab 23.84 KB MD5: b83cbef6d50e837c424eaa097a6c9213
SHA1: a30dd798ad0203707de96f5603c15143c84d438f
SHA256: b855897d43ee3304a72761c6554d1094c0466b428cee7d79ddb2b92332ba8920 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\ztzenx.swf.crab 71.40 KB MD5: 6585a63251b15872c1f9fd34aae1b5c2
SHA1: 712f008cd8573b69cb1a0e7dfffafe404e513312
SHA256: 2014eccc2c0cd793ab2865b71128f0a0e5174e0e05b0e35a0cb269f659419fd3 		False
...
c:\users\ciihmnxmn6ps\appdata\roaming\_3rohtjuifbhbbwk424g.wav.crab 44.23 KB MD5: 22adc88cb84438ed0adc71baba1923d7
SHA1: 3dc569402bada838c7080fd5751d81d15cfbd7a7
SHA256: 120a64baa20c46edddbae8ead223dea1859dd378bab4301a73697852b5d70a9e 		False
...
c:\users\ciihmnxmn6ps\contacts\aclviho asldjfl.contact.crab 1.66 KB MD5: 0ed9a33fcb93de1683ccecd99c319314
SHA1: 34af16cf7f5830d8e4bf574f6f64d80207a81ac9
SHA256: 05041e4c1dd6209e5632f55c9536e32e117a0f0242ed6f7077de07793ca6ee69 		False
...
c:\users\ciihmnxmn6ps\contacts\asdlfk poopvy.contact.crab 1.66 KB MD5: 1c41567305f9c51d4402ec71b2ab0f6e
SHA1: 31492ec98b9d465141110ef9df2a748968336cf6
SHA256: bb0eac4b99c3a5af47c6ac2844e61aa0a4422abae5590eb84a638d307b0e34c8 		False
...
c:\users\ciihmnxmn6ps\contacts\chucu jadnvk.contact.crab 1.66 KB MD5: 610b6a744e2ab33c573352838f572973
SHA1: cfbb03e7260b76f9093c3cf879c2fae149e7a813
SHA256: bef16be940877d36b59ba4cfdb7d87f3c11339bd43c410357c2f750994793938 		False
...
c:\users\ciihmnxmn6ps\contacts\lulcit amkdfe.contact.crab 1.66 KB MD5: 2703787f6345c4b3af83d07dd740819a
SHA1: 3ad32920a3efbb0e8d107eed227a235cde085e09
SHA256: 7a5e01e49c15be09eeccf827d6e5962f82858ab76625c0a6ce1d37f67ab8ae37 		False
...
c:\users\ciihmnxmn6ps\contacts\sikvnb huvuib.contact.crab 1.79 KB MD5: 7c9949f20caf11b7a89b9f7e1dab3f42
SHA1: 04a7c5198bde2bfb6573d9a0fe3ef49e30cd8713
SHA256: 5085a9aeb50c4141317935ffb68c591b1efa4a3682ff2fa0cf814ffb24adeca0 		False
...
c:\users\ciihmnxmn6ps\desktop\3kjz5cnw.mkv.crab 41.85 KB MD5: 6eafaf36145f40dbaccd9d8657966639
SHA1: 8573cc63e5e354c2ebf0951489dc1ca3fc7732d0
SHA256: d92fb21b52cdb8ec79264bfb0bcc37c8abb753b575649ba24223b4f5c652515c 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\2oefq6rgb6hpwhhmjpa.csv.crab 53.55 KB MD5: 058a5c867cc36ce8a50ca8dfafb119c6
SHA1: 86b74d0a0f57b22f3c1e89267aa4a8e7127a132d
SHA256: d01bc00ea32b27cef88b9974a0eac4b8809d3f9f595681c41c8f628b62ef7146 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\ddejn6h\sx0ocsgksjcgp9j9.m4a.crab 7.37 KB MD5: bb4558f80d836e8502c6215350ed4e7d
SHA1: cb06dcdc2a65c554f11ecb0c33642117f934d4b0
SHA256: 5514f93a0cf68b7e8f3fd716460f19b89f0ab7d9a02ca5e7917a9fc7959c39b6 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\dv-r\jlp9olqmr7z1.flv.crab 33.49 KB MD5: 8a491c5789ab40c44e956bad649ba3f6
SHA1: 94e2c136ddb41c6f72e48b0e4c117e80a37e452d
SHA256: 7357990865ac9c6fb94e824487244532fb823d4726b4ce28e8e5bebb3c1ec274 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\dv-r\tiny70xvq\2xq_zqyaag4ec6joci.png.crab 60.60 KB MD5: b20a0dc9ee59e3ac47a0fe115dda017d
SHA1: ad5ae183bf5ddae40de0e3bcf9eabf3af62f1db8
SHA256: 1fbb0b0d909c6e82ec38442fd868d151c319de50a5a2b3d5bb2109b51faa38e1 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\dv-r\tiny70xvq\4_amse53dir-zzl.mkv.crab 84.68 KB MD5: d070c730b66828160654841223aac7a8
SHA1: ee842705d1947016ef175e08898a1f408bb9db12
SHA256: 7e05cce0bb1962a45d068e232120fc6b50c85e51214f4cf44212395ce1c8eb8f 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\dv-r\tiny70xvq\nt58.png.crab 98.26 KB MD5: d9d028cb89069b970b0fd8bede763b47
SHA1: f91f81cda20089cc77700845f8b9d54fb0d6890f
SHA256: 20615992fd5cc20aab543f1ad9ddc62e99c45891ad3b9cd7f7b760fa026553cd 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\dv-r\tiny70xvq\nx5fhokrqcjo4.wav.crab 57.41 KB MD5: 55c2d6147d86911f39b139fd63573f06
SHA1: b0b0e866704024712ea86630500f6e6a09b38c66
SHA256: 97faa51b9a9bf5e097103037dfae0ef23121adf9d884b6c9de731f975d9ae259 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\dv-r\tiny70xvq\rmycwf.jpg.crab 46.24 KB MD5: a90df1a5d6986f6e4a93eb22bf479b75
SHA1: ec29ad60b6570600ebb6331623fd3db954ca3809
SHA256: a441327d91142f12d80b6283e5c0cd3f05d5ac6767e6e74e2b78896f07df7e6a 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\ir _07ql.m4a.crab 65.98 KB MD5: 9a46d311f5400100b1f3c0dab6960601
SHA1: 038c286ed1faf9a7c24b28fe2e2e010d20ee0c3e
SHA256: 11e34bca1e9f0ca59f3df07962c5cf37d93801ba8cec1d5da1796e6c64909420 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\mnfkw5sliole.m4a.crab 94.79 KB MD5: 7f80354c690242c9400dc0351207211b
SHA1: e1a8ff39f16dad72a982b2156f5f9a68ba0d47f6
SHA256: e7b37b6bc38aaa6534b961b5433e92615d163ba3a6e5547c2288d378c943f1f3 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\no6q\atogshzt-fs_r.bmp.crab 45.65 KB MD5: 8694b43c1185d85641f1018cadfe99e3
SHA1: 654a0c673c31536cd2927f40bbd2b5449c331555
SHA256: 599ead10242708e34180af2c45fc40cc6211043a376753163eaf771c5bcadc23 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\no6q\c-ijbz7.mkv.crab 91.51 KB MD5: c96a35489b2ed439f4cce5c3e4b8c8c3
SHA1: 913fcee0e2a7bb8420a78f76a396557bf0d4640a
SHA256: e62ae3dd02628e34ee90feee52017c6a3afcfc4bf07d2ee0654eda654fd69602 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\no6q\g0_n6bhayr.avi.crab 83.82 KB MD5: 3146b1950b902b4e687708967b5ec92f
SHA1: f5bac9ca6b27070174694821eacd98f930419436
SHA256: e4b654c2d4a5176087c72e9aaf463f5dbaf69d655e6aebf894718c28c659811e 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\no6q\q5vqhxmtmj4.mp4.crab 31.27 KB MD5: 846ea510de71230ad18e6ce37ee01093
SHA1: ca12896b1c8aee2e2305f5d72fd1c539dfdb65ce
SHA256: 862c0bf306255e6adaaae66a9ef518aa98cd57538e41a5c76ff38fe510b70c61 		False
...
c:\users\ciihmnxmn6ps\desktop\4tlo9m8d\no6q\tcynm2kjjqyr-gnxbb.ppt.crab 92.49 KB MD5: 00b039c9b5aa383459d4b993e0bb1ffd
SHA1: 89945845a7a4fb9af292e0d3bf0441f7c6c8039f
SHA256: 806981de17945a492ea78b2e493e0ee468f9151c096bb884cf66cdcdf848b787 		False
...
c:\users\ciihmnxmn6ps\desktop\5fjsersycmliruj.gif.crab 40.12 KB MD5: c516d85ce5ba65e6431cbd805d9d2f4c
SHA1: 1d9796062e602da06494f9446bb049fb27d02290
SHA256: f231f9afdd2201d59333d30f22bc177474a005d02bada3dd13c8194817b69329 		False
...
c:\users\ciihmnxmn6ps\desktop\5mt qncqrohl8jh7.docx.crab 81.98 KB MD5: eb7eb76d8989ce88e8c93be85da63a35
SHA1: 112d180268cfff9609e05a3930de0d2f17bd69f0
SHA256: ff569c26317eb86299526f7870acf16a59200daf21dea872e32fd6db58d2777a 		False
...
c:\users\ciihmnxmn6ps\desktop\5weqa37vozwal0.mp3.crab 86.43 KB MD5: 0ea398e71ace0c35ba86e0cd88c7fb42
SHA1: 3fbf10b8cb46c2725d583182dd581e230e8004d6
SHA256: 3e5171af9f06cc9e233bcc4e2390bd5cf60e93f36c91bf04d8b79d82bba56583 		False
...
c:\users\ciihmnxmn6ps\desktop\9lhbqme4cwt.flv.crab 22.66 KB MD5: de319889d79a2e2523822b3c528b87f2
SHA1: 003246894543c8024682c676f1d326df12bf0733
SHA256: 1611f00b9deb4c5ea8af7ed3428f3839edd319319a700ccbdfdb01112568940b 		False
...
c:\users\ciihmnxmn6ps\desktop\anvzwlibpgzs00rb.png.crab 36.30 KB MD5: 01426316a394fbb9613ed66f012a5666
SHA1: 198cc9ac73ae295da80d1152942224fcd67e03c2
SHA256: e416d7fc23a64e08d0c77ca00c7b4c4e307b6f3c204f537af0aac80e7343da54 		False
...
c:\users\ciihmnxmn6ps\desktop\br-gqtlm.mkv.crab 51.54 KB MD5: 238d6220b39d1afebc4d782c6ba17c0e
SHA1: 11be57b9455c122bc079494f4fedd95889ae5355
SHA256: 7b5e09c8944cefe148990631302a8b66357e0a634a436aebb9f44abfaed5adf1 		False
...
c:\users\ciihmnxmn6ps\desktop\de7vomw9nssrq3fo_e_u.odp.crab 67.02 KB MD5: 6bafa4697c592cf7208f48862ccaf40f
SHA1: b1f6b296fecab8fff510b8a6e088e66486544a26
SHA256: aca449c69c43c01ce91d9acbed90c14297a45878fdea977bae15be345ceb988f 		False
...
c:\users\ciihmnxmn6ps\desktop\dg8dgwbqwebmqe.png.crab 83.21 KB MD5: 1f43a715217d5e0e5f62a9e2ef73a1f9
SHA1: b341209b458ce476d9cb9798d823c15b1c32bb5c
SHA256: 810492207bca21dca41b2b0568c0102314420362bf42b8e70b78308346f4ab30 		False
...
c:\users\ciihmnxmn6ps\desktop\dj c_.avi.crab 32.35 KB MD5: f9e602a03c5ab7b70a38fb48be86fe07
SHA1: 572a0d3a7de70767605413784eef29482a357037
SHA256: 06bd01b8025d69ad816868c19c2c053639c1837e79f446bfa355a969680c0b71 		False
...
c:\users\ciihmnxmn6ps\desktop\dobcmi0uposi1t-vxh.mp3.crab 76.18 KB MD5: dde2d81e64ed18ae3f892bda1b5f7f4e
SHA1: 2709892856d20cc17d9f3e8a3d07586bf6ab38f8
SHA256: 730bdf2eedf2136489de24da7e18acdcc9b8529ee92d87f236e1fcf472ab421b 		False
...
c:\users\ciihmnxmn6ps\desktop\e5af.bmp.crab 9.46 KB MD5: eb7a561b41e6770125b70d2e9bade0b1
SHA1: d3a097ad6a5b18ebd3cc1c0e969d8f99579f0bfd
SHA256: f43ac978414b08313047ddcfbc17f44d4c221d294e9510b395b0024fb3f9373d 		False
...
c:\users\ciihmnxmn6ps\desktop\fm11jrmuxaytjhrh.bmp.crab 4.30 KB MD5: 47d68058317de771e5ad75e3206e4a4e
SHA1: c86011b43a273ae4b86cc4a073b655c8a17076e5
SHA256: fe2989972e6b91113e4e5637f5e708252a70e77ed2e56dbf8df8b0feff7d52c1 		False
...
c:\users\ciihmnxmn6ps\desktop\he z.png.crab 15.49 KB MD5: 7622711e118ec20748903e0e5f75de8b
SHA1: 9d028365c511c4f5ba79333c25b9244652cc11f6
SHA256: 5290f88412e50d497e3ebe5be55a35c211c5317b74b03f42c8a08c1e93ac4039 		False
...
c:\users\ciihmnxmn6ps\desktop\jewuwhbrobjtl.swf.crab 83.13 KB MD5: 309d557ecc088676317b7ebfefd4fe54
SHA1: d3f501e280a8be0a3c612f442a82dd53afa520cb
SHA256: 2bc8b657374d242275615e391d6127977dd1b8e2d1755dae678ce5ed54c2dfbb 		False
...
c:\users\ciihmnxmn6ps\desktop\jhzt3iiiucb vaqw3.mp3.crab 27.29 KB MD5: 0c4f55ea5348c5f699a2aa81e9e1778e
SHA1: a84fb215488dffd3010ac6711fe1930871702103
SHA256: d637fd83ce1b17c3bd92482592c999ee0772fa951fcb9ae8dfe4be8f635df370 		False
...
c:\users\ciihmnxmn6ps\desktop\k3_ooeknp.gif.crab 38.26 KB MD5: 2c3fdbbe117f8087fdbd9f3b06ad59de
SHA1: 44de34f8ceab9e0cfa4038164ab73bafae037613
SHA256: 5e77b503d011098e5e5fb13fac267d3fb164310f668ed04af0cc8ba2b70329c5 		False
...
c:\users\ciihmnxmn6ps\desktop\kojjbty0s dipj6z.mp4.crab 63.76 KB MD5: 5fa844129a9b0067bc8631cc2054bfd4
SHA1: 50ed3b1707dfa9cbc8f0eec2b5cd9309cecf5e6c
SHA256: a10952ab2a941e83d752a5a38e34f71a6b8d2dba44e4b355b70cc65d5fad5fde 		False
...
c:\users\ciihmnxmn6ps\desktop\re_25pziyuzu-5trnq.avi.crab 16.10 KB MD5: 6fa6a8a0cb095451a4d84a3c533aab17
SHA1: eaa9e26db70a6a1d120e72f87bded3b40a55d58d
SHA256: 6a4cc29d23aa4c8067ee47f401c3bbce8fd9a468051200ed6bfad54dcb4f393d 		False
...
c:\users\ciihmnxmn6ps\desktop\sb_c.pps.crab 42.66 KB MD5: 9de69627fc9b937599c6c323e9e152af
SHA1: 022e8ae494b81b0b4801c8660b1c2798fcdad3d9
SHA256: 1c92c6f8231803e7014366202ceecee328f4d4347d86bd99f8748f58f6116ae4 		False
...
c:\users\ciihmnxmn6ps\desktop\w-3rm82 t5ltsq3tc4hq.flv.crab 20.98 KB MD5: 4cca6f52aceac3d17035d222213bcbd0
SHA1: be8f645de17c43fd07d10ee7d9b1c83c8906d949
SHA256: c109ee545a463b79121db6825ce0e40064c0b86676bb7fb460a0bd7884211723 		False
...
c:\users\ciihmnxmn6ps\desktop\wqwvi3oveelhvpmviae.mp3.crab 96.71 KB MD5: d89d59f3e86aaae5c4d8ef46384939e1
SHA1: b38db36fb11c99075ed149c00a6a7f5dade375d0
SHA256: 83764a4bbe62511a4d544096942fe9d5cf3abf1fcaa0f5643f6303c9871a9996 		False
...
c:\users\ciihmnxmn6ps\desktop\_k0ttn23utsjhs.m4a.crab 85.85 KB MD5: 2afef3c97724d765936449916271a24b
SHA1: 56c69eb0e9178e17a7a9586e276ac68bac760648
SHA256: 80db8eba671f1b3cc6728858fb70aac44d63a4d072ef8d87137ba728e6fdc9ed 		False
...
c:\users\ciihmnxmn6ps\documents\56opooa0ipfxzv0\3jmj7b2_xxlf.docx.crab 19.79 KB MD5: 6dfbf20ebf39c2ef278c7b9ed39d497a
SHA1: 51be1f62262ab4b9c80e29b9a2b827d65b42c1ba
SHA256: 3c00580ad0595fe3f0fc55b7392d6ed796f709b9117aa76be7a46d2ee625f01e 		False
...
c:\users\ciihmnxmn6ps\documents\56opooa0ipfxzv0\6nhegx5xlq5ewmt.csv.crab 42.84 KB MD5: ae056b98a92ceeaa77e935a2a234511b
SHA1: 372c97296f63bbeb2429e83a00d39a77c5705cc8
SHA256: 77fef3854666a15cd5034098d51020b8c94dcf4838c38c3a7fa193dceca8ddea 		False
...
c:\users\ciihmnxmn6ps\documents\56opooa0ipfxzv0\d0lm.ods.crab 45.48 KB MD5: e53cf7179c68714db962744ab3942f57
SHA1: 0d78fdeb36071afb3099740490386533952b0780
SHA256: 5399c1c70b779dfa4660c171df88a646b6731ae9693bedac850f6e2dbdec13b7 		False
...
c:\users\ciihmnxmn6ps\documents\56opooa0ipfxzv0\h-g5n3xdxrr.xlsx.crab 43.29 KB MD5: 69255da617add2a6447f1c1a53a3d627
SHA1: 1bf84e82024b7a028a42253a9a8b3dfcb12eb372
SHA256: 84e818665316c672de228196c94a8b7e76ccdb6a5f5fb3d089fcf80121079352 		False
...
c:\users\ciihmnxmn6ps\documents\56opooa0ipfxzv0\mnjunrpg urq0zsmgo.rtf.crab 29.93 KB MD5: 8debfd99782f840a0a9dad57ed97d724
SHA1: 8ac3c1dbeee3ba0db7e32f7c3e297d315f455bcf
SHA256: df91a6480a0e0c668e3dd842a866cacbf7564649895313b627ced22778aab20a 		False
...
c:\users\ciihmnxmn6ps\documents\56opooa0ipfxzv0\rbf2bbr.odp.crab 55.91 KB MD5: cdb0f33b1c6eda75ac4ff2473a5ea75b
SHA1: e8e6304c38084890f34713dbb37c7d87a73a90af
SHA256: 95c60c07dbe3220aab3ac3c6aff4d0bfe29726677fc5c038cd0689fc66b5da60 		False
...
c:\users\ciihmnxmn6ps\documents\56opooa0ipfxzv0\rk 9wtproew7rh5.ppt.crab 100.40 KB MD5: 67f5f979118e581be84876da34b3f25a
SHA1: 2dfee51797366b50be575d792d35f0cb96611fe2
SHA256: f7c27502d2bdca9f7a652bd676fecdba42605972f5f83412bd1dc3acfd624598 		False
...
c:\users\ciihmnxmn6ps\documents\56opooa0ipfxzv0\xp3uop.doc.crab 25.91 KB MD5: 257351ca9224a74e3879bee5a52c455b
SHA1: 47c191f327ca08c5f9468c6082dc1c1f8ea296b8
SHA256: 677ab2fe7d0b68afdcd36c4179545f930257f158e969b79baedfa086196fc257 		False
...
c:\users\ciihmnxmn6ps\documents\56opooa0ipfxzv0\xs65dqrljbf.odp.crab 64.55 KB MD5: bf4809562fa4f2efdf469ae94d7cd202
SHA1: 61aab3a5a72f10a4b5fb74d9cf43c79e568bbf21
SHA256: e84cb8ef5bd87f227bf7b85e771a7f333be3a89489fb4ba5a4013e7c32ea6d48 		False
...
c:\users\ciihmnxmn6ps\documents\8mfog-1f.doc.crab 21.91 KB MD5: a4d18478fee7529d709d5d2b3898cac4
SHA1: ff4c1a5a25c7dc77c8e72554844a965b52c832a5
SHA256: b35eefb1acd872a1d0c96b8f3954f4941bda67425045d52a3fe5e4a77699e5e6 		False
...
c:\users\ciihmnxmn6ps\documents\b3zkqb-zszsc3pzm_b.docx.crab 50.09 KB MD5: 366f6e8b0bf9ff0ebbb5032433ea2d98
SHA1: f6810203642b05a9cee05eb2b782ba5e44cc32c7
SHA256: fdd45034855ae3a77def656e4658fa3a31abdbc1b7116941d331cd56b2c9d2d6 		False
...
c:\users\ciihmnxmn6ps\documents\database1.accdb.crab 348.51 KB MD5: fbeca2ff144731bab3f33685a21538c5
SHA1: 3c358bba16346e32ae98d0c27352ec0e56a5f341
SHA256: f7d490d5b41ca3aa7c9338491ea21a1a648bb02bbee061e6bab1eb9e12c3fa54 		False
...
c:\users\ciihmnxmn6ps\documents\denumi0chmuuclyan.pptx.crab 61.51 KB MD5: c904c6aa1df82196574822d29433cd36
SHA1: 173bc8a8b34fc97d3e5a00465a1fe48e2b953311
SHA256: 8bd9fc5773a1e8deb458b1fe57f391165a2e007e0e8fdfacf1ffe638d6d7d151 		False
...
c:\users\ciihmnxmn6ps\documents\ds08ze9zeso.docx.crab 84.60 KB MD5: b82a26193a9d2ce123c0927f5346c7da
SHA1: 21ddc871a5edb9ae6ebe5c4925cc2208ba74f54f
SHA256: d31d6d721de6c2c8e6706ebb92d3db40e62f746a1854d317cad864b2e0e93d5d 		False
...
c:\users\ciihmnxmn6ps\documents\dy3xta\1b9wqxp8sf4.pdf.crab 60.80 KB MD5: 41d8a37364d37598837ea4bb8b7f929c
SHA1: cbe783c8e35e5796da2cc5e3240bae015910a722
SHA256: 2794ffd9c577487e8e0b6e74ee546a88e3018ffaabd78767bcb36b63cbd0965d 		False
...
c:\users\ciihmnxmn6ps\documents\dy3xta\5ybc akpc.docx.crab 39.68 KB MD5: f1007fb182002f465606a303a1e1d1ec
SHA1: ae331a4d06a7b0b7ab421ba70a597be85bc8b794
SHA256: fa2969fef047105412b0643c0ab029561377b110018c0ce68ec68a9e1374459b 		False
...
c:\users\ciihmnxmn6ps\documents\dy3xta\ggfhx-li.pdf.crab 64.13 KB MD5: c69ad270d13bbe059fa44954abc1b0c5
SHA1: bdfd54feebd0969bc58222db5ab7e90f175563d6
SHA256: 02b11cef2731ac52006343443f3e5635da8cf226c8c2b3b25d37140f1f7f0408 		False
...
c:\users\ciihmnxmn6ps\documents\dy3xta\l6h1.doc.crab 54.27 KB MD5: 47c691c126c0157fd40666fc933fa5fc
SHA1: 2a46df55088d05246bdde2843bb20360fcf8a9be
SHA256: f2c95f6aa2cc3c0d40e320807c054742a1f654c3f62d68cd9d32250816ed770f 		False
...
c:\users\ciihmnxmn6ps\documents\dy3xta\v510unvfl.xlsx.crab 6.46 KB MD5: ae5c5c89892749d9a670d5948a576bd8
SHA1: 2ccbfaa20c5206930d97ba945eca41d44b847f31
SHA256: 0fda88d3d8f11bed0f5a0d3b8f3759e08668c714a405964f2673563bffd6e02f 		False
...
c:\users\ciihmnxmn6ps\documents\erf8\-jika2dl.docx.crab 80.21 KB MD5: e8e24708d7d9fa70c1ca75fe45a59345
SHA1: 79f59a6aa6067d6f462fcbe1b5e433289d4e413b
SHA256: bc125facc390e32cd0b5a88ee17d4a6294e2d71ef7ccaa296973414469b04ddc 		False
...
c:\users\ciihmnxmn6ps\documents\erf8\2lnzdsu kd.xls.crab 81.09 KB MD5: cec0c51e6d46c52771b0b3bf5770c6c2
SHA1: 333bffbeacecfe171c64bdfd21a88a5a42d15f9a
SHA256: c0cb7d89d67f187ff20a0d054b7911b669c1486506c14767f1fdc936bd0cda5e 		False
...
c:\users\ciihmnxmn6ps\documents\erf8\jrzzqacnfpzd.rtf.crab 90.09 KB MD5: 6124ce780a77014685de63ab04557e0b
SHA1: c3df3a803d9e034ee5ae0a85d01a05036334ba6f
SHA256: 98882554e96634c94577c556ec96de808227eecf169188d155a8678e5fb62f91 		False
...
c:\users\ciihmnxmn6ps\documents\erf8\l57k8frplr5utbglbdv.xlsx.crab 72.51 KB MD5: a32b95600a4100ab478be98604b50731
SHA1: 28d5a647e9542e0c40944438d1dfe9343d9c5516
SHA256: 87bb2586c7cdeab8c5e5431e08aa53b217c71595530c8fbb07ba4c6cce1f847e 		False
...
c:\users\ciihmnxmn6ps\documents\erf8\lkym.docx.crab 7.54 KB MD5: bbe92ea71eaf72a48a7e02b432f007a9
SHA1: e9a11b845a6ad9b940a1eb2f57b7f07af1dad565
SHA256: 19c430c740c3964fc16a6b82c1b45888b0fea27a59785a3a65cbe152212f816b 		False
...
c:\users\ciihmnxmn6ps\documents\erf8\sekqw6jabfbqv4hufe_y.rtf.crab 20.91 KB MD5: 88330256c87765aed9fcd542088365c5
SHA1: e8b53b93000cc10f7500bd66c35faa9500f605fc
SHA256: b64229cbe06c0810b3ddf81dce37b971657845d1740afffd8a90af5aca0c4d92 		False
...
c:\users\ciihmnxmn6ps\documents\erf8\wnwa1.docx.crab 36.07 KB MD5: 3d1ce328b9abacc552af0795d0362008
SHA1: ab3768c2c58c4f607366b93f047e6dba008a7c0e
SHA256: 5bfdb6c24e9302e67d6968da4cab6328768a008d66aabfa453f0814c61a8586c 		False
...
c:\users\ciihmnxmn6ps\documents\gx5wlexwddwx.docx.crab 80.95 KB MD5: 519f08b6aac6d4b6c95e69280d31dea1
SHA1: 01c965d6f60c149bc8f89afa35fa463ee7ab6a79
SHA256: 4f68c8bdf3675a3e18ca190012d6ac28c2955cde3050d56fcda613a2500aaec9 		False
...
c:\users\ciihmnxmn6ps\documents\irmpl-uiutzt.xlsx.crab 60.87 KB MD5: 86d8cf727574129d7b7fdb4de46ad272
SHA1: 14b1198ae619219bbd248cff9f32f583667175fd
SHA256: ba9f1b63873683f858ce1539e98c53b236ff94502682fc7f24b94f24930ef202 		False
...
c:\users\ciihmnxmn6ps\documents\k-zutv2ysp4mx33k.xlsx.crab 25.29 KB MD5: a311b8893e6f154baa9484402e7db176
SHA1: 48d7af328832bc1b5698c88ca584a51187ab4734
SHA256: fd797a1b1afb77831e07536b6b74f707dc40ec8d39b01ea1cb64e19f9ac30656 		False
...
c:\users\ciihmnxmn6ps\documents\lxvp2.pptx.crab 88.77 KB MD5: c9028a36ca3c261d90148a377829d71c
SHA1: 6f017ed506172bdb36ce23accde5752993eb09f6
SHA256: 843cd85f13690ee62ad508188c9ec88270fab9e6fed476e8198c3569ebe5c1e1 		False
...
c:\users\ciihmnxmn6ps\documents\mddc.docx.crab 86.85 KB MD5: 1e184b9c04ebfe1683e74c7563ff4e6b
SHA1: b074534189b08da93904d16b0cfb844d66e8e0e1
SHA256: d6d141eaac41196c251f8ae74af3df80a471fc392c89efe51b1944a786757503 		False
...
c:\users\ciihmnxmn6ps\documents\nhohi2xh7hhj1xulb.pptx.crab 32.26 KB MD5: fb6ad52762440230aa7d5a05950bced4
SHA1: b214b78e133ca6b1b3577ee40aea49c1a9fa9353
SHA256: 89bce1876041069f2231c5af7bc04c1a898601dcf94c0297d18357ada1a2bddf 		False
...
c:\users\ciihmnxmn6ps\documents\nhyvdq1sdmnuphem.docx.crab 34.30 KB MD5: c1c9ae3e9ac934b6344bb42325c67e91
SHA1: 7a24a44151a9054bd48bee440eb9a22cb9092cfe
SHA256: 2765cd487678ebcf42940432d5751c463f5da959c4b4c21a9e14cb64b065716f 		False
...
c:\users\ciihmnxmn6ps\documents\o wg.pptx.crab 42.87 KB MD5: a620ca5bc0d98c8050dd0de0c68c01eb
SHA1: 0b2d223317b8e2e2fc0c5e601ee601b5d9f201d6
SHA256: 51da00d92cd86e5035ecca1795e0af271160144b8eab7640d927297c178173f5 		False
...
c:\users\ciihmnxmn6ps\documents\od0i.xlsx.crab 6.04 KB MD5: 02b85cb08931a11890791ca16132cd30
SHA1: 90e88b50abcc12a7f5756981b034d48c75dc9d85
SHA256: 85f0722348514ac06247c6016ba23e0c7886ce7e92744d779ac6096e9790d0c8 		False
...
c:\users\ciihmnxmn6ps\documents\onenote notebooks\my notebook\open notebook.onetoc2.crab 6.55 KB MD5: eecb15bc406bd4ab7c533b2218e65b61
SHA1: 65333e2c345124e119f8f8d32635f5b65716fbcc
SHA256: f3e8d28b50f0b057d5122c0a55e5b52a4e94f5847fd9780616d375b67f6a6076 		False
...
c:\users\ciihmnxmn6ps\documents\onenote notebooks\my notebook\quick notes.one.crab 352.21 KB MD5: 6507752ea55bb994e8e72391d38811fc
SHA1: 7a496662d026b54b0aa797e645c580e0d4ad1d58
SHA256: 497ae2d0bb8d01729133d694f9429c5a3d219a9e2621252aa82497aaa998a9bc 		False
...
c:\users\ciihmnxmn6ps\documents\outlook files\lcfkj@kiekc.df.pst.crab 265.51 KB MD5: 913e1e751d3cbd4a5bb28fdde51a5d3e
SHA1: 8dcf8a885c4ab1ace012e4039bfdbf6463aee43a
SHA256: d0bb92922796a3291ddcd090728ad0a07444f44c38279d15343e7479819bf33b 		False
...
c:\users\ciihmnxmn6ps\documents\pjtd9dgbt6z.pptx.crab 82.91 KB MD5: 471f77457733c92f24406ea48c5c6c89
SHA1: d7abb6a26860120a269205c9c6f5a57e21aa0b16
SHA256: 1a1f6b7c0b690d5d392ca190c50391077eab3f4000ac0b169be2e6ce4b4a9562 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\697f9no2fryq7uqinjkd\4cua6ki.xlsx.crab 82.77 KB MD5: 0afc4f755a5ca4ece75f1a8b33c3d94a
SHA1: 8dbf40c074dc342d437fa6377a5526c30b607097
SHA256: 3e76cc462ba120d05f8f4fdba3e5718229fe16ca6b6e3b93867b89f13e4ea256 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\697f9no2fryq7uqinjkd\azyu2gpdzxotgx71b.odt.crab 5.26 KB MD5: 6942f6eb57ffad513c566ddc7a8e40f1
SHA1: 7839d5b5e9894c0cf1e99f5670e8b5350cd791cb
SHA256: 395d6621a329f3721fc3e6c49876de0f5d412d9154c57ce0b89bc3716d4cfcf9 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\697f9no2fryq7uqinjkd\mlpdu3vg.pps.crab 83.13 KB MD5: 06c13b98dd5358e319ba74b330535b97
SHA1: 1711f261080036dac4caf3e5eafe6d3b1c173a48
SHA256: dc2f2db78dc01eeb4d610f696da98bbefe510b4ecc6ff0e02a95d56c1cfaa9ee 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\697f9no2fryq7uqinjkd\y3ukhef7m5rrbf5fy30f.ppt.crab 8.51 KB MD5: 3636b2e23f5b4ac9f6b542ba80550372
SHA1: 2b2daaf7118568ca10aff1bbd0d1a29797b27465
SHA256: e890621695fa6328ce3b4b64faca858bb7236965fd2979744e681c447f546518 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\gjhxkmlsykkgxbav\0cbla7v6kluflatkts.pps.crab 81.37 KB MD5: a0866d902ef8325cbabc066b6ad2d393
SHA1: 1aa22f39807f13e181fe3048842df2920e706a04
SHA256: 9a526a214144bcfd96a0a3864a20a5ea370d604b7cd8841b347c45fa52c8810a 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\gjhxkmlsykkgxbav\1qtfxnmoh.ods.crab 17.04 KB MD5: e6df392ccbec89eb9003511a09eb72e5
SHA1: a1b7fc2716f3eddddd7633868a32e2f29cdf6dc1
SHA256: a5a453182a05bb0d906ccbe6534b0ecb53234ce6153ef5f0856431a9327c6bad 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\gjhxkmlsykkgxbav\9slkcomwgunox.rtf.crab 76.49 KB MD5: 753ea0c89fc4f85d569873240ac1d631
SHA1: 76200edb0d3ac336a83494da7c05eeb0eb445b9f
SHA256: 8297a7f14fde200b87af542a63a0295e29cc244064c26249d63948daedeaa6c3 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\gjhxkmlsykkgxbav\ezzpcbkynbq o.ots.crab 70.74 KB MD5: 923767ae927ff8b5f654b822a5a1454e
SHA1: 957be9e0efab0dac682774fd5a5d8eff20d4c6bf
SHA256: aa0fcd59ad5a43c395117c40fdb27b019d5afaca60d102ab96a81b509e89504d 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\gjhxkmlsykkgxbav\l9626l.xls.crab 90.35 KB MD5: 421b8271eaaf66c950100bfcda45b56f
SHA1: da06d5f79a0128de6d64b63363416c19c7ca2454
SHA256: 2b2b750c055c3bebc40152d5462cdd252646f0789ace90209c7ef3527bee99df 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\gjhxkmlsykkgxbav\n6m uq2mshynyf.docx.crab 3.02 KB MD5: bec25614374f1748b7b100c977812f3c
SHA1: dced51ed553fd838fe872208b40c74b623b721c5
SHA256: 3ef5041f62a67fc9f92f7afa3b8f3134dabd0f7a3aa6576295182c772d0cdcb1 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\gjhxkmlsykkgxbav\w1jz56p.rtf.crab 16.59 KB MD5: f0223d5aa6a06a1e107b63a734f02a9d
SHA1: 28f1c71b7d6c5772c365ffe40a62bfdef186dc8b
SHA256: bd30c5411dabd6af1b4bb7bd9448bbc992cf6464cfc8e85999fc6d00b751ee03 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\infmx.rtf.crab 16.80 KB MD5: 785f4a9d1d98391cf2be197cf19a3347
SHA1: 884019e5c3956bb0af6033956b66ce02077b4a17
SHA256: a6e1fdf6a9f32cd39eec9375eeee82f056303585e23d6450ccf3740a5d9d3c86 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\p7vhk81.odt.crab 46.88 KB MD5: cd5c8980058edb6640ca6f107ca69523
SHA1: 569cebe2c580086a63b11a3a7b5696e12d4d3291
SHA256: 730e7c8cf478cb83b373f96d38784361a944df5b98e4f500c351124221886b5c 		False
...
c:\users\ciihmnxmn6ps\documents\rensrx bxvi\slvqy nv.xls.crab 81.99 KB MD5: 8824d6673df75f494044554c403c8abf
SHA1: 68371ab8fe1dca2d0b3f8d3a3ee2641a01ee8bff
SHA256: a6ec8a2731659f2f4dc2547a29a241d07dfcda8ef81a4ea897f71f5ba771a1b2 		False
...
c:\users\ciihmnxmn6ps\documents\sref7xwm5_gvgsyxb.xlsx.crab 31.38 KB MD5: b40162ad8a1cae8d4db63b87d30f78e8
SHA1: 8056afac939ff0da7a03cfbb6c6ec5a6a1e186dd
SHA256: f1f4009df51de730d201a3859501e24494bd10695cc9607ecdc799277fc4a0be 		False
...
c:\users\ciihmnxmn6ps\documents\wiotqafp.xlsx.crab 56.90 KB MD5: 792fcef866c55a218163ab562944868a
SHA1: 0d925417a4b7bf718f8b78fc98174fca3bdcc7e7
SHA256: 9bc3bba829f785b930792128c151a411899e84357f647168bbd7f5142ee9b7ea 		False
...
c:\users\ciihmnxmn6ps\documents\wjlz.ots.crab 74.01 KB MD5: c1a3fdde9739531e23f4e41a4f345d3c
SHA1: d84b1f66c5415d52ae5d03090cf0fa8b96f4b443
SHA256: bbe6465b9ef85ff87e6a53ae7f326c42d5dd92e57818bd4905ebd6a0c8186227 		False
...
c:\users\ciihmnxmn6ps\documents\x3fi0tmic2vnexjsxjg.pptx.crab 75.60 KB MD5: 680c21a820e4bd1b2134f54b7a38be1d
SHA1: 34d97eb900ad692ee00324ac05ba1f807716d44a
SHA256: a1e84bdd36a5f082aa6bbccdeacbde972a941409a7292fe771662da7f520890f 		False
...
c:\users\ciihmnxmn6ps\documents\ygz_en.xlsx.crab 91.82 KB MD5: aec3bd692f7de94195e5a905a2cd6e4d
SHA1: 32f00e99a3511a0c0bbe4604bc4b82bef6bb2c91
SHA256: 15aa80fe3f2194089a29b624ac532d701460f155c40026e796b78deee9edfe62 		False
...
c:\users\ciihmnxmn6ps\favorites\bing.url.crab 0.71 KB MD5: 15e7d62a76d141d5466d97a897ef44fc
SHA1: bbeefe9d07eef2c80ac7832e390bc43a5ae838ba
SHA256: 1a1490c7eb5ef5af8337e55f6555f81ae515f67c7501e7741558e5a681e27f0d 		False
...
c:\users\ciihmnxmn6ps\music\1--8xdi7df1\7x-uxrdw-f.mp3.crab 72.18 KB MD5: 59ababbf04a44442dbde06dc6c06c359
SHA1: 5e8b38de798ff6c8af86cdf9c4efebf6423ea804
SHA256: ed7a2ca95643dc32e1ee32aefc544cc000da479044555ad926c97fcc289ccced 		False
...
c:\users\ciihmnxmn6ps\music\gn6zlvgow-90.mp3.crab 65.51 KB MD5: 09afc7cba79904ecb2f6ed7feaffad2c
SHA1: 823c9914d06e26463f0e8c7bd75298ec667b88d8
SHA256: 3e47d48aa89d2312f2ee4bddb51836f28e0f7006d803eb39337732b7e9120439 		False
...
c:\users\ciihmnxmn6ps\music\k_vexripfdsg\gd-br4mvnsrkoekqv3me\9qwo4c8zjorx.mp3.crab 68.23 KB MD5: d09643e075eb24ddd12750e28cd479c3
SHA1: bd7ba3a1d3cb8d698de0d55078a84eb3e0f7db09
SHA256: 0388a27d94be45a20364d747f22e4c0ff68c2b32db94459294613867c14de0f3 		False
...
c:\users\ciihmnxmn6ps\music\k_vexripfdsg\gd-br4mvnsrkoekqv3me\encohvk6qw7vsaiqa.wav.crab 91.21 KB MD5: a2a855cc1dd27a62a9f91f4314470e1b
SHA1: 0ccaf191ce074fc45d4a8a89a77b9b591f9729a1
SHA256: ce8583dc3a879ed2b6f1061f7f06c2161b226e4036562a3e0053f5fb2af4cf49 		False
...
c:\users\ciihmnxmn6ps\music\k_vexripfdsg\gd-br4mvnsrkoekqv3me\hpr.m4a.crab 60.96 KB MD5: 0dc574d2adc817e1fa41b46442d209de
SHA1: 0210ffd635ce9f89159d77076e067acbf7a72bb3
SHA256: 3ac59e6137585de62868c372af69c4f4c2b76e276d696594e0ada700b402c8e5 		False
...
c:\users\ciihmnxmn6ps\music\k_vexripfdsg\msvctvzrrhie\qom5beoxwyraesjka.m4a.crab 55.96 KB MD5: 45e24fa2d058103f8422f1ae200d84e8
SHA1: 4e1fb612d950c9ce388a87212c348ffe613ad504
SHA256: 783f296ca85343bb1217ec201cad6f42e69add89706271d59904f192efd803db 		False
...
c:\users\ciihmnxmn6ps\music\k_vexripfdsg\msvctvzrrhie\y7jihpscbbek7mpw.mp3.crab 51.35 KB MD5: c37e5b9648df63e2b86abfb93c452f8e
SHA1: d031b0519445e4378b2164e0e36a0fb8798955d1
SHA256: 756df3063ee6ec6fb665e32f362ff30a44756931bc9da91ed1743889d9e031c7 		False
...
c:\users\ciihmnxmn6ps\music\l40xtt1txjimm1rw1lab\-weii.wav.crab 25.84 KB MD5: b680c56a388de3e45f8dc28739084e55
SHA1: a6bff1a49774fc56fba562b4dc3a90b2f5dbf924
SHA256: 61fe42f892bdb844139ff2bc6e94680ef1a842b93827c76161e620dfc399a809 		False
...
c:\users\ciihmnxmn6ps\music\l40xtt1txjimm1rw1lab\7zuz4x2opk2lbyp.m4a.crab 93.45 KB MD5: 93ea6a4eb50390c4786c70305311871f
SHA1: 14fda0b3741b106216365580ff48021c4e4a711f
SHA256: 2e9bef499c6814dbdba73c9441b6aa4c62d0f0faa1020fbb59c93e88b1a8f6bb 		False
...
c:\users\ciihmnxmn6ps\music\l40xtt1txjimm1rw1lab\8 r3ezoms3dr2.m4a.crab 40.59 KB MD5: 16a437ac596c9aeb2d2c5fb67162f503
SHA1: 0288b597195ee4e717e3b1cb31bd10a67c1dcd9d
SHA256: 80c37d637db3e608b12b4ef8ce8858dda47b1f1c9ac43cf5b4ec1d9eccccdb54 		False
...
c:\users\ciihmnxmn6ps\music\l40xtt1txjimm1rw1lab\kgskq4.mp3.crab 25.73 KB MD5: cc93139776c308872efa769899c086af
SHA1: d5aa1c99d049984494589150b3ae440a3ac47bc7
SHA256: a3f131026bd9cedf144228c26b57ac3d2c5595ee99fc2b362986c023e1c5fc21 		False
...
c:\users\ciihmnxmn6ps\music\l40xtt1txjimm1rw1lab\mhejq6.mp3.crab 31.91 KB MD5: 5e2963a81f61a73e44fc130fab5ad790
SHA1: 7d124bf3df399a569f003fd2fc05a7f5e100e5d7
SHA256: 6445bcd8c79ce5422147cc6f5bf78dd88fa5f304e1898f1a9ccc6a6a181aed0d 		False
...
c:\users\ciihmnxmn6ps\music\l40xtt1txjimm1rw1lab\xrecjkfeu_fah.mp3.crab 92.34 KB MD5: c479718f0ca71acc19b68f8f324f6987
SHA1: 9718f1556c6990cefec426eeaf0eee471a5894ad
SHA256: 82aa4ab68e38c513f283840d87bd0a0af0acd38c1cf90bf945fff00530df98db 		False
...
c:\users\ciihmnxmn6ps\music\ok1g2ycvnekbogktj3\0qkngc.mp3.crab 73.09 KB MD5: f18d7d6ff67dcd84364fd1779018ed2f
SHA1: 7b1af225e7b269f28ef82a99e5d73d252eec5bab
SHA256: 76a8915c476588dcdcdb77c127bd571c38397fee813c72d2fc8692d04f7ddfd0 		False
...
c:\users\ciihmnxmn6ps\music\ok1g2ycvnekbogktj3\3hijzuzqnq2kzakos8m.mp3.crab 46.05 KB MD5: 356ec8766303298e058444a4bdce22c3
SHA1: f1e2f8a34c9462ea3a4e1980f33d2a8dc895d805
SHA256: 9fefad91c8cc733cf035bfb810ad6c670864f1dc427935af5ceb164e7c900a60 		False
...
c:\users\ciihmnxmn6ps\music\ok1g2ycvnekbogktj3\6k1ojr.mp3.crab 99.30 KB MD5: cdb94ce411d9444f8faeb8f4577a7dba
SHA1: 3f376d3c0d369d2f93ffaf524fe67add47de45f9
SHA256: 83a17ccf62b00bfeb1b83f6ec818242af038bdaae82ac5faafd47fe9d0ee6b91 		False
...
c:\users\ciihmnxmn6ps\music\ok1g2ycvnekbogktj3\b01e0p5ykth6sn3p1c6.m4a.crab 57.99 KB MD5: 7691674da85a32cf075817350413afff
SHA1: a3e1ff2eff626f5c4a1f8143122e6d6f0ebf11a1
SHA256: b7489055c436892357d165ed2b710507629adb4b038d56b2af918243b199458b 		False
...
c:\users\ciihmnxmn6ps\music\ok1g2ycvnekbogktj3\ytgrmu7.m4a.crab 79.77 KB MD5: 9873681af1886b62e601f72570793935
SHA1: 2cb06510f85f5a93465f26113d738b13057d445f
SHA256: b76309537db100dde89c3183ef9a76d644c3e01e30bbe00de1d470e73e72e47e 		False
...
c:\users\ciihmnxmn6ps\music\wycj0v1uf-q.mp3.crab 86.96 KB MD5: 1d8037892a0481a681d936134a13985e
SHA1: a48f75ce0206bcf433306b1eb97a6b72a5aab889
SHA256: d76c5876bf32a9424bad00621f4951b8a77a6a8f8dbacee13c0c361ee727503c 		False
...
c:\users\ciihmnxmn6ps\music\xgxniqtynb3u\1ug76b.mp3.crab 23.71 KB MD5: 8c1d7d0a646c0c7a1a081b705ac8fca7
SHA1: f4f0a445210909a618cac322b2c9c0df9aa5ba71
SHA256: ff7c43edfdd0083d85e27a98210faca98b5de01b2bf53097e0db1e1bd78f4f58 		False
...
c:\users\ciihmnxmn6ps\music\xgxniqtynb3u\d 4ygq\7du38r0\0fjkglgy j6r.wav.crab 33.54 KB MD5: 4f617346739797d71d64fce658c90157
SHA1: ef509525180e13e1a710220d2a8baf39580dcfc8
SHA256: 1d141dfffdccd9d5914413bfa89f1f76655f7f629b60c72bc46017067c1c4cfb 		False
...
c:\users\ciihmnxmn6ps\music\xgxniqtynb3u\d 4ygq\7du38r0\ngk07c01.mp3.crab 13.12 KB MD5: 8e0cead87863b2724cf2315c59d61704
SHA1: b393256d92cc37dd9532fd5ae1f01aca95f83cae
SHA256: 09215bd5e6209da0736e57e9c1b6adad4fcb1e79936851c499e67c9e78e06f67 		False
...
c:\users\ciihmnxmn6ps\music\xgxniqtynb3u\d 4ygq\7du38r0\wvxi9rnqiunsinqf.m4a.crab 23.73 KB MD5: e79cc09794668685ffc4199ca2eee13a
SHA1: fb15e7df6dcc3bfc50fd827212c907407a88075c
SHA256: 0c72fb736e06ebd43631ff11ed47e2959169fbfcb8689b2e6e749ac91aafb1dd 		False
...
c:\users\ciihmnxmn6ps\music\xgxniqtynb3u\d 4ygq\hs hrp_tb4spsj.m4a.crab 72.93 KB MD5: 7654655d53e4e980da6b2655f717b2ea
SHA1: f0db8d15b616b7b08503e31fe8d7e67641f7595b
SHA256: 23c86ef87a54a96bbd834ecab676f7de8a73eb5ede9a0e83397a36a26240866a 		False
...
c:\users\ciihmnxmn6ps\music\xgxniqtynb3u\d 4ygq\kvova.mp3.crab 93.96 KB MD5: 6c4e3bfb37e98e6dea417c9716a48a57
SHA1: a442ea2be82d75c7f66e02ae0813f1bcbce9366f
SHA256: 8f31b72eaa32cb45eeb742474dd7b051a46703e5245026416d47e3c9146cc855 		False
...
c:\users\ciihmnxmn6ps\ntuser.ini.crab 0.54 KB MD5: 4043451c6f02a9bbadd86b1ce6389d9f
SHA1: 42bd3f440fa5308a1cb215fb4839acf36f3ac11b
SHA256: 4d1c81680b383e0bedf94919763a042d5a011ea2a53938aa0362be1202689ffd 		False
...
c:\users\ciihmnxmn6ps\pictures\bhre63k.bmp.crab 32.55 KB MD5: cf46e9bfed71dde37f4d99246444f6dd
SHA1: 957bc6a35c8647a8c20c26a506d7c4262dde3410
SHA256: 12c42619d6c6c74b54c6c74dff9bb02c7e37f525e12e5ac1645e6de7678082ac 		False
...
c:\users\ciihmnxmn6ps\pictures\emdw-2vvmbkywpg\djpgxthdxubqvap-5e.gif.crab 90.02 KB MD5: ae459ab279d1834af838926005cf96a2
SHA1: a9bd49e2710f075552b0412fa921cc321a7f1c12
SHA256: 30c15f2f7b334415602de67760f309c576ba5bd6bd166af1e7b970bec9c88e21 		False
...
c:\users\ciihmnxmn6ps\pictures\emdw-2vvmbkywpg\hszcmxprb-u3u oys7ta.gif.crab 19.93 KB MD5: 2f20b66a96d7987e19a61b8aaed26286
SHA1: 6e7e26e2dc52fa62eb7b861985be44144fc312a4
SHA256: 418bac9c33f666b1fe0527240ab55cf93dd5f4f1e1a1ba55a8927901849d5058 		False
...
c:\users\ciihmnxmn6ps\pictures\emdw-2vvmbkywpg\jt_xxjz2g-wxmxjr.gif.crab 62.76 KB MD5: acc089cefba0c374959adadd6cb3aee9
SHA1: 852da9fabdec88edc20eda19d3f980800587a2cb
SHA256: 0a831a802b45e597f81e837732a93fb74e927593a8c02cfb050499e6a5741b1f 		False
...
c:\users\ciihmnxmn6ps\pictures\emdw-2vvmbkywpg\j_hj6ddl.bmp.crab 38.65 KB MD5: 6fe6fe87c2f0a53237f4126d65e90e3f
SHA1: ff640417a757f0887f534058664d812b8acdcba5
SHA256: d632a3d99c3ed70484fea4288a8a664c5819d6c460d4295eb23cb54a64ef5d89 		False
...
c:\users\ciihmnxmn6ps\pictures\emdw-2vvmbkywpg\p1vcztz.gif.crab 27.74 KB MD5: 4c40778c58e197ead9d6fe0dcd9b7814
SHA1: 1863483a0afa7b50428d29eaebba51f7316dd28b
SHA256: 97c6f733c9cc0b12d8b54ca027e1f914216a7107861d41ed510c449b0b52ab5c 		False
...
c:\users\ciihmnxmn6ps\pictures\emdw-2vvmbkywpg\rke4_lpsq.png.crab 98.13 KB MD5: 479bb6999aff27e1ada137e52376d654
SHA1: e8dbbb63184bdef2a1a8a399b1a9b03ec2f46fcf
SHA256: 94d7ca2237e361cdea217a922c5c2f41777b9a3bc1713699be47737f6127ebd8 		False
...
c:\users\ciihmnxmn6ps\pictures\emdw-2vvmbkywpg\s9-scb.bmp.crab 12.60 KB MD5: a0a4b708c51d129a4ce772f0de6f143e
SHA1: 578fe67d5621d6990015adae70d492bd294c535f
SHA256: 7b747e0b0072525accb7693c806fb7def3b33de3c76bda38d8fa33e772364521 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\473g.jpg.crab 19.18 KB MD5: 334f61722798cb674bd28652158a7041
SHA1: ae98ebdb520a245deaf15b3ca8b3876d66b716ea
SHA256: 1fcad66c5b8b86f9e92880a743c40945015a5386a240003dc715d8ecc9c141de 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\amqfdngjy4o.jpg.crab 73.51 KB MD5: b8a8bdf57d58aead1e773bf65e1c94d9
SHA1: a5632889309e2c3a40e65e445b9b666fad612d32
SHA256: f75cde35cfe77322132bf9d81b7667eb50ddbe3fb7fb3faf2acb738dfa657c5e 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\buohfempre.jpg.crab 67.41 KB MD5: 348716b86f71490890c7f582093819e1
SHA1: ee5d68f3b9666a95fa15eef7dd3fee081952f413
SHA256: 8708fa447b19f8711396ba8ca40c7cef04ec257d9c669c10db58f60b91bcba05 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\iey co5h4fzbhesd.bmp.crab 46.13 KB MD5: 47f64c7322f91a055998193b0071ccc3
SHA1: f977865c1263f60287f181b7815b6fd83fac104a
SHA256: 51b83c0939f2221a11eaf7253c69d21fcd638a21e8a2bfe45f1494ddcb067a63 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\jbs_jsw6d4gmv-4ek.jpg.crab 17.15 KB MD5: d3bff70cf1e5285fd6f03dd81fee8aa3
SHA1: 6589c1f29623d9a670b4221baed7b072f13e7d69
SHA256: 2768a0feb2a2e4363b3740502345c7dc7abe9fec98ae564d3145ba65008e80b2 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\jnznjv9j40d-9m.jpg.crab 22.24 KB MD5: d9368069107e89da0b62937198d10a19
SHA1: 758083eceb774ec84348f7ec326dca4090a47db7
SHA256: ce713000280e5e2cb17d2689f5262525cae5f7d4b7bd398d64f78cffd9318995 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\jxloy6vp.jpg.crab 28.15 KB MD5: 59f1a75542e036bc8fe696ef6991ac2e
SHA1: 3a2fb0a7bf518d593c9ac1fc7bbfcbee159eb2cb
SHA256: 007b6f57091ea7a425712690f5585416ee1f97c71df09555bd0c8f6d40bdf7f0 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\ma1iybhpjupyivea4-y7.gif.crab 17.02 KB MD5: 798839f7799dd8985c4316397033a2db
SHA1: 00254121a045cb8cf347ae0913ff6165cbc8cf3d
SHA256: b65f113022188dece7ed01974b3754454ccb12a3a3a509ffc3df38c3c45f8960 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\mznx4c2ssis.gif.crab 82.65 KB MD5: d215f0c9fa55fcd505b7b7e3cda963b2
SHA1: 3f597926df630b180825b72891b0cb38b9fb0907
SHA256: 3c4db1b52d51207b6ac2af105f3c365c86c7a5d61517b4805db91cdeca760962 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\om69q_.bmp.crab 65.95 KB MD5: e34d96dbd7700e654bbd998be61f4da1
SHA1: aa909a43b3971392e6987abfda9a4afb12b9d3bf
SHA256: 234248aa2abe3b101e16d881709e41636f17199fc7847a28457c9ad9dbbde926 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\tpyetnsone.bmp.crab 32.87 KB MD5: c15c6bd5c362883696b803ec7122639a
SHA1: f8aa5e5067b02807106f74e277642eea9b740f78
SHA256: c8a84b58a37dd09b94185a92e6a0b2e1969a25e36306ef5f97a83ad9bc2e8139 		False
...
c:\users\ciihmnxmn6ps\pictures\fvwtvqcom\usccfktcqdpxz0b23.bmp.crab 44.13 KB MD5: 8c69db6364de5cec2087088e5c91d21d
SHA1: c88e9e03f43b32ce74b50971108d6b377fa1ff9d
SHA256: 44785c7116878406674795d17e074b54e108a7b1571b442ecf0d3665877d8a4c 		False
...
c:\users\ciihmnxmn6ps\pictures\hxnex.bmp.crab 23.43 KB MD5: 9dbe54b97c7ed2c07e32d1bedf77c72e
SHA1: 995433387f3e421d189509c2c84f3bb9024250ab
SHA256: 948737ec2c63269584b7b1dd948497af8fc6c94bae832e76b4373f31db22338f 		False
...
c:\users\ciihmnxmn6ps\pictures\m0u2.bmp.crab 49.51 KB MD5: 46936076a75851d1aa57226fb3b7f4ee
SHA1: eb38daa3543c797e114a7ca3576242c01f623fd5
SHA256: 52a34d0a1bb41fd4b3b5837cb90e1a0727e9a123a8890dda4493a973c3b20a1f 		False
...
c:\users\ciihmnxmn6ps\pictures\tvewlijmgni4xeavbp.jpg.crab 27.74 KB MD5: 9542bc663b48146028789e1091d5ea51
SHA1: ed1e019a327c90e4c0e69e63546a6190a43ee967
SHA256: 8aac6bc0c67e96d55d43f9dd8700df90d275b3380c765a7ac338d21b2ec1d353 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
c:\users\ciihmnxmn6ps\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b 0.05 KB MD5: eca0470178275ac94e5de381969ed232
SHA1: d6de27e734eec57d1dda73489b4a6d6eecae3038
SHA256: 353fd628b7f6e7d426e5d6a27d1bc3ac22fa7f812e7594cf2ec5ca1175785b50 		False
...
Host Behavior
File (3712)
»
Operation Filename Additional Information Success Count Logfile
Create C:\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\$Recycle.Bin\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\$Recycle.Bin\S-1-5-18\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\$Recycle.Bin\S-1-5-21-1462094071-1423818996-289466292-1000\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\bootmgr.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\Documents and Settings\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\PerfLogs\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Program Files\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Program Files (x86)\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Recovery\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Recovery\WindowsRE\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Recovery\WindowsRE\boot.sdi.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Recovery\WindowsRE\ReAgent.xml.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Recovery\WindowsRE\Winre.wim.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\System Volume Information\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\-aptbxD6MslmY.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1gKBEHrPxrolx-ZY_-U.wav.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3dl71al.ots.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5_YsSmLdETbcv.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7ZmdJ.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Collab\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Forms\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\NAHQNPMN\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\NativeCache\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Headlights\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Linguistics\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\Logs\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\BwTdTmskwyGRCN.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\C3frj774X4nv0sKEQ.wav.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\CFlAK.avi.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\DGARQQGdB9GTUF.xls.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\EJMEZC3s3HPF0.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ih3ViHu3-9Reh6AQ8.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ipQXaXHkPRTtGJe.doc.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\k5J5AL mWPRjcsWi.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Ko3T80Orcuc8i.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DQQHJZ8C\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\System.mdw.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\AddIns\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Credentials\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\XLSTART\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MMC\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\MSO1033.acl.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Database1.LNK.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Global.LNK.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\index.dat.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.srs.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.xml.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\PowerPoint\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Proof\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\CREDHIST.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\Preferred.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\SYNCHIST.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Speech\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Calendar insights.xltm.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Email Insights.xltm.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001106[[fn=Badge]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\1033\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Normal.dotm.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Basic Flowchart.xltx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Cross-Functional Flowchart.xltx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Stock symbols comparison.xltm.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Welcome to Excel.xltx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Vault\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\STARTUP\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Extensions\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20170518000419.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\addons.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-addons.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-gfx.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-plugins.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist.xml.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cert8.db.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\compatibility.ini.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\containers.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\content-prefs.sqlite.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cookies.sqlite.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\events\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\store.json.mozlz4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\session-state.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\state.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.ini.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\formhistory.sqlite.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\WINNT_x86-msvc\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\1.6\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\1.6\gmpopenh264.info.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\LICENSE.txt.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\manifest.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\key3.db.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\kinto.sqlite.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\mimeTypes.rdf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\minidumps\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\permissions.sqlite.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\places.sqlite.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\pluginreg.dat.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\prefs.js.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\revocations.txt.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\saved-telemetry-pings\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\saved-telemetry-pings\d896fec9-1a7a-4db1-a3a2-e46d95b631a5.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\search.json.mozlz4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\secmod.db.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionCheckpoints.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\previous.js.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\upgrade.js-20170518000419.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore.js.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\SiteSecurityServiceState.txt.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\.metadata.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\.metadata-v2.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.files\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata-v2.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\1.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\journals\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage.sqlite.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\times.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\webappsstore.sqlite.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\xulstore.json.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\profiles.ini.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\qFrAYm.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\qP-PLYd.pptx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RiyRN82h-Dm1.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RTueLjnR_9bIe.flv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\RootTools\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\RootTools\roottools.conf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\Java\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\Java\Deployment\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\uf4gQw0x.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\UPkeUeYo_.wav.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\w22V ZHMhZl.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\w5HI9YXcYm -rUNGtBmN.avi.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\WrsWD.xls.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\x_unj4TPd 60im5RNF3.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ZtZenx.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\_3RohTjUIFBhbbwK424G.wav.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Application Data\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Cookies\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\3KJZ5CnW.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\2OEFQ6Rgb6HPwHhmJPA.csv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\DDEJN6h\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\DDEJN6h\sx0ocsGKSJCgp9J9.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Jlp9olQMR7z1.flv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\2xQ_ZqyaAg4ec6JOci.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\4_aMsE53DIr-ZZL.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\Nt58.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\nX5fhOkRQcJO4.wav.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\rMycWF.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\iR _07ql.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\mNfKW5sLiolE.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\atOGshzT-fs_R.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\c-IJbz7.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\g0_N6bhAyR.avi.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\q5vqHXmTMJ4.mp4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\TCYNm2kjjQYR-gNXBB.ppt.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\5FJserSYCmlIRUj.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\5mt qNcQrohl8Jh7.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\5WEqa37voZWaL0.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\9LhBqme4cWT.flv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ANVzwlIBpGZS00RB.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\br-gqtLm.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\DE7vOMw9nSsRq3Fo_E_u.odp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Dg8DgWBQwEBMqE.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\dJ C_.avi.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\DObCmi0UpOSI1T-Vxh.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\e5AF.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Fm11jRMUXayTjHRH.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\HE Z.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\JeWuWHbrobJtl.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\JHZt3iiiUcb Vaqw3.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\k3_ooEknp.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\KOjjBtY0S dIpj6Z.mp4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\RE_25PzIyUZU-5TrnQ.avi.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Sb_c.pps.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\W-3Rm82 T5LTSQ3Tc4Hq.flv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\WQwVI3OVEeLHvpMViAe.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\_k0TTN23utSJHS.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\3jMj7b2_xXLf.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\6nHeGx5XLq5EwmT.csv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\d0lM.ods.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\h-g5N3xDxrR.xlsx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\MNjunrPg uRq0ZSMgo.rtf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\rbF2BbR.odp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\Rk 9WtPROew7RH5.ppt.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\XP3UOp.doc.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\XS65dqRLJbf.odp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\8mFOG-1f.doc.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\B3ZkQB-ZSZSc3PZm_b.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\dENumi0CHmUuCLYan.pptx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\dS08zE9zesO.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\1B9wqxp8sf4.pdf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\5yBc akPC.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\GGfhX-LI.pdf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\l6h1.doc.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\v510unVfL.xlsx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\eRf8\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\eRf8\-JikA2Dl.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\eRf8\2LNZDSU KD.xls.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\eRf8\jrZzQAcnFpZD.rtf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\eRf8\L57K8FrPlR5UtBGLbDV.xlsx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\eRf8\lKYM.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\eRf8\SeKqW6JaBfBQv4HUFE_y.rtf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\eRf8\wNWA1.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Gx5wLeXwdDWx.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\IRmpL-uIUtzT.xlsx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\K-Zutv2ySP4mx33k.xlsx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\LxvP2.pptx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\MDDc.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Music\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Pictures\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Videos\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\nHohi2XH7hhJ1XULB.pptx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\nHYvdq1sDmnUPheM.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\o wg.pptx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Od0i.xlsx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\pjtD9DGBT6Z.pptx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\697f9no2frYQ7uQiNjkd\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\697f9no2frYQ7uQiNjkd\4cua6KI.xlsx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\697f9no2frYQ7uQiNjkd\AzYu2GPDZxOtgX71b.odt.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\697f9no2frYQ7uQiNjkd\MlpDu3Vg.pps.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\697f9no2frYQ7uQiNjkd\y3UKhEf7m5rRBF5fy30F.ppt.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\0CblA7v6klufLAtkTS.pps.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\1QTfXNMoh.ods.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\9slkCoMWGUnOx.rtf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\EZzPCBkYnBq O.ots.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\L9626l.xls.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\n6M uQ2MsHyNyf.docx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\w1Jz56P.rtf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\INfmx.rtf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\P7VHk81.odt.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\slvQy nv.xls.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\SrEF7XwM5_gVgsyXb.xlsx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WioTqAfP.xlsx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WJLZ.ots.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\X3FI0TMic2vNeXJSXJg.pptx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Ygz_En.xlsx.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Downloads\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Favorites\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Favorites\Links\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Links\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\1--8xDi7DF1\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\1--8xDi7DF1\7x-Uxrdw-f.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\Gn6ZLvgow-90.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\gd-bR4MVNsrkOEkQV3mE\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\gd-bR4MVNsrkOEkQV3mE\9qwO4c8ZjORX.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\gd-bR4MVNsrkOEkQV3mE\encoHvK6qw7vsAIQa.wav.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\gd-bR4MVNsrkOEkQV3mE\hPr.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\khcADeHFsQ_-BqJbRWLF\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\MSVctvzrRHiE\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\MSVctvzrRHiE\qom5beoxWyraesjka.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\MSVctvzrRHiE\y7jIHpscbBek7MpW.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\-weii.wav.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\7ZUz4x2Opk2lByp.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\8 R3ezOMS3Dr2.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\KGSKq4.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\mhejQ6.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\XRecjKfeu_fah.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\0QkngC.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\3HIjzUzQNq2KZAkos8m.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\6k1ojR.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\B01e0p5Ykth6SN3P1c6.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\yTgRMU7.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\WyCj0V1UF-Q.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\1Ug76B.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\7Du38R0\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\7Du38R0\0FjkGLGy j6r.wav.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\7Du38R0\ngK07c01.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\7Du38R0\wvXi9RnqiuNsInQF.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\hs HrP_tb4SPsj.m4a.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\kvoVa.mp3.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\My Documents\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\NetHood\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\ntuser.ini.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\OneDrive\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\bHre63k.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Camera Roll\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\dJPGxthdXubQvAP-5E.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\HsZcMXPrb-u3U OYs7Ta.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\Jt_XXjz2g-wxMXjr.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\j_hj6ddl.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\P1VCZTz.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\RKe4_LPsQ.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\S9-sCB.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\473G.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\aMQfdnGJy4o.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\BuoHFemPRE.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\ieY CO5h4fzbhesd.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\jbS_JSW6D4gmv-4ek.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\jnznjV9j40d-9M.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\JxLoY6vp.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\MA1iYbhPjuPyIVEA4-Y7.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\MZNx4C2sSIS.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\om69q_.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\TpYeTnSoNE.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\uSccFKTcqDpXZ0b23.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\HXnEx.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\m0U2.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Saved Pictures\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\TVEWLiJmgNI4XEavbp.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\UwOT.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\VqlQE.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\-awB6MY480ljS6.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\-iKmIwyDN0tmJdYSMpq.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\-YoAvPzGyrkr7QCEd.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\1vAj.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\3zPkM.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\BdBV.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\Ez8wtL7OhAmdhY3YvQii.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\FC2MWl5JvoQDgcAqkM.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\is1Z4SxrfDvm.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\r4SNj0Amolglm-9yj.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\t9VgDGjCQlDYY5lz.bmp.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\vt5KdBbG.png.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\xBVuW.gif.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\yKteK2NrNxLETD9K.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\zUmk3oDYeT2c.jpg.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\PrintHood\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Recent\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Saved Games\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Searches\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\SendTo\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Start Menu\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Templates\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\-LIBJeB.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\072_Wm-3.flv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\2ecE31RRclYEyuAV2.mp4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\2XQLCZ_.avi.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\bsr8I.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\Di_9YBIuRcYv2nJKpD75.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\FigLYNPkxh2_Mb5L2k.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\Gxrq1--isWeldX.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\hJ5LsJ.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\hYFZlAom21rLvsFZ9-.mp4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\MRKrHjKlrll2nIC.mp4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\ph2zN.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\W4kv.mp4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\Wb_bkC.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\YGOfbl9z0rjl8tnX0q.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\zi3Y2qGopW6C.mp4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\_HrLj7MOat7F8VE.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\3L3eL.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\5zBN 4.flv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\9rPB.mp4.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\bR0hK.avi.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\BSMX2XChDQM5_QLUcWt.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\gpyNyVYYR.flv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\IonBn09.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\lmSFREt87EjrlWgk9.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\MVQlIQGkUG_.avi.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\nv0FlLK0SVqmCUiALk-K.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\q8PYk9.swf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\RMhqJExWuxDq4H3Vg7gS.flv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\Tvcjw.flv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\XXEJZht9.mkv.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\Default\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Local\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Local\Application Data\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\Default\AppData\Local\History\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\settings.ini.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\Default\AppData\Local\Temp\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Local\Temporary Internet Files\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Roaming\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Application Data\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\Default\Cookies\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Desktop\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Documents\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Documents\My Music\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Documents\My Pictures\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Documents\My Videos\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Downloads\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Favorites\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Links\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Music\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\Default\My Documents\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\Default\NetHood\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\NTUSER.DAT.LOG1.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\Default\NTUSER.DAT.LOG2.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\Default\Pictures\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\Default\PrintHood\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Recent\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Saved Games\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\SendTo\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Start Menu\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Templates\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Default\Videos\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\Default User\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\Public\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Public\AccountPictures\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Public\Documents\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Public\Documents\My Music\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Public\Documents\My Pictures\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Public\Documents\My Videos\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Public\Downloads\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Public\Libraries\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\Public\Libraries\RecordedTV.library-ms.CRAB desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\Public\Music\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\Public\Pictures\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Users\Public\Videos\\CRAB-DECRYPT.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Get Info C:\bootmgr type = file_attributes True 1
Fn
Get Info C:\Recovery\WindowsRE\boot.sdi type = file_attributes True 1
Fn
Get Info C:\Recovery\WindowsRE\ReAgent.xml type = file_attributes True 1
Fn
Get Info C:\Recovery\WindowsRE\Winre.wim type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\-aptbxD6MslmY.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\1gKBEHrPxrolx-ZY_-U.wav type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3dl71al.ots type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5_YsSmLdETbcv.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7ZmdJ.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\BwTdTmskwyGRCN.swf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\C3frj774X4nv0sKEQ.wav type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\CFlAK.avi type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\DGARQQGdB9GTUF.xls type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\EJMEZC3s3HPF0.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ih3ViHu3-9Reh6AQ8.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ipQXaXHkPRTtGJe.doc type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\k5J5AL mWPRjcsWi.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Ko3T80Orcuc8i.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\System.mdw type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\MSO1033.acl type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Database1.LNK type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Global.LNK type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\index.dat type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.srs type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.xml type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\CREDHIST type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\Preferred type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\SYNCHIST type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Calendar insights.xltm type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Email Insights.xltm type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001106[[fn=Badge]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Normal.dotm type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Basic Flowchart.xltx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Cross-Functional Flowchart.xltx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Stock symbols comparison.xltm type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Welcome to Excel.xltx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20170518000419 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\addons.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-addons.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-gfx.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-plugins.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist.xml type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cert8.db type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\compatibility.ini type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\containers.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\content-prefs.sqlite type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cookies.sqlite type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\store.json.mozlz4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\session-state.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\state.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.ini type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\formhistory.sqlite type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\1.6\gmpopenh264.info type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\LICENSE.txt type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\manifest.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\key3.db type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\kinto.sqlite type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\mimeTypes.rdf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\permissions.sqlite type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\places.sqlite type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\pluginreg.dat type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\prefs.js type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\revocations.txt type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\saved-telemetry-pings\d896fec9-1a7a-4db1-a3a2-e46d95b631a5 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\search.json.mozlz4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\secmod.db type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionCheckpoints.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\previous.js type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\upgrade.js-20170518000419 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore.js type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\SiteSecurityServiceState.txt type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\.metadata type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\.metadata-v2 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata-v2 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\1 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage.sqlite type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\times.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\webappsstore.sqlite type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\xulstore.json type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\profiles.ini type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\qFrAYm.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\qP-PLYd.pptx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RiyRN82h-Dm1.swf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RTueLjnR_9bIe.flv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\RootTools\roottools.conf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\uf4gQw0x.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\UPkeUeYo_.wav type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\w22V ZHMhZl.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\w5HI9YXcYm -rUNGtBmN.avi type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\WrsWD.xls type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\x_unj4TPd 60im5RNF3.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ZtZenx.swf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\_3RohTjUIFBhbbwK424G.wav type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\3KJZ5CnW.mkv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\2OEFQ6Rgb6HPwHhmJPA.csv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\DDEJN6h\sx0ocsGKSJCgp9J9.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Jlp9olQMR7z1.flv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\2xQ_ZqyaAg4ec6JOci.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\4_aMsE53DIr-ZZL.mkv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\Nt58.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\nX5fhOkRQcJO4.wav type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\dV-R\Tiny70xVQ\rMycWF.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\iR _07ql.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\mNfKW5sLiolE.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\atOGshzT-fs_R.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\c-IJbz7.mkv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\g0_N6bhAyR.avi type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\q5vqHXmTMJ4.mp4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4TLo9m8D\nO6Q\TCYNm2kjjQYR-gNXBB.ppt type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\5FJserSYCmlIRUj.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\5mt qNcQrohl8Jh7.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\5WEqa37voZWaL0.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\9LhBqme4cWT.flv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ANVzwlIBpGZS00RB.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\br-gqtLm.mkv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\DE7vOMw9nSsRq3Fo_E_u.odp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Dg8DgWBQwEBMqE.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\dJ C_.avi type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\DObCmi0UpOSI1T-Vxh.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\e5AF.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Fm11jRMUXayTjHRH.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\HE Z.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\JeWuWHbrobJtl.swf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\JHZt3iiiUcb Vaqw3.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\k3_ooEknp.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\KOjjBtY0S dIpj6Z.mp4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\RE_25PzIyUZU-5TrnQ.avi type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Sb_c.pps type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\W-3Rm82 T5LTSQ3Tc4Hq.flv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\WQwVI3OVEeLHvpMViAe.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\_k0TTN23utSJHS.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\3jMj7b2_xXLf.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\6nHeGx5XLq5EwmT.csv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\d0lM.ods type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\h-g5N3xDxrR.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\MNjunrPg uRq0ZSMgo.rtf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\rbF2BbR.odp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\Rk 9WtPROew7RH5.ppt type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\XP3UOp.doc type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\56opOOa0iPFXzV0\XS65dqRLJbf.odp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\8mFOG-1f.doc type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\B3ZkQB-ZSZSc3PZm_b.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\dENumi0CHmUuCLYan.pptx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\dS08zE9zesO.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\1B9wqxp8sf4.pdf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\5yBc akPC.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\GGfhX-LI.pdf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\l6h1.doc type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\dY3xTa\v510unVfL.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\eRf8\-JikA2Dl.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\eRf8\2LNZDSU KD.xls type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\eRf8\jrZzQAcnFpZD.rtf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\eRf8\L57K8FrPlR5UtBGLbDV.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\eRf8\lKYM.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\eRf8\SeKqW6JaBfBQv4HUFE_y.rtf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\eRf8\wNWA1.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Gx5wLeXwdDWx.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\IRmpL-uIUtzT.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\K-Zutv2ySP4mx33k.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\LxvP2.pptx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\MDDc.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\nHohi2XH7hhJ1XULB.pptx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\nHYvdq1sDmnUPheM.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\o wg.pptx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Od0i.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\pjtD9DGBT6Z.pptx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\697f9no2frYQ7uQiNjkd\4cua6KI.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\697f9no2frYQ7uQiNjkd\AzYu2GPDZxOtgX71b.odt type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\697f9no2frYQ7uQiNjkd\MlpDu3Vg.pps type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\697f9no2frYQ7uQiNjkd\y3UKhEf7m5rRBF5fy30F.ppt type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\0CblA7v6klufLAtkTS.pps type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\1QTfXNMoh.ods type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\9slkCoMWGUnOx.rtf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\EZzPCBkYnBq O.ots type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\L9626l.xls type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\n6M uQ2MsHyNyf.docx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\GJHxKMLsYkkGXBAV\w1Jz56P.rtf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\INfmx.rtf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\P7VHk81.odt type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\reNSRx BxVI\slvQy nv.xls type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\SrEF7XwM5_gVgsyXb.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\WioTqAfP.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\WJLZ.ots type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\X3FI0TMic2vNeXJSXJg.pptx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Ygz_En.xlsx type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\1--8xDi7DF1\7x-Uxrdw-f.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\Gn6ZLvgow-90.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\gd-bR4MVNsrkOEkQV3mE\9qwO4c8ZjORX.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\gd-bR4MVNsrkOEkQV3mE\encoHvK6qw7vsAIQa.wav type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\gd-bR4MVNsrkOEkQV3mE\hPr.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\MSVctvzrRHiE\qom5beoxWyraesjka.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\k_vexRIPfdSG\MSVctvzrRHiE\y7jIHpscbBek7MpW.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\-weii.wav type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\7ZUz4x2Opk2lByp.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\8 R3ezOMS3Dr2.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\KGSKq4.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\mhejQ6.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\l40xtt1TXJiMm1Rw1LaB\XRecjKfeu_fah.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\0QkngC.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\3HIjzUzQNq2KZAkos8m.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\6k1ojR.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\B01e0p5Ykth6SN3P1c6.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\OK1g2ycvNeKboGkTj3\yTgRMU7.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\WyCj0V1UF-Q.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\1Ug76B.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\7Du38R0\0FjkGLGy j6r.wav type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\7Du38R0\ngK07c01.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\7Du38R0\wvXi9RnqiuNsInQF.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\hs HrP_tb4SPsj.m4a type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\xGxnIQtYnb3u\D 4yGQ\kvoVa.mp3 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\ntuser.dat.LOG1 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\ntuser.dat.LOG2 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\ntuser.ini type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\bHre63k.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\dJPGxthdXubQvAP-5E.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\HsZcMXPrb-u3U OYs7Ta.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\Jt_XXjz2g-wxMXjr.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\j_hj6ddl.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\P1VCZTz.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\RKe4_LPsQ.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\eMDw-2VvMBkywPG\S9-sCB.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\473G.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\aMQfdnGJy4o.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\BuoHFemPRE.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\ieY CO5h4fzbhesd.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\jbS_JSW6D4gmv-4ek.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\jnznjV9j40d-9M.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\JxLoY6vp.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\MA1iYbhPjuPyIVEA4-Y7.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\MZNx4C2sSIS.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\om69q_.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\TpYeTnSoNE.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\FVwtvQCoM\uSccFKTcqDpXZ0b23.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\HXnEx.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\m0U2.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\TVEWLiJmgNI4XEavbp.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\UwOT.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\VqlQE.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\-awB6MY480ljS6.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\-iKmIwyDN0tmJdYSMpq.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\-YoAvPzGyrkr7QCEd.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\1vAj.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\3zPkM.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\BdBV.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\Ez8wtL7OhAmdhY3YvQii.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\FC2MWl5JvoQDgcAqkM.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\is1Z4SxrfDvm.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\r4SNj0Amolglm-9yj.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\t9VgDGjCQlDYY5lz.bmp type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\vt5KdBbG.png type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\xBVuW.gif type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\yKteK2NrNxLETD9K.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\WlhBF9\zUmk3oDYeT2c.jpg type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\-LIBJeB.mkv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\072_Wm-3.flv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\2ecE31RRclYEyuAV2.mp4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\2XQLCZ_.avi type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\bsr8I.swf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\Di_9YBIuRcYv2nJKpD75.swf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\FigLYNPkxh2_Mb5L2k.swf type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\Gxrq1--isWeldX.mkv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\hJ5LsJ.mkv type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\hYFZlAom21rLvsFZ9-.mp4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\MRKrHjKlrll2nIC.mp4 type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\23FVW2KUs\ph2zN.mkv type = file_attributes True 1
Fn
Move C:\Users\CIiHmnxMn6Ps\AppData\Roaming\w5HI9YXcYm -rUNGtBmN.avi.CRAB source_filename = C:\Users\CIiHmnxMn6Ps\AppData\Roaming\w5HI9YXcYm -rUNGtBmN.avi True 1
Fn
Read C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cookies.sqlite.CRAB size = 1048576, size_out = 524288 True 1
Fn
Read C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\places.sqlite.CRAB size = 1048576, size_out = 1048576 True 10
Fn
Read C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\places.sqlite.CRAB size = 1048576, size_out = 0 True 1
Fn
Write C:\Program Files\\CRAB-DECRYPT.txt size = 3278 True 1
Fn
Data
Write C:\Program Files (x86)\\CRAB-DECRYPT.txt size = 3278 True 1
Fn
Data
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\\CRAB-DECRYPT.txt size = 3278 True 1
Fn
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\\CRAB-DECRYPT.txt size = 3278 True 1
Fn
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\CRAB-DECRYPT.txt size = 3278 True 1
Fn
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\CRAB-DECRYPT.txt size = 3278 True 1
Fn
Write C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\CRAB-DECRYPT.txt size = 3278 True 1
Fn
For performance reasons, the remaining 1826 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (32)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters - True 1
Fn
Open Key HKEY_CURRENT_USER\Control Panel\International - True 1
Fn
Open Key HKEY_CURRENT_USER\Keyboard Layout\Preload - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 - True 2
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 - True 2
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters value_name = Domain, data = 0 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = ProcessorNameString, data = 73 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = Identifier, data = 73 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters value_name = Domain, data = 0 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = ProcessorNameString, data = 73 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = Identifier, data = 73 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters value_name = Domain, data = 0 True 1
Fn
Read Value HKEY_CURRENT_USER\Control Panel\International value_name = LocaleName, data = 101 True 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 1, data = 48 True 1
Fn
Read Value HKEY_CURRENT_USER\Keyboard Layout\Preload value_name = 2, data = 48 False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion value_name = productName, data = 87 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = ProcessorNameString, data = 73 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = Identifier, data = 73 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters value_name = Domain, data = 0 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = ProcessorNameString, data = 73 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 value_name = Identifier, data = 73 True 1
Fn
Process (2)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\wbem\wmic.exe show_window = SW_HIDE True 1
Fn
Create cmd.exe show_window = SW_HIDE True 1
Fn
Module (1704)
»
Operation Module Additional Information Success Count Logfile
Load KERNEL32.dll base_address = 0x77670000 True 1
Fn
Load USER32.dll base_address = 0x74d70000 True 1
Fn
Load ADVAPI32.dll base_address = 0x77990000 True 1
Fn
Load SHELL32.dll base_address = 0x755b0000 True 1
Fn
Load CRYPT32.dll base_address = 0x74eb0000 True 1
Fn
Load WININET.dll base_address = 0x74970000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x77670000 True 1
Fn
Get Handle c:\windows\syswow64\ntdll.dll base_address = 0x77c40000 True 7
Fn
Get Handle c:\windows\syswow64\advapi32.dll base_address = 0x77990000 True 775
Fn
Get Filename - process_name = c:\users\ciihmnxmn6ps\desktop\sample_file.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\sample_file.exe, size = 260 True 1
Fn
Get Filename - process_name = c:\users\ciihmnxmn6ps\desktop\sample_file.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\sample_file.exe, size = 256 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x7768a330 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x7768f400 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x77687580 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x77689910 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x77696030 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x77695f90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x77695ff0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadStackGuarantee, address_out = 0x7768a5d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x7768a690 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x77c740f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x77c6d630 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x77c6ecf0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x77695720 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x77c6e140 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x77c6eb60 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77ca9990 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x77ca5540 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x77c99dc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalProcessorInformation, address_out = 0x7768a550 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x776b0a40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetDefaultDllDirectories, address_out = 0x76aa0790 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x7768f8a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x7768fa30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x776b1030 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x7768a000 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x776b14b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x7768a4f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x776b16f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x77689970 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x76a23c90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x77688710 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleExW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandleW, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TerminateProcess, address_out = 0x7768fbc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VerifyVersionInfoW, address_out = 0x77687960 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForMultipleObjects, address_out = 0x776960f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteCriticalSection, address_out = 0x77c99920 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalFree, address_out = 0x776887c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x7768c8c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatA, address_out = 0x7768efc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MultiByteToWideChar, address_out = 0x77682d60 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32FirstW, address_out = 0x7768ee30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Process32NextW, address_out = 0x7768c9b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateToolhelp32Snapshot, address_out = 0x77697510 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LeaveCriticalSection, address_out = 0x77c85e00 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x77695f20 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x77696250 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x77696340 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpW, address_out = 0x776878d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileW, address_out = 0x7768a770 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x776961d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x77696290 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x77696510 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetNativeSystemInfo, address_out = 0x7768a410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetComputerNameW, address_out = 0x77693e90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x776877b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetWindowsDirectoryW, address_out = 0x77694cc0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVolumeInformationW, address_out = 0x77696450 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x7768d8d0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemDirectoryW, address_out = 0x77689a90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = OpenProcess, address_out = 0x776892b0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSection, address_out = 0x77c995f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForSingleObject, address_out = 0x77696110 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VerSetConditionMask, address_out = 0x77c953c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeW, address_out = 0x77696300 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcatW, address_out = 0x776ad320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsProcessorFeaturePresent, address_out = 0x77689680 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiW, address_out = 0x77687540 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenW, address_out = 0x77682d80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitThread, address_out = 0x77ca2570 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x77696180 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x77689560 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x77696590 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x77689660 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyA, address_out = 0x7768e320 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleA, address_out = 0x77689640 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x77688b70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcAddress, address_out = 0x77687940 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetProcessHeap, address_out = 0x77687910 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x77695fe0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcpyW, address_out = 0x776ad410 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x77682db0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x77696540 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocalAlloc, address_out = 0x77688840 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x776957f0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x776964a0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrcmpiA, address_out = 0x77687610 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x77688c70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceW, address_out = 0x776962e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x77689700 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapFree, address_out = 0x776825e0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x77682da0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = HeapAlloc, address_out = 0x77c7da90 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = lstrlenA, address_out = 0x77693a30 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnterCriticalSection, address_out = 0x77c85e80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x776974f0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfW, address_out = 0x74d9ddf0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x74decf50 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = wsprintfA, address_out = 0x74d9ea00 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = GetForegroundWindow, address_out = 0x74da50f0 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = CharUpperBuffW, address_out = 0x74da3140 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameW, address_out = 0x779b0ee0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x779aefa0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = OpenProcessToken, address_out = 0x779aee90 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetSidSubAuthority, address_out = 0x779b0ea0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetSidSubAuthorityCount, address_out = 0x779b0f50 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetTokenInformation, address_out = 0x779aed40 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptExportKey, address_out = 0x779af8f0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x779b0730 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGetKeyParam, address_out = 0x779c5c90 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x779b0ad0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptImportKey, address_out = 0x779af890 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptEncrypt, address_out = 0x779c5bd0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGenKey, address_out = 0x779b3fd0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyKey, address_out = 0x779afc10 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExW, address_out = 0x779aed60 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x779aed80 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = AllocateAndInitializeSid, address_out = 0x779af0c0 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = FreeSid, address_out = 0x779b04a0 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = SHGetSpecialFolderPathW, address_out = 0x7573edb0 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteW, address_out = 0x75744370 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteExW, address_out = 0x75744cb0 True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptBinaryToStringA, address_out = 0x74ed2290 True 1
Fn
Get Address c:\windows\syswow64\crypt32.dll function = CryptStringToBinaryA, address_out = 0x74ef8040 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetCloseHandle, address_out = 0x749f2410 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpAddRequestHeadersW, address_out = 0x74a3f750 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpSendRequestW, address_out = 0x749e4510 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetConnectW, address_out = 0x74a0b650 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = HttpOpenRequestW, address_out = 0x74a39fd0 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetOpenW, address_out = 0x749e2460 True 1
Fn
Get Address c:\windows\syswow64\wininet.dll function = InternetReadFile, address_out = 0x749e11e0 True 1
Fn
Get Address c:\windows\syswow64\ntdll.dll function = RtlComputeCrc32, address_out = 0x77c66b10 True 7
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGenRandom, address_out = 0x779b0df0 True 774
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CheckTokenMembership, address_out = 0x779af8d0 True 1
Fn
System (13)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = LHNIWSJ True 1
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Sleep duration = -1 (infinite) True 1
Fn
Get Time type = Ticks, time = 109000 True 1
Fn
Get Time type = Ticks, time = 112281 True 1
Fn
Get Time type = Ticks, time = 144312 True 2
Fn
Get Info type = Windows Directory, result_out = C:\Windows True 4
Fn
Get Info type = Hardware Information True 1
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 1
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = Global\pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def True 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Network Behavior
HTTP Sessions (3)
»
Information Value
Total Data Sent 727 bytes
Total Data Received 566 bytes
Contacted Host Count 2
Contacted Hosts ipv4bot.whatismyipaddress.com, 5.39.221.60
HTTP Session #1
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name ipv4bot.whatismyipaddress.com
Server Port 80
Data Sent 255
Data Received 14
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = ipv4bot.whatismyipaddress.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP/1.1, target_resource = /, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Add HTTP Request Headers headers = Host: yahoo.com True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = ipv4bot.whatismyipaddress.com/ True 1
Fn
Read Response size = 10238, size_out = 14 True 1
Fn
Data
Read Response size = 10238, size_out = 0 True 1
Fn
Close Session - True 6
Fn
HTTP Session #2
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name 5.39.221.60
Server Port 80
Data Sent 244
Data Received 552
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = 5.39.221.60, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = aibeege?erza=ai&ayplea=s, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Add HTTP Request Headers headers = Host: yahoo.com True 1
Fn
Send HTTP Request headers = Content-Type: application/x-www-form-urlencoded, url = 5.39.221.60/aibeege?erza=ai&ayplea=s True 1
Fn
Data
Read Response size = 204798, size_out = 552 True 1
Fn
Data
Read Response size = 204798, size_out = 0 True 1
Fn
Close Session - True 6
Fn
HTTP Session #3
»
Information Value
User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Server Name 5.39.221.60
Server Port 80
Data Sent 228
Data Received 0
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = 5.39.221.60, server_port = 80 True 1
Fn
Open HTTP Request http_verb = POST, http_version = HTTP/1.1, target_resource = eadeayza, accept_types = 0, flags = INTERNET_FLAG_PRAGMA_NOCACHE, INTERNET_FLAG_NO_UI, INTERNET_FLAG_HYPERLINK, INTERNET_FLAG_IGNORE_CERT_CN_INVALID, INTERNET_FLAG_IGNORE_CERT_DATE_INVALID, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS, INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP, INTERNET_FLAG_NO_AUTH, INTERNET_FLAG_NO_CACHE_WRITE, INTERNET_FLAG_RELOAD True 1
Fn
Add HTTP Request Headers headers = Host: yahoo.com True 1
Fn
Send HTTP Request headers = Content-Type: application/x-www-form-urlencoded, url = 5.39.221.60/eadeayza True 1
Fn
Data
Read Response size = 204798, size_out = 0 True 1
Fn
Close Session - True 6
Fn
Process #2: wmic.exe
16 0
»
Information Value
ID #2
File Name c:\windows\syswow64\wbem\wmic.exe
Command Line "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:01:07, Reason: Child Process
Unmonitor End Time: 00:02:20, Reason: Terminated by Timeout
Monitor Duration 00:01:13
OS Process Information
»
Information Value
PID 0xaec
Parent PID 0xec (c:\users\ciihmnxmn6ps\desktop\sample_file.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 344
0x 910
0x 928
0x A94
0x A54
0x A88
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
wmic.exe 0x00140000 0x001a3fff Memory Mapped File Readable, Writable, Executable True False False -
pagefile_0x00000000004a0000 0x004a0000 0x0449ffff Pagefile Backed Memory - True False False -
private_0x00000000044a0000 0x044a0000 0x044bffff Private Memory Readable, Writable True False False -
pagefile_0x00000000044a0000 0x044a0000 0x044affff Pagefile Backed Memory Readable, Writable True False False -
private_0x00000000044b0000 0x044b0000 0x044b3fff Private Memory Readable, Writable True False False -
private_0x00000000044c0000 0x044c0000 0x044c1fff Private Memory Readable, Writable True False False -
pagefile_0x00000000044c0000 0x044c0000 0x044c0fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000044d0000 0x044d0000 0x044e3fff Pagefile Backed Memory Readable True False False -
private_0x00000000044f0000 0x044f0000 0x0452ffff Private Memory Readable, Writable True False False -
private_0x0000000004530000 0x04530000 0x0456ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000004570000 0x04570000 0x04573fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000004580000 0x04580000 0x04580fff Pagefile Backed Memory Readable True False False -
private_0x0000000004590000 0x04590000 0x04591fff Private Memory Readable, Writable True False False -
locale.nls 0x045a0000 0x0465dfff Memory Mapped File Readable False False False -
pagefile_0x0000000004660000 0x04660000 0x04660fff Pagefile Backed Memory Readable True False False -
private_0x0000000004670000 0x04670000 0x0467ffff Private Memory Readable, Writable True False False -
private_0x0000000004680000 0x04680000 0x046bffff Private Memory Readable, Writable True False False -
private_0x00000000046c0000 0x046c0000 0x046fffff Private Memory Readable, Writable True False False -
private_0x0000000004700000 0x04700000 0x0473ffff Private Memory Readable, Writable True False False -
private_0x0000000004740000 0x04740000 0x0477ffff Private Memory Readable, Writable True False False -
private_0x0000000004780000 0x04780000 0x04783fff Private Memory Readable, Writable True False False -
private_0x0000000004790000 0x04790000 0x047affff Private Memory Readable, Writable True False False -
msxml3r.dll 0x04790000 0x04790fff Memory Mapped File Readable False False False -
private_0x00000000047a0000 0x047a0000 0x047affff Private Memory Readable, Writable True False False -
private_0x00000000047b0000 0x047b0000 0x048affff Private Memory Readable, Writable True False False -
ole32.dll 0x048b0000 0x04998fff Memory Mapped File Readable False False False -
private_0x00000000048b0000 0x048b0000 0x049effff Private Memory Readable, Writable True False False -
private_0x00000000048b0000 0x048b0000 0x049affff Private Memory Readable, Writable True False False -
private_0x00000000048b0000 0x048b0000 0x0499ffff Private Memory Readable, Writable True False False -
private_0x00000000048b0000 0x048b0000 0x0494ffff Private Memory Readable, Writable True False False -
private_0x00000000048b0000 0x048b0000 0x048cffff Private Memory - True False False -
imm32.dll 0x048d0000 0x048f9fff Memory Mapped File Readable False False False -
wmic.exe.mui 0x048d0000 0x048dffff Memory Mapped File Readable False False False -
private_0x00000000048e0000 0x048e0000 0x048e0fff Private Memory Readable, Writable True False False -
private_0x00000000048f0000 0x048f0000 0x048f0fff Private Memory Readable, Writable True False False -
pagefile_0x0000000004900000 0x04900000 0x04900fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000004900000 0x04900000 0x04903fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000004910000 0x04910000 0x0491cfff Pagefile Backed Memory Readable, Writable True False False -
wmiutils.dll.mui 0x04910000 0x04914fff Memory Mapped File Readable False False False -
private_0x0000000004940000 0x04940000 0x0494ffff Private Memory Readable, Writable True False False -
private_0x0000000004950000 0x04950000 0x0498ffff Private Memory Readable, Writable True False False -
private_0x0000000004990000 0x04990000 0x0499ffff Private Memory Readable, Writable True False False -
private_0x00000000049a0000 0x049a0000 0x049affff Private Memory Readable, Writable True False False -
private_0x00000000049e0000 0x049e0000 0x049effff Private Memory Readable, Writable True False False -
private_0x00000000049f0000 0x049f0000 0x04a2ffff Private Memory Readable, Writable True False False -
private_0x0000000004a60000 0x04a60000 0x04a6ffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x04a70000 0x04da6fff Memory Mapped File Readable False False False -
kernelbase.dll.mui 0x04db0000 0x04e8efff Memory Mapped File Readable False False False -
private_0x0000000004e90000 0x04e90000 0x0528ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000005290000 0x05290000 0x05417fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000005420000 0x05420000 0x055a0fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000055b0000 0x055b0000 0x069affff Pagefile Backed Memory Readable True False False -
private_0x00000000069b0000 0x069b0000 0x06a3ffff Private Memory Readable, Writable True False False -
private_0x00000000069b0000 0x069b0000 0x069effff Private Memory Readable, Writable True False False -
private_0x00000000069f0000 0x069f0000 0x06a2ffff Private Memory Readable, Writable True False False -
private_0x0000000006a30000 0x06a30000 0x06a3ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000006a40000 0x06a40000 0x06af7fff Pagefile Backed Memory Readable True False False -
private_0x0000000006b00000 0x06b00000 0x06bfffff Private Memory Readable, Writable True False False -
private_0x0000000006c00000 0x06c00000 0x06c3ffff Private Memory Readable, Writable True False False -
private_0x0000000006c40000 0x06c40000 0x06c7ffff Private Memory Readable, Writable True False False -
wow64.dll 0x59300000 0x5934efff Memory Mapped File Readable, Writable, Executable False False False -
wow64cpu.dll 0x59350000 0x59357fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x59360000 0x593d2fff Memory Mapped File Readable, Writable, Executable False False False -
wmiutils.dll 0x74120000 0x7413dfff Memory Mapped File Readable, Writable, Executable False False False -
fastprox.dll 0x74160000 0x7421bfff Memory Mapped File Readable, Writable, Executable False False False -
wbemsvc.dll 0x74220000 0x74230fff Memory Mapped File Readable, Writable, Executable False False False -
rsaenh.dll 0x74240000 0x7426efff Memory Mapped File Readable, Writable, Executable False False False -
cryptsp.dll 0x74270000 0x74282fff Memory Mapped File Readable, Writable, Executable False False False -
wininet.dll 0x74290000 0x744b3fff Memory Mapped File Readable, Writable, Executable False False False -
iertutil.dll 0x744c0000 0x74780fff Memory Mapped File Readable, Writable, Executable False False False -
urlmon.dll 0x74790000 0x748effff Memory Mapped File Readable, Writable, Executable False False False -
msxml3.dll 0x748f0000 0x74a7ffff Memory Mapped File Readable, Writable, Executable False False False -
bcrypt.dll 0x74a80000 0x74a9afff Memory Mapped File Readable, Writable, Executable False False False -
wbemcomn.dll 0x74aa0000 0x74b05fff Memory Mapped File Readable, Writable, Executable False False False -
wbemprox.dll 0x74b10000 0x74b1cfff Memory Mapped File Readable, Writable, Executable False False False -
framedynos.dll 0x74b20000 0x74b5efff Memory Mapped File Readable, Writable, Executable False False False -
winnsi.dll 0x74b60000 0x74b67fff Memory Mapped File Readable, Writable, Executable False False False -
iphlpapi.dll 0x74b70000 0x74b9ffff Memory Mapped File Readable, Writable, Executable False False False -
dwmapi.dll 0x74ba0000 0x74bbcfff Memory Mapped File Readable, Writable, Executable False False False -
uxtheme.dll 0x74bc0000 0x74c34fff Memory Mapped File Readable, Writable, Executable False False False -
bcryptprimitives.dll 0x74ce0000 0x74d38fff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x74d40000 0x74d49fff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x74d50000 0x74d6dfff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x74d70000 0x74eaffff Memory Mapped File Readable, Writable, Executable False False False -
shlwapi.dll 0x75080000 0x750c3fff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x76970000 0x76ae5fff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x76ca0000 0x76decfff Memory Mapped File Readable, Writable, Executable False False False -
kernel.appcore.dll 0x76f60000 0x76f6bfff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x76f70000 0x7708ffff Memory Mapped File Readable, Writable, Executable False False False -
combase.dll 0x77090000 0x77249fff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x77250000 0x77292fff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x77430000 0x77519fff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x775e0000 0x7760afff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x77670000 0x7775ffff Memory Mapped File Readable, Writable, Executable False False False -
clbcatq.dll 0x77760000 0x777e1fff Memory Mapped File Readable, Writable, Executable False False False -
shcore.dll 0x778a0000 0x7792cfff Memory Mapped File Readable, Writable, Executable False False False -
ws2_32.dll 0x77930000 0x7798bfff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x77990000 0x77a0afff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x77a10000 0x77acdfff Memory Mapped File Readable, Writable, Executable False False False -
nsi.dll 0x77ad0000 0x77ad6fff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x77af0000 0x77b9bfff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x77ba0000 0x77c31fff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77c40000 0x77db8fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x000000007e827000 0x7e827000 0x7e829fff Private Memory Readable, Writable True False False -
private_0x000000007e82a000 0x7e82a000 0x7e82cfff Private Memory Readable, Writable True False False -
private_0x000000007e82d000 0x7e82d000 0x7e82ffff Private Memory Readable, Writable True False False -
pagefile_0x000000007e830000 0x7e830000 0x7e92ffff Pagefile Backed Memory Readable True False False -
pagefile_0x000000007e930000 0x7e930000 0x7e952fff Pagefile Backed Memory Readable True False False -
private_0x000000007e953000 0x7e953000 0x7e953fff Private Memory Readable, Writable True False False -
private_0x000000007e954000 0x7e954000 0x7e954fff Private Memory Readable, Writable True False False -
private_0x000000007e957000 0x7e957000 0x7e959fff Private Memory Readable, Writable True False False -
private_0x000000007e95a000 0x7e95a000 0x7e95cfff Private Memory Readable, Writable True False False -
private_0x000000007e95d000 0x7e95d000 0x7e95ffff Private Memory Readable, Writable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfc03e6ffff Private Memory Readable True False False -
pagefile_0x00007dfc03e70000 0x7dfc03e70000 0x7ffc03e6ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffc03e70000 0x7ffc04031fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x00007ffc04032000 0x7ffc04032000 0x7ffffffeffff Private Memory Readable True False False -
Host Behavior
COM (6)
»
Operation Class Interface Additional Information Success Count Logfile
Create WBEMLocator IWbemLocator cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create F6D90F12-9C73-11D3-B32E-00C04F990BB4 2933BF95-7B36-11D2-B20E-00C04F983E60 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create EB87E1BD-3233-11D2-AEC9-00C04FB68820 EB87E1BC-3233-11D2-AEC9-00C04FB68820 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = root\cli True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = root\cli\ms_409 True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = \\LHNIWSJ\ROOT\CIMV2 True 1
Fn
Registry (5)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging, data = 48 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging Directory True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging Directory, data = 37 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Log File Max Size, data = 54 True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\wbem\wmic.exe base_address = 0x140000 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = LHNIWSJ True 1
Fn
Get Time type = Local Time, time = 2018-06-04 21:30:51 (Local Time) True 1
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 1
Fn
Process #4: cmd.exe
55 0
»
Information Value
ID #4
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /c shutdown -r -t 60 -f
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:01:09, Reason: Child Process
Unmonitor End Time: 00:02:20, Reason: Terminated by Timeout
Monitor Duration 00:01:11
OS Process Information
»
Information Value
PID 0xafc
Parent PID 0xec (c:\users\ciihmnxmn6ps\desktop\sample_file.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 7D0
0x 930
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x00000000005d0000 0x005d0000 0x005effff Private Memory Readable, Writable True False False -
pagefile_0x00000000005d0000 0x005d0000 0x005dffff Pagefile Backed Memory Readable, Writable True False False -
private_0x00000000005e0000 0x005e0000 0x005e3fff Private Memory Readable, Writable True False False -
private_0x00000000005f0000 0x005f0000 0x005f1fff Private Memory Readable, Writable True False False -
private_0x00000000005f0000 0x005f0000 0x005f3fff Private Memory Readable, Writable True False False -
pagefile_0x0000000000600000 0x00600000 0x00613fff Pagefile Backed Memory Readable True False False -
private_0x0000000000620000 0x00620000 0x0065ffff Private Memory Readable, Writable True False False -
private_0x0000000000660000 0x00660000 0x0075ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000760000 0x00760000 0x00763fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000000770000 0x00770000 0x00770fff Pagefile Backed Memory Readable True False False -
private_0x0000000000780000 0x00780000 0x00781fff Private Memory Readable, Writable True False False -
locale.nls 0x00790000 0x0084dfff Memory Mapped File Readable False False False -
private_0x0000000000860000 0x00860000 0x0086ffff Private Memory Readable, Writable True False False -
private_0x0000000000870000 0x00870000 0x0096ffff Private Memory Readable, Writable True False False -
private_0x0000000000970000 0x00970000 0x009affff Private Memory Readable, Writable True False False -
private_0x00000000009b0000 0x009b0000 0x00aaffff Private Memory Readable, Writable True False False -
private_0x0000000000b00000 0x00b00000 0x00b0ffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x00b10000 0x00e46fff Memory Mapped File Readable False False False -
cmd.exe 0x00f30000 0x00f7ffff Memory Mapped File Readable, Writable, Executable True False False -
pagefile_0x0000000000f80000 0x00f80000 0x04f7ffff Pagefile Backed Memory - True False False -
wow64.dll 0x59300000 0x5934efff Memory Mapped File Readable, Writable, Executable False False False -
wow64cpu.dll 0x59350000 0x59357fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x59360000 0x593d2fff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x76970000 0x76ae5fff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x77670000 0x7775ffff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x77a10000 0x77acdfff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77c40000 0x77db8fff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x000000007f820000 0x7f820000 0x7f91ffff Pagefile Backed Memory Readable True False False -
pagefile_0x000000007f920000 0x7f920000 0x7f942fff Pagefile Backed Memory Readable True False False -
private_0x000000007f943000 0x7f943000 0x7f943fff Private Memory Readable, Writable True False False -
private_0x000000007f946000 0x7f946000 0x7f946fff Private Memory Readable, Writable True False False -
private_0x000000007f94a000 0x7f94a000 0x7f94cfff Private Memory Readable, Writable True False False -
private_0x000000007f94d000 0x7f94d000 0x7f94ffff Private Memory Readable, Writable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfc03e6ffff Private Memory Readable True False False -
pagefile_0x00007dfc03e70000 0x7dfc03e70000 0x7ffc03e6ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffc03e70000 0x7ffc04031fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x00007ffc04032000 0x7ffc04032000 0x7ffffffeffff Private Memory Readable True False False -
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\CIiHmnxMn6Ps\Desktop type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 184, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\shutdown.exe os_pid = 0xaa0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0xf30000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x77670000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x776b2780 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x7768fa80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x7768a790 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76a835c0 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\CIiHmnxMn6Ps\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #6: shutdown.exe
0 0
»
Information Value
ID #6
File Name c:\windows\syswow64\shutdown.exe
Command Line shutdown -r -t 60 -f
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:01:11, Reason: Child Process
Unmonitor End Time: 00:02:20, Reason: Terminated by Timeout
Monitor Duration 00:01:09
Remarks No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xaa0
Parent PID 0xafc (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9F4
0x A94
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000710000 0x00710000 0x0072ffff Private Memory Readable, Writable True False False -
pagefile_0x0000000000710000 0x00710000 0x0071ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000000000720000 0x00720000 0x00723fff Private Memory Readable, Writable True False False -
private_0x0000000000730000 0x00730000 0x00731fff Private Memory Readable, Writable True False False -
shutdown.exe.mui 0x00730000 0x00733fff Memory Mapped File Readable False False False -
pagefile_0x0000000000740000 0x00740000 0x00753fff Pagefile Backed Memory Readable True False False -
private_0x0000000000760000 0x00760000 0x0079ffff Private Memory Readable, Writable True False False -
private_0x00000000007a0000 0x007a0000 0x007dffff Private Memory Readable, Writable True False False -
pagefile_0x00000000007e0000 0x007e0000 0x007e3fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000000007f0000 0x007f0000 0x007f0fff Pagefile Backed Memory Readable True False False -
private_0x0000000000800000 0x00800000 0x00801fff Private Memory Readable, Writable True False False -
private_0x0000000000810000 0x00810000 0x0084ffff Private Memory Readable, Writable True False False -
private_0x0000000000850000 0x00850000 0x0088ffff Private Memory Readable, Writable True False False -
private_0x0000000000890000 0x00890000 0x00890fff Private Memory Readable, Writable True False False -
private_0x00000000008a0000 0x008a0000 0x008a0fff Private Memory Readable, Writable True False False -
user32.dll.mui 0x008b0000 0x008b4fff Memory Mapped File Readable False False False -
shutdown.exe 0x008c0000 0x008cafff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x00000000008d0000 0x008d0000 0x048cffff Pagefile Backed Memory - True False False -
locale.nls 0x048d0000 0x0498dfff Memory Mapped File Readable False False False -
private_0x0000000004a90000 0x04a90000 0x04a9ffff Private Memory Readable, Writable True False False -
private_0x0000000004aa0000 0x04aa0000 0x04aaffff Private Memory Readable, Writable True False False -
private_0x0000000004c00000 0x04c00000 0x04cfffff Private Memory Readable, Writable True False False -
pagefile_0x0000000004d00000 0x04d00000 0x04e87fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000004e90000 0x04e90000 0x05010fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000000005020000 0x05020000 0x0641ffff Pagefile Backed Memory Readable True False False -
wow64.dll 0x59300000 0x5934efff Memory Mapped File Readable, Writable, Executable False False False -
wow64cpu.dll 0x59350000 0x59357fff Memory Mapped File Readable, Writable, Executable False False False -
wow64win.dll 0x59360000 0x593d2fff Memory Mapped File Readable, Writable, Executable False False False -
bcryptprimitives.dll 0x74ce0000 0x74d38fff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x74d40000 0x74d49fff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x74d50000 0x74d6dfff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x74d70000 0x74eaffff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x76970000 0x76ae5fff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x76ca0000 0x76decfff Memory Mapped File Readable, Writable, Executable False False False -
msctf.dll 0x76f70000 0x7708ffff Memory Mapped File Readable, Writable, Executable False False False -
combase.dll 0x77090000 0x77249fff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x77250000 0x77292fff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x77430000 0x77519fff Memory Mapped File Readable, Writable, Executable False False False -
imm32.dll 0x775e0000 0x7760afff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x77670000 0x7775ffff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x77990000 0x77a0afff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x77a10000 0x77acdfff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x77af0000 0x77b9bfff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x77c40000 0x77db8fff Memory Mapped File Readable, Writable, Executable False False False -
pagefile_0x000000007f950000 0x7f950000 0x7fa4ffff Pagefile Backed Memory Readable True False False -
pagefile_0x000000007fa50000 0x7fa50000 0x7fa72fff Pagefile Backed Memory Readable True False False -
private_0x000000007fa78000 0x7fa78000 0x7fa7afff Private Memory Readable, Writable True False False -
private_0x000000007fa7b000 0x7fa7b000 0x7fa7dfff Private Memory Readable, Writable True False False -
private_0x000000007fa7e000 0x7fa7e000 0x7fa7efff Private Memory Readable, Writable True False False -
private_0x000000007fa7f000 0x7fa7f000 0x7fa7ffff Private Memory Readable, Writable True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfc03e6ffff Private Memory Readable True False False -
pagefile_0x00007dfc03e70000 0x7dfc03e70000 0x7ffc03e6ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffc03e70000 0x7ffc04031fff Memory Mapped File Readable, Writable, Executable False False False -
private_0x00007ffc04032000 0x7ffc04032000 0x7ffffffeffff Private Memory Readable True False False -
Process #7: svchost.exe
0 0
»
Information Value
ID #7
File Name c:\windows\system32\svchost.exe
Command Line C:\Windows\system32\svchost.exe -k netsvcs
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:13, Reason: RPC Server
Unmonitor End Time: 00:02:20, Reason: Terminated by Timeout
Monitor Duration 00:01:07
Remarks No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x378
Parent PID 0x1e4 (c:\windows\system32\services.exe)
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 9A0
0x 420
0x 90C
0x 98C
0x 2EC
0x 718
0x 9C8
0x 354
0x A24
0x 820
0x B0C
0x 32C
0x 670
0x 40
0x 2D0
0x BF4
0x B2C
0x 8C0
0x B48
0x 298
0x 390
0x AE0
0x 4D0
0x 798
0x 878
0x 870
0x 784
0x 780
0x 754
0x 750
0x 740
0x 73C
0x 738
0x 734
0x 688
0x 730
0x 724
0x 71C
0x 70C
0x 708
0x 6F4
0x 6EC
0x 6D4
0x 6B4
0x 694
0x 680
0x 664
0x 650
0x 64C
0x 630
0x 628
0x 5F8
0x 5E4
0x 5CC
0x 5C4
0x 574
0x 558
0x 530
0x 4DC
0x 414
0x 118
0x FC
0x 140
0x 1A0
0x 14C
0x 154
0x 130
0x 160
0x F8
0x 3DC
0x 3D8
0x 3D0
0x 3CC
0x 3C8
0x 37C
0x 52C
0x C4C
0x C50
0x CB4
0x CC0
0x CD4
0x CD8
0x CEC
0x CFC
0x D9C
0x DB0
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
pagefile_0x00000051e5e10000 0x51e5e10000 0x51e5e1ffff Pagefile Backed Memory Readable, Writable True False False -
svchost.exe.mui 0x51e5e20000 0x51e5e20fff Memory Mapped File Readable False False False -
pagefile_0x00000051e5e30000 0x51e5e30000 0x51e5e43fff Pagefile Backed Memory Readable True False False -
private_0x00000051e5e50000 0x51e5e50000 0x51e5ecffff Private Memory Readable, Writable True False False -
pagefile_0x00000051e5ed0000 0x51e5ed0000 0x51e5ed3fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000051e5ee0000 0x51e5ee0000 0x51e5ee0fff Pagefile Backed Memory Readable True False False -
private_0x00000051e5ef0000 0x51e5ef0000 0x51e5ef1fff Private Memory Readable, Writable True False False -
locale.nls 0x51e5f00000 0x51e5fbdfff Memory Mapped File Readable False False False -
private_0x00000051e5fc0000 0x51e5fc0000 0x51e5fc0fff Private Memory Readable, Writable True False False -
private_0x00000051e5fd0000 0x51e5fd0000 0x51e5fd6fff Private Memory Readable, Writable True False False -
private_0x00000051e5fe0000 0x51e5fe0000 0x51e5fe0fff Private Memory Readable, Writable True False False -
pagefile_0x00000051e5ff0000 0x51e5ff0000 0x51e5ff0fff Pagefile Backed Memory Readable True False False -
private_0x00000051e6000000 0x51e6000000 0x51e60fffff Private Memory Readable, Writable True False False -
private_0x00000051e6100000 0x51e6100000 0x51e617ffff Private Memory Readable, Writable True False False -
pagefile_0x00000051e6180000 0x51e6180000 0x51e6180fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000051e6190000 0x51e6190000 0x51e6190fff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x00000051e61a0000 0x51e61a0000 0x51e61a1fff Pagefile Backed Memory Readable True False False -
private_0x00000051e61b0000 0x51e61b0000 0x51e61b6fff Private Memory Readable, Writable True False False -
cversions.2.db 0x51e61c0000 0x51e61c3fff Memory Mapped File Readable True False False -
cversions.2.db 0x51e61d0000 0x51e61d3fff Memory Mapped File Readable True False False -
private_0x00000051e61e0000 0x51e61e0000 0x51e61e6fff Private Memory Readable, Writable True False False -
iphlpsvc.dll.mui 0x51e61f0000 0x51e61fcfff Memory Mapped File Readable False False False -
private_0x00000051e6200000 0x51e6200000 0x51e62fffff Private Memory Readable, Writable True False False -
pagefile_0x00000051e6300000 0x51e6300000 0x51e6487fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000051e6490000 0x51e6490000 0x51e6610fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000051e6620000 0x51e6620000 0x51e66dffff Pagefile Backed Memory Readable True False False -
private_0x00000051e66e0000 0x51e66e0000 0x51e675ffff Private Memory Readable, Writable True False False -
private_0x00000051e6760000 0x51e6760000 0x51e67dffff Private Memory Readable, Writable True False False -
private_0x00000051e67e0000 0x51e67e0000 0x51e68dffff Private Memory Readable, Writable True False False -
private_0x00000051e68e0000 0x51e68e0000 0x51e69dffff Private Memory Readable, Writable True False False -
private_0x00000051e69e0000 0x51e69e0000 0x51e6adffff Private Memory Readable, Writable True False False -
{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000b.db 0x51e6ae0000 0x51e6b22fff Memory Mapped File Readable True False False -
propsys.dll.mui 0x51e6b30000 0x51e6b40fff Memory Mapped File Readable False False False -
private_0x00000051e6b50000 0x51e6b50000 0x51e6b56fff Private Memory Readable, Writable True False False -
winnlsres.dll 0x51e6b60000 0x51e6b64fff Memory Mapped File Readable False False False -
winnlsres.dll.mui 0x51e6b70000 0x51e6b7ffff Memory Mapped File Readable False False False -
private_0x00000051e6b80000 0x51e6b80000 0x51e6b86fff Private Memory Readable, Writable True False False -
private_0x00000051e6b90000 0x51e6b90000 0x51e6ba7fff Private Memory Readable, Writable True False False -
mswsock.dll.mui 0x51e6bb0000 0x51e6bb2fff Memory Mapped File Readable False False False -
dosvc.dll.mui 0x51e6bc0000 0x51e6bc0fff Memory Mapped File Readable False False False -
usocore.dll.mui 0x51e6bd0000 0x51e6bd0fff Memory Mapped File Readable False False False -
pagefile_0x00000051e6be0000 0x51e6be0000 0x51e6be1fff Pagefile Backed Memory Readable True False False -
gpsvc.dll.mui 0x51e6bf0000 0x51e6bfcfff Memory Mapped File Readable False False False -
private_0x00000051e6c00000 0x51e6c00000 0x51e6cfffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x51e6d00000 0x51e7036fff Memory Mapped File Readable False False False -
private_0x00000051e7040000 0x51e7040000 0x51e713ffff Private Memory Readable, Writable True False False -
private_0x00000051e7140000 0x51e7140000 0x51e723ffff Private Memory Readable, Writable True False False -
private_0x00000051e7240000 0x51e7240000 0x51e733ffff Private Memory Readable, Writable True False False -
private_0x00000051e7340000 0x51e7340000 0x51e743ffff Private Memory Readable, Writable True False False -
private_0x00000051e7440000 0x51e7440000 0x51e74bffff Private Memory Readable, Writable True False False -
vsstrace.dll.mui 0x51e74c0000 0x51e74c8fff Memory Mapped File Readable False False False -
private_0x00000051e74d0000 0x51e74d0000 0x51e74d6fff Private Memory Readable, Writable True False False -
activeds.dll.mui 0x51e74e0000 0x51e74e1fff Memory Mapped File Readable False False False -
pagefile_0x00000051e74f0000 0x51e74f0000 0x51e74f1fff Pagefile Backed Memory Readable True False False -
private_0x00000051e7500000 0x51e7500000 0x51e75fffff Private Memory Readable, Writable True False False -
private_0x00000051e7600000 0x51e7600000 0x51e76fffff Private Memory Readable, Writable True False False -
private_0x00000051e7700000 0x51e7700000 0x51e777ffff Private Memory Readable, Writable True False False -
private_0x00000051e7780000 0x51e7780000 0x51e787ffff Private Memory Readable, Writable True False False -
private_0x00000051e7880000 0x51e7880000 0x51e797ffff Private Memory Readable, Writable True False False -
private_0x00000051e7980000 0x51e7980000 0x51e7a7ffff Private Memory Readable, Writable True False False -
private_0x00000051e7a80000 0x51e7a80000 0x51e7afffff Private Memory Readable, Writable True False False -
private_0x00000051e7b00000 0x51e7b00000 0x51e7bfffff Private Memory Readable, Writable True False False -
{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db 0x51e7c00000 0x51e7c8afff Memory Mapped File Readable True False False -
private_0x00000051e7c90000 0x51e7c90000 0x51e7d8ffff Private Memory Readable, Writable True False False -
private_0x00000051e7d90000 0x51e7d90000 0x51e7e8ffff Private Memory Readable, Writable True False False -
private_0x00000051e7e90000 0x51e7e90000 0x51e7f8ffff Private Memory Readable, Writable True False False -
private_0x00000051e7f90000 0x51e7f90000 0x51e800ffff Private Memory Readable, Writable True False False -
pagefile_0x00000051e8010000 0x51e8010000 0x51e8010fff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x00000051e8020000 0x51e8020000 0x51e8022fff Pagefile Backed Memory Readable True False False -
pagefile_0x00000051e8030000 0x51e8030000 0x51e8030fff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x00000051e8040000 0x51e8040000 0x51e8040fff Pagefile Backed Memory Readable, Writable True False False -
private_0x00000051e8050000 0x51e8050000 0x51e80cffff Private Memory Readable, Writable True False False -
private_0x00000051e8110000 0x51e8110000 0x51e820ffff Private Memory Readable, Writable True False False -
private_0x00000051e8210000 0x51e8210000 0x51e828ffff Private Memory Readable, Writable True False False -
private_0x00000051e8290000 0x51e8290000 0x51e838ffff Private Memory Readable, Writable True False False -
private_0x00000051e8390000 0x51e8390000 0x51e848ffff Private Memory Readable, Writable True False False -
private_0x00000051e8490000 0x51e8490000 0x51e850ffff Private Memory Readable, Writable True False False -
pagefile_0x00000051e8510000 0x51e8510000 0x51e860ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x00000051e8630000 0x51e8630000 0x51e8636fff Private Memory Readable, Writable True False False -
private_0x00000051e8700000 0x51e8700000 0x51e87fffff Private Memory Readable, Writable True False False -
private_0x00000051e8800000 0x51e8800000 0x51e88fffff Private Memory Readable, Writable True False False -
private_0x00000051e8900000 0x51e8900000 0x51e89fffff Private Memory Readable, Writable True False False -
private_0x00000051e8a80000 0x51e8a80000 0x51e8b7ffff Private Memory Readable, Writable True False False -
private_0x00000051e8c00000 0x51e8c00000 0x51e8c7ffff Private Memory Readable, Writable True False False -
private_0x00000051e8c80000 0x51e8c80000 0x51e8d7ffff Private Memory Readable, Writable True False False -
private_0x00000051e8e00000 0x51e8e00000 0x51e8e7ffff Private Memory Readable, Writable True False False -
private_0x00000051e8f00000 0x51e8f00000 0x51e8ffffff Private Memory Readable, Writable True False False -
private_0x00000051e9000000 0x51e9000000 0x51e90fffff Private Memory Readable, Writable True False False -
private_0x00000051e9100000 0x51e9100000 0x51e917ffff Private Memory Readable, Writable True False False -
private_0x00000051e9180000 0x51e9180000 0x51e91fffff Private Memory Readable, Writable True False False -
private_0x00000051e9200000 0x51e9200000 0x51e92fffff Private Memory Readable, Writable True False False -
private_0x00000051e9300000 0x51e9300000 0x51e93fffff Private Memory Readable, Writable True False False -
private_0x00000051e9400000 0x51e9400000 0x51e94fffff Private Memory Readable, Writable True False False -
private_0x00000051e9500000 0x51e9500000 0x51e95fffff Private Memory Readable, Writable True False False -
private_0x00000051e9600000 0x51e9600000 0x51e96fffff Private Memory Readable, Writable True False False -
private_0x00000051e9700000 0x51e9700000 0x51e97fffff Private Memory Readable, Writable True False False -
private_0x00000051e9800000 0x51e9800000 0x51e98fffff Private Memory Readable, Writable True False False -
private_0x00000051e9900000 0x51e9900000 0x51e99fffff Private Memory Readable, Writable True False False -
private_0x00000051e9a00000 0x51e9a00000 0x51e9afffff Private Memory Readable, Writable True False False -
private_0x00000051e9b00000 0x51e9b00000 0x51e9bfffff Private Memory Readable, Writable True False False -
private_0x00000051e9c00000 0x51e9c00000 0x51e9cfffff Private Memory Readable, Writable True False False -
private_0x00000051e9d00000 0x51e9d00000 0x51e9dfffff Private Memory Readable, Writable True False False -
private_0x00000051e9e00000 0x51e9e00000 0x51e9efffff Private Memory Readable, Writable True False False -
kernelbase.dll.mui 0x51e9f00000 0x51e9fdefff Memory Mapped File Readable False False False -
private_0x00000051e9fe0000 0x51e9fe0000 0x51ea0dffff Private Memory Readable, Writable True False False -
private_0x00000051ea0e0000 0x51ea0e0000 0x51ea15ffff Private Memory Readable, Writable True False False -
private_0x00000051ea170000 0x51ea170000 0x51ea176fff Private Memory Readable, Writable True False False -
private_0x00000051ea180000 0x51ea180000 0x51ea27ffff Private Memory Readable, Writable True False False -
private_0x00000051ea300000 0x51ea300000 0x51ea3fffff Private Memory Readable, Writable True False False -
private_0x00000051ea400000 0x51ea400000 0x51ea4fffff Private Memory Readable, Writable True False False -
private_0x00000051ea500000 0x51ea500000 0x51ea5fffff Private Memory Readable, Writable True False False -
private_0x00000051ea600000 0x51ea600000 0x51ea6fffff Private Memory Readable, Writable True False False -
private_0x00000051ea700000 0x51ea700000 0x51ea7fffff Private Memory Readable, Writable True False False -
private_0x00000051ea800000 0x51ea800000 0x51ea8fffff Private Memory Readable, Writable True False False -
private_0x00000051ea900000 0x51ea900000 0x51ea9fffff Private Memory Readable, Writable True False False -
private_0x00000051eaa00000 0x51eaa00000 0x51eaafffff Private Memory Readable, Writable True False False -
private_0x00000051eab00000 0x51eab00000 0x51eabfffff Private Memory Readable, Writable True False False -
private_0x00000051eac00000 0x51eac00000 0x51eacfffff Private Memory Readable, Writable True False False -
private_0x00000051ead00000 0x51ead00000 0x51eadfffff Private Memory Readable, Writable True False False -
private_0x00000051eae00000 0x51eae00000 0x51eaefffff Private Memory Readable, Writable True False False -
private_0x00000051eaf00000 0x51eaf00000 0x51eaffffff Private Memory Readable, Writable True False False -
private_0x00000051eb000000 0x51eb000000 0x51eb0fffff Private Memory Readable, Writable True False False -
private_0x00000051eb1d0000 0x51eb1d0000 0x51eb1d6fff Private Memory Readable, Writable True False False -
private_0x00000051eb200000 0x51eb200000 0x51eb2fffff Private Memory Readable, Writable True False False -
private_0x00000051eb300000 0x51eb300000 0x51eb3fffff Private Memory Readable, Writable True False False -
private_0x00000051eb400000 0x51eb400000 0x51eb4fffff Private Memory Readable, Writable True False False -
private_0x00000051eb500000 0x51eb500000 0x51eb5fffff Private Memory Readable, Writable True False False -
private_0x00000051eb600000 0x51eb600000 0x51eb6fffff Private Memory Readable, Writable True False False -
private_0x00000051eb700000 0x51eb700000 0x51eb7fffff Private Memory Readable, Writable True False False -
private_0x00000051eb800000 0x51eb800000 0x51eb8fffff Private Memory Readable, Writable True False False -
private_0x00000051eb900000 0x51eb900000 0x51eb9fffff Private Memory Readable, Writable True False False -
private_0x00000051eba00000 0x51eba00000 0x51ebafffff Private Memory Readable, Writable True False False -
private_0x00000051ebb00000 0x51ebb00000 0x51ebbfffff Private Memory Readable, Writable True False False -
private_0x00000051ebc00000 0x51ebc00000 0x51ebcfffff Private Memory Readable, Writable True False False -
private_0x00000051ebd00000 0x51ebd00000 0x51ebdfffff Private Memory Readable, Writable True False False -
private_0x00000051ebe00000 0x51ebe00000 0x51ebefffff Private Memory Readable, Writable True False False -
pagefile_0x00007df5ffdb0000 0x7df5ffdb0000 0x7ff5ffdaffff Pagefile Backed Memory - True False False -
private_0x00007ff7b3aa6000 0x7ff7b3aa6000 0x7ff7b3aa7fff Private Memory Readable, Writable True False False -
private_0x00007ff7b3aa8000 0x7ff7b3aa8000 0x7ff7b3aa9fff Private Memory Readable, Writable True False False -
private_0x00007ff7b3aaa000 0x7ff7b3aaa000 0x7ff7b3aabfff Private Memory Readable, Writable True False False -
private_0x00007ff7b3aac000 0x7ff7b3aac000 0x7ff7b3aadfff Private Memory Readable, Writable True False False -
private_0x00007ff7b3aae000 0x7ff7b3aae000 0x7ff7b3aaffff Private Memory Readable, Writable True False False -
private_0x00007ff7b3ab0000 0x7ff7b3ab0000 0x7ff7b3ab1fff Private Memory Readable, Writable True False False -
private_0x00007ff7b3ab2000 0x7ff7b3ab2000 0x7ff7b3ab3fff Private Memory Readable, Writable True False False -
private_0x00007ff7b3ab4000 0x7ff7b3ab4000 0x7ff7b3ab5fff Private Memory Readable, Writable True False False -
private_0x00007ff7b3ab6000 0x7ff7b3ab6000 0x7ff7b3ab7fff Private Memory Readable, Writable True False False -
private_0x00007ff7b3ab8000 0x7ff7b3ab8000 0x7ff7b3ab9fff Private Memory Readable, Writable True False False -
private_0x00007ff7b3aba000 0x7ff7b3aba000 0x7ff7b3abbfff Private Memory Readable, Writable True False False -
private_0x00007ff7b3abc000 0x7ff7b3abc000 0x7ff7b3abdfff Private Memory Readable, Writable True False False -
For performance reasons, the remaining 330 entries are omitted.
The remaining entries can be found in flog.txt.
Process #9: sc.exe
8 0
»
Information Value
ID #9
File Name c:\windows\system32\sc.exe
Command Line C:\Windows\system32\sc.exe start wuauserv
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:49, Reason: Child Process
Unmonitor End Time: 00:02:20, Reason: Terminated by Timeout
Monitor Duration 00:00:31
OS Process Information
»
Information Value
PID 0xc94
Parent PID 0x378 (c:\windows\system32\svchost.exe)
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x C98
0x CB0
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x0000007f34c60000 0x7f34c60000 0x7f34c7ffff Private Memory Readable, Writable True False False -
pagefile_0x0000007f34c60000 0x7f34c60000 0x7f34c6ffff Pagefile Backed Memory Readable, Writable True False False -
private_0x0000007f34c70000 0x7f34c70000 0x7f34c76fff Private Memory Readable, Writable True False False -
pagefile_0x0000007f34c80000 0x7f34c80000 0x7f34c93fff Pagefile Backed Memory Readable True False False -
private_0x0000007f34ca0000 0x7f34ca0000 0x7f34d1ffff Private Memory Readable, Writable True False False -
pagefile_0x0000007f34d20000 0x7f34d20000 0x7f34d23fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000007f34d30000 0x7f34d30000 0x7f34d30fff Pagefile Backed Memory Readable True False False -
private_0x0000007f34d40000 0x7f34d40000 0x7f34d41fff Private Memory Readable, Writable True False False -
private_0x0000007f34d50000 0x7f34d50000 0x7f34d56fff Private Memory Readable, Writable True False False -
sc.exe.mui 0x7f34d60000 0x7f34d71fff Memory Mapped File Readable False False False -
private_0x0000007f34da0000 0x7f34da0000 0x7f34e9ffff Private Memory Readable, Writable True False False -
locale.nls 0x7f34ea0000 0x7f34f5dfff Memory Mapped File Readable False False False -
private_0x0000007f34f60000 0x7f34f60000 0x7f34fdffff Private Memory Readable, Writable True False False -
private_0x0000007f35130000 0x7f35130000 0x7f3513ffff Private Memory Readable, Writable True False False -
pagefile_0x00007df5ff460000 0x7df5ff460000 0x7ff5ff45ffff Pagefile Backed Memory - True False False -
pagefile_0x00007ff6f2f90000 0x7ff6f2f90000 0x7ff6f308ffff Pagefile Backed Memory Readable True False False -
pagefile_0x00007ff6f3090000 0x7ff6f3090000 0x7ff6f30b2fff Pagefile Backed Memory Readable True False False -
private_0x00007ff6f30bb000 0x7ff6f30bb000 0x7ff6f30bcfff Private Memory Readable, Writable True False False -
private_0x00007ff6f30bd000 0x7ff6f30bd000 0x7ff6f30bdfff Private Memory Readable, Writable True False False -
private_0x00007ff6f30be000 0x7ff6f30be000 0x7ff6f30bffff Private Memory Readable, Writable True False False -
sc.exe 0x7ff6f33d0000 0x7ff6f33e5fff Memory Mapped File Readable, Writable, Executable True False False -
kernelbase.dll 0x7ffc01360000 0x7ffc0153cfff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x7ffc01dd0000 0x7ffc01ef5fff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x7ffc02060000 0x7ffc020fcfff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x7ffc02100000 0x7ffc0215afff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x7ffc03dc0000 0x7ffc03e6cfff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x7ffc03e70000 0x7ffc04031fff Memory Mapped File Readable, Writable, Executable False False False -
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 425 True 1
Fn
Data
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\system32\sc.exe base_address = 0x7ff6f33d0000 True 1
Fn
Service (4)
»
Operation Additional Information Success Count Logfile
Get Info service_name = wuauserv True 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Start service_name = wuauserv True 1
Fn
Process #12: services.exe
0 0
»
Information Value
ID #12
File Name c:\windows\system32\services.exe
Command Line C:\Windows\system32\services.exe
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:50, Reason: Created Daemon
Unmonitor End Time: 00:02:03, Reason: Self Terminated
Monitor Duration 00:00:13
Remarks No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x1e4
Parent PID 0x194 (c:\windows\system32\wininit.exe)
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 36C
0x 358
0x 30C
0x 260
0x 240
0x 238
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
pagefile_0x000000a4161d0000 0xa4161d0000 0xa4161dffff Pagefile Backed Memory Readable, Writable True False False -
services.exe.mui 0xa4161e0000 0xa4161e4fff Memory Mapped File Readable False False False -
pagefile_0x000000a4161f0000 0xa4161f0000 0xa416203fff Pagefile Backed Memory Readable True False False -
pagefile_0x000000a416290000 0xa416290000 0xa416293fff Pagefile Backed Memory Readable True False False -
pagefile_0x000000a4162a0000 0xa4162a0000 0xa4162a0fff Pagefile Backed Memory Readable True False False -
locale.nls 0xa4162b0000 0xa41636dfff Memory Mapped File Readable False False False -
private_0x000000a416370000 0xa416370000 0xa416370fff Private Memory Readable, Writable True False False -
private_0x000000a4163d0000 0xa4163d0000 0xa4163d6fff Private Memory Readable, Writable True False False -
private_0x000000a416400000 0xa416400000 0xa4164fffff Private Memory Readable, Writable True False False -
private_0x000000a416580000 0xa416580000 0xa4165fffff Private Memory Readable, Writable True False False -
private_0x000000a416600000 0xa416600000 0xa41667ffff Private Memory Readable, Writable True False False -
private_0x000000a416680000 0xa416680000 0xa4166fffff Private Memory Readable, Writable True False False -
private_0x000000a416750000 0xa416750000 0xa416756fff Private Memory Readable, Writable True False False -
private_0x000000a416800000 0xa416800000 0xa4168fffff Private Memory Readable, Writable True False False -
private_0x000000a416980000 0xa416980000 0xa4169fffff Private Memory Readable, Writable True False False -
private_0x000000a416b00000 0xa416b00000 0xa416b7ffff Private Memory Readable, Writable True False False -
private_0x000000a416b80000 0xa416b80000 0xa416bfffff Private Memory Readable, Writable True False False -
private_0x000000a416c00000 0xa416c00000 0xa416cfffff Private Memory Readable, Writable True False False -
pagefile_0x00007df5ff8b0000 0x7df5ff8b0000 0x7ff5ff8affff Pagefile Backed Memory - True False False -
private_0x00007ff64fbc4000 0x7ff64fbc4000 0x7ff64fbc5fff Private Memory Readable, Writable True False False -
private_0x00007ff64fbc6000 0x7ff64fbc6000 0x7ff64fbc7fff Private Memory Readable, Writable True False False -
private_0x00007ff64fbcc000 0x7ff64fbcc000 0x7ff64fbcdfff Private Memory Readable, Writable True False False -
pagefile_0x00007ff64fbd0000 0x7ff64fbd0000 0x7ff64fccffff Pagefile Backed Memory Readable True False False -
pagefile_0x00007ff64fcd0000 0x7ff64fcd0000 0x7ff64fcf2fff Pagefile Backed Memory Readable True False False -
private_0x00007ff64fcf5000 0x7ff64fcf5000 0x7ff64fcf5fff Private Memory Readable, Writable True False False -
private_0x00007ff64fcf6000 0x7ff64fcf6000 0x7ff64fcf7fff Private Memory Readable, Writable True False False -
private_0x00007ff64fcf8000 0x7ff64fcf8000 0x7ff64fcf9fff Private Memory Readable, Writable True False False -
private_0x00007ff64fcfa000 0x7ff64fcfa000 0x7ff64fcfbfff Private Memory Readable, Writable True False False -
services.exe 0x7ff650490000 0x7ff6504fffff Memory Mapped File Readable, Writable, Executable False False False -
usermgrcli.dll 0x7ffbfd180000 0x7ffbfd18ffff Memory Mapped File Readable, Writable, Executable False False False -
authz.dll 0x7ffbff9b0000 0x7ffbff9f7fff Memory Mapped File Readable, Writable, Executable False False False -
scesrv.dll 0x7ffbffa00000 0x7ffbffa8dfff Memory Mapped File Readable, Writable, Executable False False False -
srvcli.dll 0x7ffbffb00000 0x7ffbffb25fff Memory Mapped File Readable, Writable, Executable False False False -
mswsock.dll 0x7ffc00110000 0x7ffc0016cfff Memory Mapped File Readable, Writable, Executable False False False -
sspicli.dll 0x7ffc004c0000 0x7ffc004ebfff Memory Mapped File Readable, Writable, Executable False False False -
spinf.dll 0x7ffc00670000 0x7ffc0068afff Memory Mapped File Readable, Writable, Executable False False False -
eventaggregation.dll 0x7ffc00690000 0x7ffc006a9fff Memory Mapped File Readable, Writable, Executable False False False -
dabapi.dll 0x7ffc006b0000 0x7ffc006b7fff Memory Mapped File Readable, Writable, Executable False False False -
bcryptprimitives.dll 0x7ffc006f0000 0x7ffc0075afff Memory Mapped File Readable, Writable, Executable False False False -
profapi.dll 0x7ffc008f0000 0x7ffc00902fff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x7ffc01360000 0x7ffc0153cfff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x7ffc01dd0000 0x7ffc01ef5fff Memory Mapped File Readable, Writable, Executable False False False -
nsi.dll 0x7ffc02050000 0x7ffc02057fff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x7ffc02060000 0x7ffc020fcfff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x7ffc02100000 0x7ffc0215afff Memory Mapped File Readable, Writable, Executable False False False -
ws2_32.dll 0x7ffc03980000 0x7ffc039e8fff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x7ffc03dc0000 0x7ffc03e6cfff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x7ffc03e70000 0x7ffc04031fff Memory Mapped File Readable, Writable, Executable False False False -
Process #26: sppsvc.exe
1 0
»
Information Value
ID #26
File Name c:\windows\system32\sppsvc.exe
Command Line C:\Windows\system32\sppsvc.exe
Initial Working Directory C:\Windows
Monitor Start Time: 00:01:50, Reason: Child Process
Unmonitor End Time: 00:02:20, Reason: Terminated by Timeout
Monitor Duration 00:00:30
OS Process Information
»
Information Value
PID 0xc10
Parent PID 0x1e4 (c:\windows\system32\services.exe)
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\Network Service
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x C8C
0x C30
0x C20
0x C18
0x C14
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory Readable True False False -
private_0x0000003fbeb80000 0x3fbeb80000 0x3fbeb86fff Private Memory Readable, Writable True False False -
pagefile_0x0000003fbeb90000 0x3fbeb90000 0x3fbeb9ffff Pagefile Backed Memory Readable, Writable True False False -
pagefile_0x0000003fbeba0000 0x3fbeba0000 0x3fbebb3fff Pagefile Backed Memory Readable True False False -
private_0x0000003fbebc0000 0x3fbebc0000 0x3fbec3ffff Private Memory Readable, Writable True False False -
locale.nls 0x3fbec40000 0x3fbecfdfff Memory Mapped File Readable False False False -
private_0x0000003fbed00000 0x3fbed00000 0x3fbed06fff Private Memory Readable, Writable True False False -
sppsvc.exe.mui 0x3fbed10000 0x3fbed15fff Memory Mapped File Readable False False False -
private_0x0000003fbed20000 0x3fbed20000 0x3fbed20fff Private Memory Readable, Writable True False False -
private_0x0000003fbed30000 0x3fbed30000 0x3fbed30fff Private Memory Readable, Writable True False False -
private_0x0000003fbed40000 0x3fbed40000 0x3fbed4ffff Private Memory Readable, Writable True False False -
private_0x0000003fbed50000 0x3fbed50000 0x3fbed5ffff Private Memory Readable, Writable True False False -
private_0x0000003fbed60000 0x3fbed60000 0x3fbee5ffff Private Memory Readable, Writable True False False -
private_0x0000003fbee60000 0x3fbee60000 0x3fbeedffff Private Memory Readable, Writable True False False -
pagefile_0x0000003fbeee0000 0x3fbeee0000 0x3fbef9ffff Pagefile Backed Memory Readable True False False -
private_0x0000003fbefa0000 0x3fbefa0000 0x3fbf01ffff Private Memory Readable, Writable True False False -
private_0x0000003fbf020000 0x3fbf020000 0x3fbf02ffff Private Memory Readable, Writable True False False -
pagefile_0x0000003fbf030000 0x3fbf030000 0x3fbf1b7fff Pagefile Backed Memory Readable True False False -
pagefile_0x0000003fbf1c0000 0x3fbf1c0000 0x3fbf340fff Pagefile Backed Memory Readable True False False -
private_0x0000003fbf350000 0x3fbf350000 0x3fbf44ffff Private Memory Readable, Writable True False False -
private_0x0000003fbf450000 0x3fbf450000 0x3fbf4cffff Private Memory Readable, Writable True False False -
sortdefault.nls 0x3fbf4d0000 0x3fbf806fff Memory Mapped File Readable False False False -
private_0x0000003fbf810000 0x3fbf810000 0x3fbf88ffff Private Memory Readable, Writable True False False -
pagefile_0x00007df5ffb30000 0x7df5ffb30000 0x7ff5ffb2ffff Pagefile Backed Memory - True False False -
pagefile_0x00007ff696a10000 0x7ff696a10000 0x7ff696b0ffff Pagefile Backed Memory Readable True False False -
pagefile_0x00007ff696b10000 0x7ff696b10000 0x7ff696b32fff Pagefile Backed Memory Readable True False False -
private_0x00007ff696b35000 0x7ff696b35000 0x7ff696b36fff Private Memory Readable, Writable True False False -
private_0x00007ff696b37000 0x7ff696b37000 0x7ff696b38fff Private Memory Readable, Writable True False False -
private_0x00007ff696b39000 0x7ff696b39000 0x7ff696b3afff Private Memory Readable, Writable True False False -
private_0x00007ff696b3b000 0x7ff696b3b000 0x7ff696b3cfff Private Memory Readable, Writable True False False -
private_0x00007ff696b3d000 0x7ff696b3d000 0x7ff696b3efff Private Memory Readable, Writable True False False -
private_0x00007ff696b3f000 0x7ff696b3f000 0x7ff696b3ffff Private Memory Readable, Writable True False False -
sppsvc.exe 0x7ff697860000 0x7ff697e8dfff Memory Mapped File Readable, Writable, Executable False False False -
sppwinob.dll 0x7ffbea690000 0x7ffbea729fff Memory Mapped File Readable, Writable, Executable False False False -
cryptxml.dll 0x7ffbeb810000 0x7ffbeb831fff Memory Mapped File Readable, Writable, Executable False False False -
clipc.dll 0x7ffbebc00000 0x7ffbebc15fff Memory Mapped File Readable, Writable, Executable False False False -
webservices.dll 0x7ffbebfb0000 0x7ffbec12afff Memory Mapped File Readable, Writable, Executable False False False -
xmllite.dll 0x7ffbfbe40000 0x7ffbfbe75fff Memory Mapped File Readable, Writable, Executable False False False -
dsrole.dll 0x7ffbfdc10000 0x7ffbfdc19fff Memory Mapped File Readable, Writable, Executable False False False -
rsaenh.dll 0x7ffbffdc0000 0x7ffbffdf2fff Memory Mapped File Readable, Writable, Executable False False False -
cryptsp.dll 0x7ffc00170000 0x7ffc00186fff Memory Mapped File Readable, Writable, Executable False False False -
cryptbase.dll 0x7ffc002e0000 0x7ffc002eafff Memory Mapped File Readable, Writable, Executable False False False -
bcrypt.dll 0x7ffc006c0000 0x7ffc006e7fff Memory Mapped File Readable, Writable, Executable False False False -
bcryptprimitives.dll 0x7ffc006f0000 0x7ffc0075afff Memory Mapped File Readable, Writable, Executable False False False -
kernel.appcore.dll 0x7ffc00910000 0x7ffc0091efff Memory Mapped File Readable, Writable, Executable False False False -
msasn1.dll 0x7ffc00920000 0x7ffc00930fff Memory Mapped File Readable, Writable, Executable False False False -
crypt32.dll 0x7ffc01190000 0x7ffc01350fff Memory Mapped File Readable, Writable, Executable False False False -
kernelbase.dll 0x7ffc01360000 0x7ffc0153cfff Memory Mapped File Readable, Writable, Executable False False False -
advapi32.dll 0x7ffc01640000 0x7ffc016e5fff Memory Mapped File Readable, Writable, Executable False False False -
combase.dll 0x7ffc018a0000 0x7ffc01b1bfff Memory Mapped File Readable, Writable, Executable False False False -
rpcrt4.dll 0x7ffc01dd0000 0x7ffc01ef5fff Memory Mapped File Readable, Writable, Executable False False False -
user32.dll 0x7ffc01f00000 0x7ffc0204dfff Memory Mapped File Readable, Writable, Executable False False False -
msvcrt.dll 0x7ffc02060000 0x7ffc020fcfff Memory Mapped File Readable, Writable, Executable False False False -
sechost.dll 0x7ffc02100000 0x7ffc0215afff Memory Mapped File Readable, Writable, Executable False False False -
gdi32.dll 0x7ffc037f0000 0x7ffc03974fff Memory Mapped File Readable, Writable, Executable False False False -
ole32.dll 0x7ffc03bb0000 0x7ffc03cf0fff Memory Mapped File Readable, Writable, Executable False False False -
oleaut32.dll 0x7ffc03d00000 0x7ffc03dbdfff Memory Mapped File Readable, Writable, Executable False False False -
kernel32.dll 0x7ffc03dc0000 0x7ffc03e6cfff Memory Mapped File Readable, Writable, Executable False False False -
ntdll.dll 0x7ffc03e70000 0x7ffc04031fff Memory Mapped File Readable, Writable, Executable False False False -
Host Behavior
System (1)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2018-06-04 11:31:57 (UTC) True 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image