Javascript Dropper #1 - Gandcrab Analysis | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: Windows 10 (64-bit) | windows_script_files
Classification: Dropper, Downloader, Ransomware

b4b6f6c2588001e5b95eed79faf99a92b9d9224f65af6a92e055ddfb145a1ecc (SHA256)

DOC6131166051-PDF.js

JScript

Created at 2018-03-14 01:58:00

...

Notifications (2/3)

Some extracted files may be missing in the report since the total file extraction size limit was reached during the analysis. You can increase the limit in the configuration settings.

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

The operating system was rebooted during the analysis because the sample installed a startup script or application for persistence.

Indicators

File (2908)
»
Filename Hash Operations
CONOUT$ - Access
C:\ - Access
C:\$Recycle.Bin\\CRAB-DECRYPT.txt - Access, Write
C:\$Recycle.Bin\S-1-5-18\\CRAB-DECRYPT.txt - Access, Write
C:\$Recycle.Bin\S-1-5-21-2172869166-1497266965-2109836178-1000\$IPEWI8I.TMP MD5: 9126296e0dcaf851df5209121867f433
SHA1: e8cabfbab7c89afc8f8c5a2cab6316eb338db5fa
SHA256: bde73da1e1a47653bc41c876383655184b8c176fe4f3d991a4e0a22de751e026 		Access, Read, Write
C:\$Recycle.Bin\S-1-5-21-2172869166-1497266965-2109836178-1000\$IPEWI8I.TMP.CRAB MD5: 9126296e0dcaf851df5209121867f433
SHA1: e8cabfbab7c89afc8f8c5a2cab6316eb338db5fa
SHA256: bde73da1e1a47653bc41c876383655184b8c176fe4f3d991a4e0a22de751e026 		Access
C:\$Recycle.Bin\S-1-5-21-2172869166-1497266965-2109836178-1000\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default User\AppData\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Local\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Roaming\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Cookies\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Desktop\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Documents\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Documents\My Music\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Documents\My Pictures\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Documents\My Videos\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Downloads\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Favorites\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Links\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Music\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\My Documents\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\My Documents\My Music\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\My Documents\My Pictures\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\My Documents\My Videos\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\NetHood\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Pictures\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\PrintHood\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Recent\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Saved Games\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\SendTo\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Start Menu\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Start Menu\Programs\Accessibility\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Start Menu\Programs\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Start Menu\Programs\Maintenance\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Start Menu\Programs\System Tools\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Start Menu\Programs\Windows PowerShell\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Templates\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default User\Videos\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\settings.ini - Access, Read, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\settings.ini.CRAB - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\settings.ini - Access, Read, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\settings.ini.CRAB - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Local\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Local\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\AppData\Roaming\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\Application Data\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\Cookies\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Desktop\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Documents\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Documents\My Music\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Documents\My Pictures\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Documents\My Videos\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Downloads\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Favorites\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Links\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Music\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\My Documents\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\My Documents\My Music\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\My Documents\My Pictures\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\My Documents\My Videos\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\NetHood\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\NTUSER.DAT.LOG1 - Access, Read, Write
C:\Documents and Settings\Default\NTUSER.DAT.LOG1.CRAB - Access
C:\Documents and Settings\Default\NTUSER.DAT.LOG2 - Access, Read, Write
C:\Documents and Settings\Default\NTUSER.DAT.LOG2.CRAB - Access
C:\Documents and Settings\Default\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf - Access, Read, Write
C:\Documents and Settings\Default\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf.CRAB - Access
C:\Documents and Settings\Default\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms - Access, Read, Write
C:\Documents and Settings\Default\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms.CRAB - Access
C:\Documents and Settings\Default\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms - Access, Read, Write
C:\Documents and Settings\Default\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms.CRAB - Access
C:\Documents and Settings\Default\Pictures\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Default\PrintHood\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Recent\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Saved Games\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\SendTo\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Start Menu\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Start Menu\Programs\Accessibility\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Start Menu\Programs\Accessories\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Start Menu\Programs\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Start Menu\Programs\Maintenance\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Start Menu\Programs\System Tools\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Start Menu\Programs\Windows PowerShell\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Templates\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Default\Videos\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\ActiveSync\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt15.lst - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt15.lst.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt15.lst - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt15.lst.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt15.lst - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt15.lst.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\Cache\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr.dat - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr.dat.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\UserCache.bin - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\AcroCef\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\AcroCef\DC\Acrobat\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\AcroCef\DC\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Color\ACECache11.lst - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Color\ACECache11.lst.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Color\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Color\Profiles\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Color\Profiles\wscRGB.icc - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Color\Profiles\wsRGB.icc - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Adobe\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\ActiveSync\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Adobe\Acrobat\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Adobe\Acrobat\DC\Cache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Adobe\Acrobat\DC\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Adobe\AcroCef\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Adobe\AcroCef\DC\Acrobat\Cookie\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Adobe\AcroCef\DC\Acrobat\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Adobe\AcroCef\DC\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Adobe\Color\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Adobe\Color\Profiles\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Adobe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\ActiveSync\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Adobe\Acrobat\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Adobe\Acrobat\DC\Cache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Adobe\Acrobat\DC\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Adobe\AcroCef\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Adobe\AcroCef\DC\Acrobat\Cookie\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Adobe\AcroCef\DC\Acrobat\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Adobe\AcroCef\DC\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Adobe\Color\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Adobe\Color\Profiles\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Adobe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\ActiveSync\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\DC\Cache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\DC\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Adobe\AcroCef\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Adobe\AcroCef\DC\Acrobat\Cookie\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Adobe\AcroCef\DC\Acrobat\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Adobe\AcroCef\DC\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Adobe\Color\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Adobe\Color\Profiles\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Adobe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\-e jJuv2TeKL.pdf - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\-ZZr9xYkqr28kj4Ewly.bmp - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0rGnGm QreoWsur9e.mp3 - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1dIAUE6JjxOcRnUgYL.mp4 - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1wJk.mp4 - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2GRWsBis.mp4 - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2nz3uSwqyVXWxqCOCF18.gif - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4229bD.swf - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\_E9_ON r.gif - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dBLEEVc8Nl3ui3b.m4a - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\DdyE 50uK2L.gif - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dPo3pQlaA.wav - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\F-PsEooiB7-oXDbtz1id.bmp - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fAfwVeyGLAK7P93Obz3Y.pdf - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hf1D.jpg - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hLFQVM89GDd j6TcCek.m4a - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\iEyof2ITfx5.flv - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\KAwEoER.m4a - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\l5sTDgUGeyhDz.gif - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\LtnS7XaVnVQol2Qn1xH.avi - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\mLE9mf-BdFdOibSg9l.wav - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\oUGX-5zbSZw.gif - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\QZg7oH35.avi - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\R6QY5M2ifYeXIFzAbryD.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Rw3B6OL.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\SDaC6UaMD-p1Jk.mp3 - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tVTfmiVg4ragt74J-.bmp - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\vO1f0VBn.mp4 - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WjWFRmK.swf - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\XL3UQ.mp4 - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\YO5CdbmrFGoGb.bmp - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ySgEVn.xls - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\z28ae.mp4 - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Temp\CalendarCache.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\AggregateCache.uca - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\store.vol - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\tmp.edb - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.chk - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USSres00001.jrs - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USSres00002.jrs - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USStmp.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\ngen.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\ngen.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMDATA64.DAT - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\GameDVR\KnownGameList.bin - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\mspub.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\outlook.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\powerpnt.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\setup.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\winword.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\-e jJuv2TeKL.pdf - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\-e jJuv2TeKL.pdf.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\-ZZr9xYkqr28kj4Ewly.bmp - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0rGnGm QreoWsur9e.mp3 - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1dIAUE6JjxOcRnUgYL.mp4 - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1wJk.mp4 - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1wJk.mp4.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2GRWsBis.mp4 - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2GRWsBis.mp4.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2nz3uSwqyVXWxqCOCF18.gif - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4229bD.swf - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4229bD.swf.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\_E9_ON r.gif - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\_E9_ON r.gif.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dBLEEVc8Nl3ui3b.m4a - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\DdyE 50uK2L.gif - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\DdyE 50uK2L.gif.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dPo3pQlaA.wav - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dPo3pQlaA.wav.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\F-PsEooiB7-oXDbtz1id.bmp - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fAfwVeyGLAK7P93Obz3Y.pdf - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hf1D.jpg - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hf1D.jpg.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hLFQVM89GDd j6TcCek.m4a - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\iEyof2ITfx5.flv - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\iEyof2ITfx5.flv.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\KAwEoER.m4a - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\KAwEoER.m4a.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\l5sTDgUGeyhDz.gif - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\l5sTDgUGeyhDz.gif.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\LtnS7XaVnVQol2Qn1xH.avi - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\mLE9mf-BdFdOibSg9l.wav - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\oUGX-5zbSZw.gif - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\oUGX-5zbSZw.gif.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\QZg7oH35.avi - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\QZg7oH35.avi.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\R6QY5M2ifYeXIFzAbryD.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Rw3B6OL.png - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Rw3B6OL.png.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\SDaC6UaMD-p1Jk.mp3 - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\SDaC6UaMD-p1Jk.mp3.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tVTfmiVg4ragt74J-.bmp - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\vO1f0VBn.mp4 - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\vO1f0VBn.mp4.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WjWFRmK.swf - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WjWFRmK.swf.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\XL3UQ.mp4 - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\XL3UQ.mp4.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\YO5CdbmrFGoGb.bmp - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\YO5CdbmrFGoGb.bmp.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ySgEVn.xls - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ySgEVn.xls.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\z28ae.mp4 - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\z28ae.mp4.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Temp\CalendarCache.dat - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Temp\CalendarCache.dat.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Temp\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\AggregateCache.uca - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\AggregateCache.uca.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\store.vol - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\tmp.edb - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.chk - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.chk.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USSres00001.jrs - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USSres00001.jrs.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USSres00002.jrs - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USSres00002.jrs.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USStmp.log - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USStmp.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateTransparency\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\settings.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CrashpadMetrics-active.pma - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Cache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\IndexedDB\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\previews_opt_out.db - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Service Worker\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Extension Settings\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\EVWhitelist\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OriginTrials\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\PepperFlash\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Safe Browsing\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SSLErrorAssistant\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SwReporter\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\WidevineCdm\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\CrashReports\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\MSHist012018031420180315\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\UsageLogs\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\ngen.log - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\ngen.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\mmc.exe.log - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\mmc.exe.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\powershell_ise.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\sdiagnhost.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\ngen.log - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\ngen.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\UsageLogs\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Event Viewer\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\3Y244KAF\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ASF6K8JF\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\M2CKLQNS\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZH5Q7INF\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMDATA64.DAT - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMDATA64.DAT.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\GameDVR\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\GameDVR\KnownGameList.bin - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InstallAgent\Checkpoints\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InstallAgent\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DomainSuggestions\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\0IPER52U\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\BZMP202C\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\EU700QP2\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\YWTG9C16\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\EmieSiteList\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\EmieUserList\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\EUPP\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\ie4uinit-UserConfig.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\IECompatData\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\IEFlipAheadCache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\imagestore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\imagestore\o2e7lod\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\imagestore\v2a1n8m\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\Active\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\TabRoaming\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-1055582590\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-13849261960\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-14780564560\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-14780564610\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-14780569370\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-18110748030\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-19904609010\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-314712940\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-4085800870\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-706976130\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-7404745920\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-8427938880\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin-9449249960\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin15686110540\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin17161738060\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin19620886520\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin20075419400\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin20075423150\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin21042551290\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin2327546390\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin3769534880\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tiles\pin4101377530\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Tracking Protection\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\VersionManager\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Transcoded Files Cache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\BackstageInAppNavCache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\mspub.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\outlook.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\powerpnt.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\setup.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\WebServiceCache\AllUsers\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\WebServiceCache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\Wef\AppCommands\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\Wef\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\winword.exe_Rules.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{1CA34AD9-2E94-4593-80A1-BE0DAB9454A5} (0) - 3344 - excel.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{1CA34AD9-2E94-4593-80A1-BE0DAB9454A5} (0) - 3344 - excel.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{1CA34AD9-2E94-4593-80A1-BE0DAB9454A5} (1) - 3344 - excel.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{1CA34AD9-2E94-4593-80A1-BE0DAB9454A5} (1) - 3344 - excel.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{1CA34AD9-2E94-4593-80A1-BE0DAB9454A5} (2) - 3344 - excel.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{451466D4-5166-4794-B27B-C8CD184AE5F3} (0) - 904 - outlook.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{451466D4-5166-4794-B27B-C8CD184AE5F3} (0) - 904 - outlook.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{451466D4-5166-4794-B27B-C8CD184AE5F3} (1) - 904 - outlook.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{451466D4-5166-4794-B27B-C8CD184AE5F3} (1) - 904 - outlook.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{451466D4-5166-4794-B27B-C8CD184AE5F3} (2) - 904 - outlook.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{6546F78C-B365-4242-A7C0-C17F4B77F309} (0) - 4084 - outlook.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{6546F78C-B365-4242-A7C0-C17F4B77F309} (0) - 4084 - outlook.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{6546F78C-B365-4242-A7C0-C17F4B77F309} (1) - 4084 - outlook.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{6546F78C-B365-4242-A7C0-C17F4B77F309} (1) - 4084 - outlook.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{6546F78C-B365-4242-A7C0-C17F4B77F309} (2) - 4084 - outlook.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{94EAEC45-055E-40D3-AC7E-1317913A835B} (0) - 3100 - mspub.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{94EAEC45-055E-40D3-AC7E-1317913A835B} (0) - 3100 - mspub.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{94EAEC45-055E-40D3-AC7E-1317913A835B} (1) - 3100 - mspub.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{94EAEC45-055E-40D3-AC7E-1317913A835B} (1) - 3100 - mspub.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{94EAEC45-055E-40D3-AC7E-1317913A835B} (2) - 3100 - mspub.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{9563EC4C-BF03-4AA4-ABB5-7395066C012E} (0) - 1432 - winword.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{9563EC4C-BF03-4AA4-ABB5-7395066C012E} (0) - 1432 - winword.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{9563EC4C-BF03-4AA4-ABB5-7395066C012E} (1) - 1432 - winword.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{9563EC4C-BF03-4AA4-ABB5-7395066C012E} (1) - 1432 - winword.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{9563EC4C-BF03-4AA4-ABB5-7395066C012E} (2) - 1432 - winword.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{99EF5110-2E92-4433-B206-F9A1D9F0BE82} (0) - 3932 - powerpnt.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{99EF5110-2E92-4433-B206-F9A1D9F0BE82} (0) - 3932 - powerpnt.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{99EF5110-2E92-4433-B206-F9A1D9F0BE82} (1) - 3932 - powerpnt.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{99EF5110-2E92-4433-B206-F9A1D9F0BE82} (1) - 3932 - powerpnt.exe - OTeleMediumCost.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\{99EF5110-2E92-4433-B206-F9A1D9F0BE82} (2) - 3932 - powerpnt.exe - OTele.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.6743.1212\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\adm\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\adm\OneDrive.adml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\adm\OneDrive.admx - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\af\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\af\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\alertIcon.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\am-et\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\amd64\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\AppBlue.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\AppErrorBlue.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\AppErrorWhite.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\AppWhite.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ar\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\arm64\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\as-in\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\AutoPlayOptIn.gif - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\AutoPlayOptIn.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\az-latn-az\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\be\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\be\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\bg\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\bg\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\bn-bd\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\bn-in\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\bs-latn-ba\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ca-es-valencia\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ca\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ca\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\cs\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\cs\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\cy-gb\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\da\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\da\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\de\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\de\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\el\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\el\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ElevatedAppBlue.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ElevatedAppWhite.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\en-gb\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\en\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\en\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\Error.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ErrorPage.html - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\es\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\es\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\et\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\et\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\eu\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\eu\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\fa\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\fa\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\fi\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\fi\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\fil-ph\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\fr\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\fr\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ga-ie\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\gd-latn\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\gl\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\gl\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\gu\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\gu\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ha-latn-ng\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\he\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\he\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\hi\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\hi\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\hr\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\hr\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\hu\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\hu\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\hy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\hy\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\id\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\id\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ig-ng\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\imageformats\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\images\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\is\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\is\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\it\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\it\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ja\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ja\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ka\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ka\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\kk\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\kk\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\km-kh\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\kn\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\kn\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ko\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ko\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\kok\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\kok\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ku-arab\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ky\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ky\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\lb-lu\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\LoadingPage.html - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\lt\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\lt\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\lv\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\lv\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\mi-nz\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\mk\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\mk\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ml-in\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\mn\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\mn\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\mr\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\mr\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ms\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ms\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\mt-mt\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\nb-no\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ne-np\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\nl\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\nl\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\nn-no\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\nso-za\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\OneDriveLogo.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\or-in\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\pa-arab\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\pa\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\pa\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\pl\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\pl\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\platforms\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\prs-af\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\pt-br\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\pt-pt\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\qml\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\qml\fabricmdl2.ttf - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\qml\QtQuick.2\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\qml\QtQuick\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\QuotaCritical.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\QuotaError.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\QuotaNearing.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\qut-latn\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\quz-pe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ro\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ro\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ru\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ru\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\rw\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\rw\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\SaveApplicationEventLogs.wsf - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ScreenshotOptIn.gif - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sd-arab\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\si-lk\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sk\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sk\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sl\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sl\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sq\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sq\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sr-cyrl-ba\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sr-cyrl-rs\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sr-latn-rs\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sv\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sv\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sw\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\sw\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ta\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ta\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\te\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\te\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\TestSharePage.html - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\tg-cyrl\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\th\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\th\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ThirdPartyNotices.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ti\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ti\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\tk-tm\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\tn-za\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\tr\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\tr\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\tt\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\tt\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ug-arab\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\uk\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\uk\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ur\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\ur\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\uz-latn-uz\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\vi\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\vi\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\Warning.png - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\wo\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\wo\FileSync.LocalizedResources.dll.mui - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\xh-za\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\yo-ng\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\zh-cn\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\zh-tw\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\17.3.7294.0108\zu-za\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2017-10-13.931.788.1.odl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2017-10-20.728.2412.1.odl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2017-10-24.733.3644.1.odl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2017-11-9.1012.3172.1.odl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2017-9-4.1033.3896.1.odl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2017-9-6.1152.120.1.odl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2017-9-8.837.904.1.odl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2018-2-14.1036.2804.1.odl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\standaloneUpdaterTelemetryCache.otc - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\standaloneUpdaterTelemetryCache.otc.session - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\telemetryCache.otc - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Common\telemetryCache.otc.session - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Personal\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Personal\TraceArchive.5892.0626-0.etl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Personal\TraceArchive.6943.0625-1.etl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Personal\TraceArchive.6998.0830-2.etl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\Personal\TraceCurrent.7076.1026.etl - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install-PerUser_2017-08-25_095804_e80-e84.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install-PerUser_2017-08-25_101410_f84-eb4.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install-PerUser_2017-09-04_123316_c28-c24.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install-PerUser_2017-10-13_113206_7f4-dc8.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install-PerUser_2017-11-09_111218_e54-e58.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install-PerUser_2018-02-14_113640_d68-cb0.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install_2017-08-25_095803_e54-e58.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install_2017-08-25_101409_960-e20.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install_2017-09-04_123312_ea0-870.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install_2017-10-13_113202_f28-eec.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install_2017-11-09_111215_e20-e24.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\Install_2018-02-14_113635_5c0-718.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2017-09-04_123303_f38-f14.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2017-09-06_135244_78-5a0.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2017-09-08_103729_388-f84.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2017-10-13_113153_314-414.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2017-10-20_092830_96c-d40.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2017-10-24_093359_e3c-e68.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2017-11-09_111209_c64-c68.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2018-02-14_113628_af4-c0c.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\StandaloneUpdater\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\StandaloneUpdater\Update.xml - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\gliding\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\Internet Explorer\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\Internet Explorer\Desktop\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Publisher\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\TaskSchedulerConfig\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\UserProfileRoaming\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Live\Bici\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Live\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\settings.ini - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\settings.ini.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft_Corporation\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft_Corporation\powershell_ise.exe_StrongName_lw2v2vm3wmtzzpebq33gybmeoxukb04w\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\MicrosoftEdge\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\MicrosoftEdge\SharedCacheContainers\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_bingpagedata\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompatua\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_ieflipahead\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\MicrosoftEdge\User\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\MicrosoftEdge\User\Default\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\i6gc44p4.default\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\9E2F88E3.Twitter_wgeqdkkx372wm\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\king.com.CandyCrushSodaSaga_kgqvnymyfvs32\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.3DBuilder_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Appconnector_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.BingFinance_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.BingNews_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.BingSports_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.CommsPhone_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.LockApp_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Messaging_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Office.Sway_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.People_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.WindowsFeedback_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.WindowsPhone_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Windows.ContactSupport_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\windows.devicesflow_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Windows.MiracastView_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Windows.PrintDialog_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Windows.PurchaseDialog_cw5n1h2txyewy\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\windows_ie_ac_001\AC\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\windows_ie_ac_001\AC\INetCache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\windows_ie_ac_001\AC\INetCookies\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\windows_ie_ac_001\AC\INetHistory\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\windows_ie_ac_001\AC\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\windows_ie_ac_001\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\PeerDistRepub\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Publishers\8wekyb3d8bbwe\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Publishers\8wekyb3d8bbwe\Fonts\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Publishers\8wekyb3d8bbwe\Licenses\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Publishers\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\-e jJuv2TeKL.pdf - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\-e jJuv2TeKL.pdf.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\-ZZr9xYkqr28kj4Ewly.bmp - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\-ZZr9xYkqr28kj4Ewly.bmp.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0rGnGm QreoWsur9e.mp3 - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0rGnGm QreoWsur9e.mp3.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1dIAUE6JjxOcRnUgYL.mp4 - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1dIAUE6JjxOcRnUgYL.mp4.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2nz3uSwqyVXWxqCOCF18.gif - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2nz3uSwqyVXWxqCOCF18.gif.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dBLEEVc8Nl3ui3b.m4a - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dBLEEVc8Nl3ui3b.m4a.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\DdyE 50uK2L.gif - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\DdyE 50uK2L.gif.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\F-PsEooiB7-oXDbtz1id.bmp - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\F-PsEooiB7-oXDbtz1id.bmp.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fAfwVeyGLAK7P93Obz3Y.pdf - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fAfwVeyGLAK7P93Obz3Y.pdf.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hLFQVM89GDd j6TcCek.m4a - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hLFQVM89GDd j6TcCek.m4a.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\iEyof2ITfx5.flv - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\iEyof2ITfx5.flv.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\l5sTDgUGeyhDz.gif - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\l5sTDgUGeyhDz.gif.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\LtnS7XaVnVQol2Qn1xH.avi - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\LtnS7XaVnVQol2Qn1xH.avi.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\mLE9mf-BdFdOibSg9l.wav - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\mLE9mf-BdFdOibSg9l.wav.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\oUGX-5zbSZw.gif - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\oUGX-5zbSZw.gif.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\R6QY5M2ifYeXIFzAbryD.png - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\R6QY5M2ifYeXIFzAbryD.png.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\SDaC6UaMD-p1Jk.mp3 - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\SDaC6UaMD-p1Jk.mp3.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tVTfmiVg4ragt74J-.bmp - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tVTfmiVg4ragt74J-.bmp.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\YO5CdbmrFGoGb.bmp - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\YO5CdbmrFGoGb.bmp.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8IT9H3B2\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\S0DXV6ZB\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\Z8MX2JKH\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.MSO\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.Word\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\counters.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\8IT9H3B2\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\8IT9H3B2\instrument17[1].htm - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\S0DXV6ZB\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\Z8MX2JKH\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\IE\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\SmartScreenCache.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\SuggestedSites.dat - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Virtualized\C\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Virtualized\C\Users\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Virtualized\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDB.chk - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDB.chk.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDB.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDB00006.log - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDB00006.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDBres00001.jrs - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDBres00001.jrs.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDBres00002.jrs - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDBres00002.jrs.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDBtmp.log - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\EDBtmp.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\TileDataLayer\Database\vedatamodel.edb - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Temp\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\AggregateCache.uca - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\AggregateCache.uca.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\store.vol - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\tmp.edb - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateTransparency\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\settings.dat - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\settings.dat.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CrashpadMetrics-active.pma - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CrashpadMetrics-active.pma.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Cache\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\Databases.db - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\Databases.db.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\000003.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\000003.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\IndexedDB\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\IndexedDB\https_www.google.com_0.indexeddb.leveldb\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\https_www.youtube.com_0.localstorage - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\previews_opt_out.db - Access, Read, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\previews_opt_out.db.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Service Worker\CacheStorage\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Service Worker\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Service Worker\Database\000003.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Service Worker\Database\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Service Worker\ScriptCache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\000003.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Data\LevelDB\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Extension Settings\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\_crx_aohghmighlieiainnegkcijnfilokake\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\EVWhitelist\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OriginTrials\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\PepperFlash\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Safe Browsing\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SSLErrorAssistant\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SwReporter\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\WidevineCdm\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\CrashReports\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\MSHist012018031420180315\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\UsageLogs\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\mmc.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\mmc.exe.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\powershell_ise.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\powershell_ise.exe.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\sdiagnhost.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\sdiagnhost.exe.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\UsageLogs\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Event Viewer\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\3Y244KAF\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ASF6K8JF\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\M2CKLQNS\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZH5Q7INF\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.CRAB - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\Internet Explorer Suggested Sites~.feed-ms - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\GameDVR\KnownGameList.bin - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\Application Data\\CRAB-DECRYPT.txt - Access
C:\Documents and Settings\Nd9E1FYi\AppData\Local\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\Nd9E1FYi\\CRAB-DECRYPT.txt - Access
C:\MSOCache\\CRAB-DECRYPT.txt - Access
C:\PerfLogs\\CRAB-DECRYPT.txt - Access
C:\Program Files\WindowsPowerShell\Modules - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Commands.Management - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Commands.Management\Microsoft.PowerShell.Commands.Management.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Commands.Utility - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Commands.Utility\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1 - Access, Read
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\Pester - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.3.5 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.3.5\3.3.5.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.3.5\3.3.5.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.3.5\3.3.5.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.3.5\3.3.5.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.3.5\3.3.5.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.3.5\Pester.psd1 - Access, Read
C:\Program Files\WindowsPowerShell\Modules\Pester\3.3.5\Pester.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1 - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\1.0.0.1.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\1.0.0.1.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\1.0.0.1.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\1.0.0.1.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\1.0.0.1.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1 - Access, Read
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\1.1.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\1.1.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\1.1.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\1.1.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\1.1.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\en - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\en\en.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\en\en.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\en\en.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\en\en.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\en\en.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\PSReadline.psd1 - Access, Read
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\PSReadLine.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.xaml - Access
C:\ProgramData\Oracle\Java\javapath - Access
C:\Recovery\\CRAB-DECRYPT.txt - Access
C:\System Volume Information\\CRAB-DECRYPT.txt - Access
C:\Users - Access
C:\Users\\CRAB-DECRYPT.txt - Access
C:\Users\Default User\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Application Data\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\History\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\settings.ini - Access
C:\Users\Default\AppData\Local\Temp\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Application Data\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Cookies\\CRAB-DECRYPT.txt - Access
C:\Users\Default\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Desktop\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\My Music\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\My Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\My Videos\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Downloads\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Favorites\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Links\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Music\\CRAB-DECRYPT.txt - Access
C:\Users\Default\My Documents\\CRAB-DECRYPT.txt - Access
C:\Users\Default\NetHood\\CRAB-DECRYPT.txt - Access
C:\Users\Default\NTUSER.DAT.LOG1 - Access
C:\Users\Default\NTUSER.DAT.LOG2 - Access
C:\Users\Default\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf - Access
C:\Users\Default\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms - Access
C:\Users\Default\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms - Access
C:\Users\Default\Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Default\PrintHood\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Recent\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Saved Games\\CRAB-DECRYPT.txt - Access
C:\Users\Default\SendTo\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Start Menu\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Templates\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Videos\\CRAB-DECRYPT.txt - Access
C:\Users\Nd9E1FYi - Access
C:\Users\Nd9E1FYi\AppData\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\ - Access
C:\Users\Nd9E1FYi\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_96fb2ebe-5768-403c-8fbc-1b0ef0323733 - Access, Read
C:\Users\Nd9E1FYi\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex MD5: 209a126e4839093dbd140950fa232dff
SHA1: a98ffb3882b8f519eede39d32935578d6e4c774b
SHA256: 8ff6e7821f5e3cea46c176bd5ccc51c24ac089de25cfa18412726d00c0d59b75 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Local\Temp\ - Access
C:\Users\Nd9E1FYi\AppData\Local\Temp\4yreaw5k.md3.ps1 MD5: c4ca4238a0b923820dcc509a6f75849b
SHA1: 356a192b7913b04c54574d18c28d46e6395428ab
SHA256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b 		Access, Write
C:\Users\Nd9E1FYi\AppData\Local\Temp\dppe3wwf.ebw.psm1 MD5: c4ca4238a0b923820dcc509a6f75849b
SHA1: 356a192b7913b04c54574d18c28d46e6395428ab
SHA256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\27YjI_tg_wmDvK-.gif MD5: 33b37811e300cd38fd42ee4595e64a7a
SHA1: 13a299124374d056be60ad69363b0d61a61bba94
SHA256: 0943f228aaba2fdb420dae8af3705520ae645c4f5c9128d7202a1ecbce49e50f 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\27YjI_tg_wmDvK-.gif.CRAB MD5: 33b37811e300cd38fd42ee4595e64a7a
SHA1: 13a299124374d056be60ad69363b0d61a61bba94
SHA256: 0943f228aaba2fdb420dae8af3705520ae645c4f5c9128d7202a1ecbce49e50f 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\2KxNzGrrl.doc MD5: 0925ae510c00843e8ff004dcd205ad55
SHA1: 13d2e372537974ae87bf0beacf52fabb8bf16bfe
SHA256: 5d6434586875c05706540c9cd8f9f507ae0cfeeb9debf5ef47ef1cf69a9f56cb 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\2KxNzGrrl.doc.CRAB MD5: 0925ae510c00843e8ff004dcd205ad55
SHA1: 13d2e372537974ae87bf0beacf52fabb8bf16bfe
SHA256: 5d6434586875c05706540c9cd8f9f507ae0cfeeb9debf5ef47ef1cf69a9f56cb 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\57VfXi.wav MD5: 57d39e8e934f486ce2df553b8b37cefb
SHA1: 6f88945811525cd707f139d8acaf24b0c4bb7c32
SHA256: 0acf88959fd6d0b83eed505404f3054aeb4efa76852d09cc63aad4fc40f57afb 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\57VfXi.wav.CRAB MD5: 57d39e8e934f486ce2df553b8b37cefb
SHA1: 6f88945811525cd707f139d8acaf24b0c4bb7c32
SHA256: 0acf88959fd6d0b83eed505404f3054aeb4efa76852d09cc63aad4fc40f57afb 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\7y338WW30Khw_Kvdj.bmp MD5: 73aa67b6c11cb8e4e3d9a5ae9e12b7db
SHA1: 5e074b352b05c7e0f14cfa90cc39529742370023
SHA256: a9a4fc09573596b03c01eb43953db285750d41ed3cfc34fc5edd3021f96e020f 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\7y338WW30Khw_Kvdj.bmp.CRAB MD5: 73aa67b6c11cb8e4e3d9a5ae9e12b7db
SHA1: 5e074b352b05c7e0f14cfa90cc39529742370023
SHA256: a9a4fc09573596b03c01eb43953db285750d41ed3cfc34fc5edd3021f96e020f 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\80nauBl1bcqQ.mp3 MD5: 2ec9e11e00d2cf8d0c49b4f1e143178f
SHA1: aa0cee6278ad02cf49fb121cc2632fa124bce608
SHA256: 3eb0079a1b3d5a29c7fe1cb0ef849f01f9ff6c7474f39a9ed95069c17f52a9b1 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\80nauBl1bcqQ.mp3.CRAB MD5: 2ec9e11e00d2cf8d0c49b4f1e143178f
SHA1: aa0cee6278ad02cf49fb121cc2632fa124bce608
SHA256: 3eb0079a1b3d5a29c7fe1cb0ef849f01f9ff6c7474f39a9ed95069c17f52a9b1 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\9HQb6.gif MD5: f19b4b0480a637a87e8e65a12b15987c
SHA1: 2d9bd346f04a49ee8c50811c8ae4e4c4674639a4
SHA256: c7e2b6295b7b77ca2518fef935b429074004e45dd638a5bb08d3608854259c12 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\9HQb6.gif.CRAB MD5: f19b4b0480a637a87e8e65a12b15987c
SHA1: 2d9bd346f04a49ee8c50811c8ae4e4c4674639a4
SHA256: c7e2b6295b7b77ca2518fef935b429074004e45dd638a5bb08d3608854259c12 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\aD456ynae.png MD5: b3e9dec2280047385d315d862dbeed9b
SHA1: ae478640536d46e333c43f2841d23f3e43733d9f
SHA256: 464d2602d76d629350d377995403fd8379c59f32211b8514579f98b66711c4f2 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\aD456ynae.png.CRAB MD5: b3e9dec2280047385d315d862dbeed9b
SHA1: ae478640536d46e333c43f2841d23f3e43733d9f
SHA256: 464d2602d76d629350d377995403fd8379c59f32211b8514579f98b66711c4f2 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\Collab\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\Forms\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\JSCache\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata MD5: 9556ec253b68d3316da8ce5805124195
SHA1: 0ae6967e9b17f83525ebd1b2a68dd1bbbbb3bafb
SHA256: e7ea07c3c3edeed4c2390e344c148f2d02f4d960e4de71e5b70c2eb85af03ca4 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.CRAB MD5: 9556ec253b68d3316da8ce5805124195
SHA1: 0ae6967e9b17f83525ebd1b2a68dd1bbbbb3bafb
SHA256: e7ea07c3c3edeed4c2390e344c148f2d02f4d960e4de71e5b70c2eb85af03ca4 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\Security\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl MD5: 77c3dfeb6e7c910439ceb13793412d3a
SHA1: 01db9ff3c4f0644b703d32ca6a8e7b9f2dc323db
SHA256: 693ff4318218952cc39d4c6534eb81e7f2274d3dde4851f77d6a4882923f39b2 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.CRAB MD5: 77c3dfeb6e7c910439ceb13793412d3a
SHA1: 01db9ff3c4f0644b703d32ca6a8e7b9f2dc323db
SHA256: 693ff4318218952cc39d4c6534eb81e7f2274d3dde4851f77d6a4882923f39b2 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl MD5: 038f0d3fa4f6c30bda347e14daa5d509
SHA1: 3a63eda2be6bbde9ed8e92e299d32c3a070fa80c
SHA256: 1aff34b598561d6a511196a7de352e236109f0578c4912f64b2dac865a0f8f15 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.CRAB MD5: 038f0d3fa4f6c30bda347e14daa5d509
SHA1: 3a63eda2be6bbde9ed8e92e299d32c3a070fa80c
SHA256: 1aff34b598561d6a511196a7de352e236109f0578c4912f64b2dac865a0f8f15 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Flash Player\AssetCache\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Flash Player\AssetCache\EYGUEQKQ\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Flash Player\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Flash Player\NativeCache\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Headlights\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Linguistics\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\LogTransport2\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\LogTransport2\Logs\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_Acrobat12_Reader_3980e2e3-09b5-4737-a657-22675b06a39a_03db394c-1477-45d1-895c-00e42db7e723_0.rdy MD5: 422c175e6e571cf2e4492c0db57061ee
SHA1: 41bceed183f6ce224cc0dca9d925927dff29db0d
SHA256: 3316929aa2a8d8b7f24d4c2a963b098b542ea55227b541c628393e0565a7ae89 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_Acrobat12_Reader_3980e2e3-09b5-4737-a657-22675b06a39a_03db394c-1477-45d1-895c-00e42db7e723_0.rdy.CRAB MD5: 422c175e6e571cf2e4492c0db57061ee
SHA1: 41bceed183f6ce224cc0dca9d925927dff29db0d
SHA256: 3316929aa2a8d8b7f24d4c2a963b098b542ea55227b541c628393e0565a7ae89 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg MD5: 5dacfa3f9df2e8f4348e0d45e9ceed74
SHA1: 84466badd7fc255dd0ae18bbff5b7340d94b856c
SHA256: 36c7c2d247c0313f9d1d96632ac13286b9ce48b5e424b50967a04fa884777fc8 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg.CRAB MD5: 5dacfa3f9df2e8f4348e0d45e9ceed74
SHA1: 84466badd7fc255dd0ae18bbff5b7340d94b856c
SHA256: 36c7c2d247c0313f9d1d96632ac13286b9ce48b5e424b50967a04fa884777fc8 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Sonar\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Sonar\Sonar1.0\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml MD5: e65e1a2c9c85016aa94dc6aa760c57e6
SHA1: d9ff601028219fccb785065fd3090fcd50f45e1f
SHA256: aa4a0f0ba0b26ad1dfe2840bf6d04784b8e96c51889200347283b0f8c73cdce3 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml.CRAB MD5: e65e1a2c9c85016aa94dc6aa760c57e6
SHA1: d9ff601028219fccb785065fd3090fcd50f45e1f
SHA256: aa4a0f0ba0b26ad1dfe2840bf6d04784b8e96c51889200347283b0f8c73cdce3 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\BC4CK.mp3 MD5: f3e9ec68a907777d38584fbbafa33563
SHA1: adc75a14ca07b283854561c5a71fc609b4cd83d6
SHA256: 3f4a5974e890e7a2423dcca139577b2a4d7277d4e2b24ced7fdab96f1c533987 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\BC4CK.mp3.CRAB MD5: f3e9ec68a907777d38584fbbafa33563
SHA1: adc75a14ca07b283854561c5a71fc609b4cd83d6
SHA256: 3f4a5974e890e7a2423dcca139577b2a4d7277d4e2b24ced7fdab96f1c533987 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Cx 2hVTJNEPKc.mp3 MD5: 2fe501450902ecb586556d3185442805
SHA1: 659e60b75850cf04c0f01734e42f416457731bd6
SHA256: 2d33695032ec3724b21038dc5da2731483ff0b58d40cce695b0bb1f3071347ea 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Cx 2hVTJNEPKc.mp3.CRAB MD5: 2fe501450902ecb586556d3185442805
SHA1: 659e60b75850cf04c0f01734e42f416457731bd6
SHA256: 2d33695032ec3724b21038dc5da2731483ff0b58d40cce695b0bb1f3071347ea 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\d 3OIHehyy3Jgx.mp4 MD5: b844612a261fa35f563f6e8fed742891
SHA1: a0f80bc7662764fcaeb715321314b3de15bbd715
SHA256: e80b65c06b5701001337bb24061b55786d0d1e1792cd11861cd7b2987fa77d27 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\d 3OIHehyy3Jgx.mp4.CRAB MD5: b844612a261fa35f563f6e8fed742891
SHA1: a0f80bc7662764fcaeb715321314b3de15bbd715
SHA256: e80b65c06b5701001337bb24061b55786d0d1e1792cd11861cd7b2987fa77d27 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Dz28gHwyj9-jVurMnBQV.ots MD5: 36b6019f59d531e698b09ff9340cab6c
SHA1: 3b86abf0f7962fd32b76222ef324c9a8843a6a12
SHA256: a0328766660c9dc51a52bcd4e4acb62df7ee5d242411eb4915ac541e363c13ee 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Dz28gHwyj9-jVurMnBQV.ots.CRAB MD5: 36b6019f59d531e698b09ff9340cab6c
SHA1: 3b86abf0f7962fd32b76222ef324c9a8843a6a12
SHA256: a0328766660c9dc51a52bcd4e4acb62df7ee5d242411eb4915ac541e363c13ee 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\fezrNJYET8dXBnLxa.mp4 MD5: b1c736b29b0e697b2d0d1090a003aed1
SHA1: 62c0f72a8194fb4d78be4d6f273bd81bbc60d829
SHA256: f10af594f52228588d6867e4fb1bae7ba0a436b1b2a28dc2a4244abaea651a4c 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\fezrNJYET8dXBnLxa.mp4.CRAB MD5: b1c736b29b0e697b2d0d1090a003aed1
SHA1: 62c0f72a8194fb4d78be4d6f273bd81bbc60d829
SHA256: f10af594f52228588d6867e4fb1bae7ba0a436b1b2a28dc2a4244abaea651a4c 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\FKoQ.odt MD5: a67864437f7df752af8067739eb9fead
SHA1: 5c68c6248fb43d41c415433277e55d0ad6da4890
SHA256: 87b90562688bebe43710921a5a3ef8b5787ee17ed516a326020b8ebd1337a635 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\FKoQ.odt.CRAB MD5: a67864437f7df752af8067739eb9fead
SHA1: 5c68c6248fb43d41c415433277e55d0ad6da4890
SHA256: 87b90562688bebe43710921a5a3ef8b5787ee17ed516a326020b8ebd1337a635 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\gfLne6ecA1jmfG6m8.mkv MD5: 254a59ce4a44e6a2ccddcdcdebd0b2bd
SHA1: 5fa896a2497bcec5a80dcd1e7ca6a719568e088e
SHA256: bab8f84304e72431acadc45dd0348f9da39c723a4e22cc5c785dae5a2d482f18 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\gfLne6ecA1jmfG6m8.mkv.CRAB MD5: 254a59ce4a44e6a2ccddcdcdebd0b2bd
SHA1: 5fa896a2497bcec5a80dcd1e7ca6a719568e088e
SHA256: bab8f84304e72431acadc45dd0348f9da39c723a4e22cc5c785dae5a2d482f18 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Im-Xi-TXJUjXU8gwjeAN.avi MD5: cc02aad286bbc55c846334b9fcf97c23
SHA1: 2bca1d93c5a0921a9d7cc175bbba1128b015d127
SHA256: 8346acc9eb71d7ea8c9e5c6349400f8a3511a3a9c51787ee853b562c84c39c05 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Im-Xi-TXJUjXU8gwjeAN.avi.CRAB MD5: cc02aad286bbc55c846334b9fcf97c23
SHA1: 2bca1d93c5a0921a9d7cc175bbba1128b015d127
SHA256: 8346acc9eb71d7ea8c9e5c6349400f8a3511a3a9c51787ee853b562c84c39c05 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\iVmnctwjmS.swf MD5: 0ef0cc6639cce2a58068f5728f29cfb8
SHA1: 9984d40ab0cac952cce1567dd572c60c8795873a
SHA256: 36c9e35afb1b56487098e9d116967099c08218dd1379e5f21c41845c6521883a 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\iVmnctwjmS.swf.CRAB MD5: 0ef0cc6639cce2a58068f5728f29cfb8
SHA1: 9984d40ab0cac952cce1567dd572c60c8795873a
SHA256: 36c9e35afb1b56487098e9d116967099c08218dd1379e5f21c41845c6521883a 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\je8O8Wzi8buOk7-5Nx6.m4a MD5: d82980ee504e39e8b872bf5c544ded94
SHA1: 67509d96388c9e4549839eb26a2457afba8e6554
SHA256: 8e4af37c3738adaa3e7d8cff2d1100b0b347968265695a47bf6a5a819076a95f 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\je8O8Wzi8buOk7-5Nx6.m4a.CRAB MD5: d82980ee504e39e8b872bf5c544ded94
SHA1: 67509d96388c9e4549839eb26a2457afba8e6554
SHA256: 8e4af37c3738adaa3e7d8cff2d1100b0b347968265695a47bf6a5a819076a95f 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\KdoskM.avi MD5: a7b942969f1bf68b179aeae423e4d378
SHA1: 0630f7af67c4c94dde2d6ad8b8da03c9873a38a6
SHA256: ad084a7dec745f4a3aaee85b041cec212553d93610df37ac680a30dc9425debf 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\KdoskM.avi.CRAB MD5: a7b942969f1bf68b179aeae423e4d378
SHA1: 0630f7af67c4c94dde2d6ad8b8da03c9873a38a6
SHA256: ad084a7dec745f4a3aaee85b041cec212553d93610df37ac680a30dc9425debf 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Macromedia\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\P7UB2489\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Macromedia\Flash Player\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Macromedia\Flash Player\macromedia.com\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol MD5: e2206511aff69f5b850d7ee6a919d27f
SHA1: ee4ca5d547dede4f68e1f0800bc49f1c8b25c09d
SHA256: 62d05c8600db2b0702a08a711fba484251fa50f6ee3ac750422c9a0acf04c121 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol.CRAB MD5: e2206511aff69f5b850d7ee6a919d27f
SHA1: ee4ca5d547dede4f68e1f0800bc49f1c8b25c09d
SHA256: 62d05c8600db2b0702a08a711fba484251fa50f6ee3ac750422c9a0acf04c121 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\AddIns\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl MD5: 61a3ee38ddc2f88dfc40025034077a92
SHA1: fb7e2435fd22aaef4d5b0d7056c8b470208bac10
SHA256: 051b6b195d37c676c45792a492e1a97b887682c33de73ef773fef87d75e4a383 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl.CRAB MD5: 61a3ee38ddc2f88dfc40025034077a92
SHA1: fb7e2435fd22aaef4d5b0d7056c8b470208bac10
SHA256: 051b6b195d37c676c45792a492e1a97b887682c33de73ef773fef87d75e4a383 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL MD5: f46785f453192d5fa1329a94665afe5f
SHA1: 1216204b959550a1a66e271cdb6073f6dacc1e2c
SHA256: 4e598970a4f86cc010ce3b21af510d4b8cea876b3f1a872f7f8fefccecd4f5b4 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL.CRAB MD5: f46785f453192d5fa1329a94665afe5f
SHA1: 1216204b959550a1a66e271cdb6073f6dacc1e2c
SHA256: 4e598970a4f86cc010ce3b21af510d4b8cea876b3f1a872f7f8fefccecd4f5b4 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL MD5: 57b717430663f711e0764f54f75b1171
SHA1: be1f3bb094b8f1498be1c1df96440c837dd00da7
SHA256: 153a5e3ce6252846f9523a2478e0ba07ad33477cdf6658f0a5d824e831e75010 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL.CRAB MD5: 57b717430663f711e0764f54f75b1171
SHA1: be1f3bb094b8f1498be1c1df96440c837dd00da7
SHA256: 153a5e3ce6252846f9523a2478e0ba07ad33477cdf6658f0a5d824e831e75010 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL MD5: 804d9447d5d2bb18e587d344f3e2dfcb
SHA1: 80a928f7ff94f126a9e65afe6c6f29f211bd5d49
SHA256: 5d6fc9f27eb1eeb05e5009eb9e52b870fa68add981e1e375fb53a321db44ef99 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL.CRAB MD5: 804d9447d5d2bb18e587d344f3e2dfcb
SHA1: 80a928f7ff94f126a9e65afe6c6f29f211bd5d49
SHA256: 5d6fc9f27eb1eeb05e5009eb9e52b870fa68add981e1e375fb53a321db44ef99 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL MD5: 3911c8d6204fe569e721de94f0012e17
SHA1: ef594d1e156346303d06abb45abbf01cfe9d7935
SHA256: f01dcde8c722bb53f3870f2ade6d178c6c3484540ed2237e034c55b3c6028c77 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL.CRAB MD5: 3911c8d6204fe569e721de94f0012e17
SHA1: ef594d1e156346303d06abb45abbf01cfe9d7935
SHA256: f01dcde8c722bb53f3870f2ade6d178c6c3484540ed2237e034c55b3c6028c77 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl MD5: 3839347e1addcada30ca46af95551fb6
SHA1: 820ef21437fb9dfc29447de715c26f5807bf29ed
SHA256: 022bac14a6f2e6627c0123173ade165e6bde76bcf171ba0abaa57b4c1bcf9333 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.CRAB MD5: 3839347e1addcada30ca46af95551fb6
SHA1: 820ef21437fb9dfc29447de715c26f5807bf29ed
SHA256: 022bac14a6f2e6627c0123173ade165e6bde76bcf171ba0abaa57b4c1bcf9333 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl MD5: 0cb7b278cc858433c4a247def784e45a
SHA1: 77cd02cb67c5dce7d59716b98ccf3646a55d2331
SHA256: 001ed2b3f7bf57a61394d678d8e65a7fd20d16d26291355528b5cb7410093ea5 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl.CRAB MD5: 0cb7b278cc858433c4a247def784e45a
SHA1: 77cd02cb67c5dce7d59716b98ccf3646a55d2331
SHA256: 001ed2b3f7bf57a61394d678d8e65a7fd20d16d26291355528b5cb7410093ea5 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL MD5: 355bff6c28a5f7534daa0d8acb1b5081
SHA1: 131cbc60972f1e53ba414340850852e0d7a60c92
SHA256: 8d85ac523e6689458187382686ea77a4e749d1b862e588e24fd8a73bf976e565 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL.CRAB MD5: 355bff6c28a5f7534daa0d8acb1b5081
SHA1: 131cbc60972f1e53ba414340850852e0d7a60c92
SHA256: 8d85ac523e6689458187382686ea77a4e749d1b862e588e24fd8a73bf976e565 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL MD5: d49957312865f0a5b9da55be60742991
SHA1: 7dc3002b0834874fc99ac7c06a1bd8a5402bc82f
SHA256: 96fc0864f529925fc710d58015cea830e68dcf982f8a1990ed99f6a7ca405d4e 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL.CRAB MD5: d49957312865f0a5b9da55be60742991
SHA1: 7dc3002b0834874fc99ac7c06a1bd8a5402bc82f
SHA256: 96fc0864f529925fc710d58015cea830e68dcf982f8a1990ed99f6a7ca405d4e 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl MD5: 84908043b8b4075593e2354ab53eba99
SHA1: 9262318a94cea1501eea1db22543e7d8e3acb989
SHA256: ba45ccf8eb13d6870268d83c2ee6965340570ab76de31cef292fab83d8c93cf9 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.CRAB MD5: 84908043b8b4075593e2354ab53eba99
SHA1: 9262318a94cea1501eea1db22543e7d8e3acb989
SHA256: ba45ccf8eb13d6870268d83c2ee6965340570ab76de31cef292fab83d8c93cf9 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL MD5: e912d2fc3c9283572d218869dd8502f3
SHA1: 6399f35b2bc5412e5854e3d2ceb800997a4eec44
SHA256: 6d505e8e8d511f7a25d837c39f70e70fe5322a1e660833efe5cbcde776567fb0 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL.CRAB MD5: e912d2fc3c9283572d218869dd8502f3
SHA1: 6399f35b2bc5412e5854e3d2ceb800997a4eec44
SHA256: 6d505e8e8d511f7a25d837c39f70e70fe5322a1e660833efe5cbcde776567fb0 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL MD5: a1c6df9aa0c2e4d5a7d0fff984a16941
SHA1: 614c5eb554473012e2d12a1753b97ba3d00d9807
SHA256: ea2d96a2846045199eddd79e4f3800cdaab5b068c6b292ea58755174aef5b096 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL.CRAB MD5: a1c6df9aa0c2e4d5a7d0fff984a16941
SHA1: 614c5eb554473012e2d12a1753b97ba3d00d9807
SHA256: ea2d96a2846045199eddd79e4f3800cdaab5b068c6b292ea58755174aef5b096 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Credentials\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Crypto\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Crypto\RSA\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2172869166-1497266965-2109836178-1000\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx MD5: 03571da0bb80d64c6740abdc86f2747d
SHA1: 82e22d7a3c682d859a6098623b9232a94c26e2ea
SHA256: 307be3c2c5dffc70e0cef6bd9cc3ab84177c4bd7bdabdf7ce92cb39758cd59a8 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx.CRAB MD5: 03571da0bb80d64c6740abdc86f2747d
SHA1: 82e22d7a3c682d859a6098623b9232a94c26e2ea
SHA256: 307be3c2c5dffc70e0cef6bd9cc3ab84177c4bd7bdabdf7ce92cb39758cd59a8 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Document Building Blocks\1033\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Document Building Blocks\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Excel\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Excel\XLSTART\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\InputMethod\Chs\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\InputMethod\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Internet Explorer\UserData\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\MMC\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Network\Connections\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Network\Connections\Pbk\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Network\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Office\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Office\MSO1033.acl MD5: 2ad3ef61650d42d6cd1e7d4d32a0bb41
SHA1: d6d2c8dd5bf597ac2b789c73537c9fc49969693b
SHA256: 25ecd528bab6b79c7dc44ac022195582f25b70563d12c8d8884508d468270df4 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Office\MSO1033.acl.CRAB MD5: 2ad3ef61650d42d6cd1e7d4d32a0bb41
SHA1: d6d2c8dd5bf597ac2b789c73537c9fc49969693b
SHA256: 25ecd528bab6b79c7dc44ac022195582f25b70563d12c8d8884508d468270df4 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Office\Recent\con2.LNK MD5: cf34cf8fb6e6d884e433b5105620ad94
SHA1: abcb1662e23aab31e092cc3b2989a578d9195fdc
SHA256: 5b6224b3b725d33d463e8ab7b3292e8ab272a2bc859aaa83aa660b674c174457 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Office\Recent\con2.LNK.CRAB MD5: cf34cf8fb6e6d884e433b5105620ad94
SHA1: abcb1662e23aab31e092cc3b2989a578d9195fdc
SHA256: 5b6224b3b725d33d463e8ab7b3292e8ab272a2bc859aaa83aa660b674c174457 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Office\Recent\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Office\Recent\index.dat MD5: dd7637e5fad846ea1a9abc0da1a6a582
SHA1: e1e0bb8eb5d3a288e07f15e0705dda3720b18e8d
SHA256: 5ffe4661bf10d535e4213fd173a822e1a8e6bc8e9652fb23db661340836cc55f 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Office\Recent\index.dat.CRAB MD5: dd7637e5fad846ea1a9abc0da1a6a582
SHA1: e1e0bb8eb5d3a288e07f15e0705dda3720b18e8d
SHA256: 5ffe4661bf10d535e4213fd173a822e1a8e6bc8e9652fb23db661340836cc55f 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK MD5: 8e3a05c869f45c42ed7d70d9edb95c80
SHA1: 582593ada3ec554cf46769497cb93d3730ccc3b8
SHA256: f1579d60c5b585d2b8d4f6f89b15bc4830baf59d196d53ddbe3ed5e9007d2b4f 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK.CRAB MD5: 8e3a05c869f45c42ed7d70d9edb95c80
SHA1: 582593ada3ec554cf46769497cb93d3730ccc3b8
SHA256: f1579d60c5b585d2b8d4f6f89b15bc4830baf59d196d53ddbe3ed5e9007d2b4f 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Outlook\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Outlook\Outlook.srs MD5: 2b615e096959c120e49b3c6795053480
SHA1: f2979cfb451dd8ac49867873f1843522b6605813
SHA256: a5d74a406637373b6913bdae41df22a769a624762fecaa1f6095dc38b3f260ca 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Outlook\Outlook.srs.CRAB MD5: 2b615e096959c120e49b3c6795053480
SHA1: f2979cfb451dd8ac49867873f1843522b6605813
SHA256: a5d74a406637373b6913bdae41df22a769a624762fecaa1f6095dc38b3f260ca 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Outlook\Outlook.xml MD5: 880b40cb7fda6e0c947f93d6f7d8295b
SHA1: fdff6cfca149248f52f19db1cb5964e40730ecf3
SHA256: 6b0e1782869f48951063dea5df7f8d4cb413e396a6048c7626020205089eecb0 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Outlook\Outlook.xml.CRAB MD5: 880b40cb7fda6e0c947f93d6f7d8295b
SHA1: fdff6cfca149248f52f19db1cb5964e40730ecf3
SHA256: 6b0e1782869f48951063dea5df7f8d4cb413e396a6048c7626020205089eecb0 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\PowerPoint\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Proof\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Protect\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Protect\S-1-5-21-2172869166-1497266965-2109836178-1000\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml MD5: 4dd2a758d59783a4eeb09cc3a04a622d
SHA1: 4e29aaca232e12721b3bd53f9faa4c0c968a41ba
SHA256: ca4ab65f795c9cdaf35fc89fe26f483b915aaf34d0357d8b7ec15e532ba31a3f 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.CRAB MD5: 4dd2a758d59783a4eeb09cc3a04a622d
SHA1: 4e29aaca232e12721b3bd53f9faa4c0c968a41ba
SHA256: ca4ab65f795c9cdaf35fc89fe26f483b915aaf34d0357d8b7ec15e532ba31a3f 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Publisher Building Blocks\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Publisher\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Speech\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Spelling\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Spelling\en-US\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\SystemCertificates\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\SystemCertificates\My\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm MD5: 6fbf4a75f316ffa5c06bd1d6e930d2b4
SHA1: 422d43d07965de56ea41654652cd4d661267df42
SHA256: 30b29fbd1522924f3957dbdc63701c9f2f23791b3b14d8944e9f2eddfe61f7ec 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm.CRAB MD5: 6fbf4a75f316ffa5c06bd1d6e930d2b4
SHA1: 422d43d07965de56ea41654652cd4d661267df42
SHA256: 30b29fbd1522924f3957dbdc63701c9f2f23791b3b14d8944e9f2eddfe61f7ec 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\Theme Colors\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\Theme Effects\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\Theme Fonts\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02836342[[fn=Ion]].thmx MD5: de55d6587353d6bf651d31e57e39d9dc
SHA1: 470b17d26e4275bec3c555a1222676d91f509895
SHA256: c72b4845be666875977b608ae528ae63da2fa059d5ab535e734e09d89ebddadb 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02836342[[fn=Ion]].thmx.CRAB MD5: de55d6587353d6bf651d31e57e39d9dc
SHA1: 470b17d26e4275bec3c555a1222676d91f509895
SHA256: c72b4845be666875977b608ae528ae63da2fa059d5ab535e734e09d89ebddadb 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02892315[[fn=Wisp]].thmx MD5: 96a1156f8b5fc937b9438013329b178e
SHA1: e48ad051719a7e83e1c61b2b44d27d393220c49b
SHA256: 0a66e6b45d194c7f73c84179bef2ec5460b4526a98106c376c12305337c538cb 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02892315[[fn=Wisp]].thmx.CRAB MD5: 96a1156f8b5fc937b9438013329b178e
SHA1: e48ad051719a7e83e1c61b2b44d27d393220c49b
SHA256: 0a66e6b45d194c7f73c84179bef2ec5460b4526a98106c376c12305337c538cb 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900688[[fn=Facet]].thmx MD5: e6e7256fb78bdae9a6b2c9ace28befbd
SHA1: d5961f2e7e829be513061d5464993ec9beb55438
SHA256: a40560a001a8d7604c55f22615157f5d4c62126cbde19264d77a5535c1db5b5a 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900688[[fn=Facet]].thmx.CRAB MD5: e6e7256fb78bdae9a6b2c9ace28befbd
SHA1: d5961f2e7e829be513061d5464993ec9beb55438
SHA256: a40560a001a8d7604c55f22615157f5d4c62126cbde19264d77a5535c1db5b5a 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900771[[fn=Slice]].thmx MD5: cadb3c0da30291f89e092a5e02640bd0
SHA1: 8e76338061d3597f0b9794e634ca1a15c98b06f5
SHA256: df069e21bccf11b24ea9adc1d153086a1ccb634f5278fe7047c4cb29b450de40 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM02900771[[fn=Slice]].thmx.CRAB MD5: cadb3c0da30291f89e092a5e02640bd0
SHA1: 8e76338061d3597f0b9794e634ca1a15c98b06f5
SHA256: df069e21bccf11b24ea9adc1d153086a1ccb634f5278fe7047c4cb29b450de40 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx MD5: 81ef9a9b98cb8bde4b6f2773a49b5109
SHA1: 24437f20e0bb9c77326cb6b08ff67de466ab1795
SHA256: 2c65398b797782dbda743edf269d5ee1a24540b65437d37896ae435af8413bd1 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx.CRAB MD5: 81ef9a9b98cb8bde4b6f2773a49b5109
SHA1: 24437f20e0bb9c77326cb6b08ff67de466ab1795
SHA256: 2c65398b797782dbda743edf269d5ee1a24540b65437d37896ae435af8413bd1 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx MD5: c1587dbe39c33e5bbbe5baad4186f86c
SHA1: 4785766c81ee062924ebdc9086971fdfadef8fba
SHA256: 38aa5633e615b85cb386d7e860b02414e5a32f28e0decc73c90d6f85e8eb97d1 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx.CRAB MD5: c1587dbe39c33e5bbbe5baad4186f86c
SHA1: 4785766c81ee062924ebdc9086971fdfadef8fba
SHA256: 38aa5633e615b85cb386d7e860b02414e5a32f28e0decc73c90d6f85e8eb97d1 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx MD5: 9e11fde89f689aa45e7f07013490b150
SHA1: 95f7f286411b5a11bdb3833932a315bf0fe0b678
SHA256: 224f658a958eadff784baea8710f1849017b31d1a75eb0b377b701e64baead51 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx.CRAB MD5: 9e11fde89f689aa45e7f07013490b150
SHA1: 95f7f286411b5a11bdb3833932a315bf0fe0b678
SHA256: 224f658a958eadff784baea8710f1849017b31d1a75eb0b377b701e64baead51 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx MD5: 76051fa29994c47ed57de1bb58d1ff6c
SHA1: 3d84055384400a9b11d045b127b9fe17d343347e
SHA256: 4d3c3b324b7cad1ad828ce043f1b1d7ee376ad673673d49df58d451dc05752d5 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx.CRAB MD5: 76051fa29994c47ed57de1bb58d1ff6c
SHA1: 3d84055384400a9b11d045b127b9fe17d343347e
SHA256: 4d3c3b324b7cad1ad828ce043f1b1d7ee376ad673673d49df58d451dc05752d5 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx MD5: b8a5cd8176c89adc3a4a2193363e526b
SHA1: 89900d82dd654072ab503cfde4eaeb40509728ec
SHA256: 9c68e2acd9e948583e47cbfce132330279e89f256786b8842b7f6ca8c3044f14 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx.CRAB MD5: b8a5cd8176c89adc3a4a2193363e526b
SHA1: 89900d82dd654072ab503cfde4eaeb40509728ec
SHA256: 9c68e2acd9e948583e47cbfce132330279e89f256786b8842b7f6ca8c3044f14 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx MD5: f32b086c758f97a8a0bb563ee69e4b63
SHA1: 1d409d3907633a2e27bcc17d4c48a7f1eb781f71
SHA256: 6b6a783f9d5b827382a314e986ed85da31ced3b15f63d7612907ee457956a479 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx.CRAB MD5: f32b086c758f97a8a0bb563ee69e4b63
SHA1: 1d409d3907633a2e27bcc17d4c48a7f1eb781f71
SHA256: 6b6a783f9d5b827382a314e986ed85da31ced3b15f63d7612907ee457956a479 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx MD5: 3e8cae1f2393464a34304036dba60940
SHA1: d37c5d8ed5894482a76090989993436891bf6e3c
SHA256: fb624f682c47a2436917519ed5276fcfeb5fc1d47e2000d2170fc7e5372bf673 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx.CRAB MD5: 3e8cae1f2393464a34304036dba60940
SHA1: d37c5d8ed5894482a76090989993436891bf6e3c
SHA256: fb624f682c47a2436917519ed5276fcfeb5fc1d47e2000d2170fc7e5372bf673 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx MD5: d83998fdc7808e89dfe49d74095695ce
SHA1: d254449176173cf448bd35d5712a4d8b3aa6f477
SHA256: 1f5b9e9180c1c85f6618dc8ce67f5b4926b7f8a0f682434ad5979b8d7972ded2 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx.CRAB MD5: d83998fdc7808e89dfe49d74095695ce
SHA1: d254449176173cf448bd35d5712a4d8b3aa6f477
SHA256: 1f5b9e9180c1c85f6618dc8ce67f5b4926b7f8a0f682434ad5979b8d7972ded2 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx MD5: 2df1f26ee11ea5b50f80a441a9e731be
SHA1: 978732ff8c2cef5e3b5ca75b870fc64a50c10891
SHA256: 3bd8c57275a9e130e4ee82307266b8b03e478d13984807ca074f0d060d1718c9 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx.CRAB MD5: 2df1f26ee11ea5b50f80a441a9e731be
SHA1: 978732ff8c2cef5e3b5ca75b870fc64a50c10891
SHA256: 3bd8c57275a9e130e4ee82307266b8b03e478d13984807ca074f0d060d1718c9 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx MD5: 75ca266e3f3744d3fa062938118a607e
SHA1: 5d699a89ef8627a1fed8b69c72a329ce2ce3e28d
SHA256: 7573db225fed45775ef359c2af5092cdaa0ece59cc0c2bb373c1e7b46ecdf990 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx.CRAB MD5: 75ca266e3f3744d3fa062938118a607e
SHA1: 5d699a89ef8627a1fed8b69c72a329ce2ce3e28d
SHA256: 7573db225fed45775ef359c2af5092cdaa0ece59cc0c2bb373c1e7b46ecdf990 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx MD5: ea3ce48fb687aed6551a5a06374da0f1
SHA1: cc603efec870ecec299af84ac10ee3a214db3374
SHA256: 33bee6160e3856a28b21d054286efcadc93641945eb98433cde11c226e0684c1 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx.CRAB MD5: ea3ce48fb687aed6551a5a06374da0f1
SHA1: cc603efec870ecec299af84ac10ee3a214db3374
SHA256: 33bee6160e3856a28b21d054286efcadc93641945eb98433cde11c226e0684c1 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx MD5: 8a820622207844e096523f1393cdae03
SHA1: 14a9aa68d0f51c6f2e92c6ccbe4ee9e06a727cdb
SHA256: 8cafd429239e4a4249f961da17f8e10699406f1ed7a719dcb99f9d8b926248d7 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx.CRAB MD5: 8a820622207844e096523f1393cdae03
SHA1: 14a9aa68d0f51c6f2e92c6ccbe4ee9e06a727cdb
SHA256: 8cafd429239e4a4249f961da17f8e10699406f1ed7a719dcb99f9d8b926248d7 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx MD5: 4199138446736e1d694428c3eeae187d
SHA1: b476989fd42a8126cf61821b66147753a4567de6
SHA256: f85935c1c1a7e3594d542f1dfba95941e361fb10edfafe753e6b7dbadbe8b2d2 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx.CRAB MD5: 4199138446736e1d694428c3eeae187d
SHA1: b476989fd42a8126cf61821b66147753a4567de6
SHA256: f85935c1c1a7e3594d542f1dfba95941e361fb10edfafe753e6b7dbadbe8b2d2 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx MD5: 334003e3df3ca09c1540157cd4158114
SHA1: ae1490e95ee5061599003a39fc724f4d4fd604c2
SHA256: e742b597c04f5484202e8d7854bd777f16c96e98241a3cc00ae89a4a1c64624c 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx.CRAB MD5: 334003e3df3ca09c1540157cd4158114
SHA1: ae1490e95ee5061599003a39fc724f4d4fd604c2
SHA256: e742b597c04f5484202e8d7854bd777f16c96e98241a3cc00ae89a4a1c64624c 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx MD5: 34efa048b3ea9ebd0f9a1b2f1f37cd85
SHA1: 02950b2a44a2972b2d69afdc266bf50fef730ad9
SHA256: 4d223b5e94dab1176ac233043fd51750064212940d265b99e3c439ef5c516711 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx.CRAB MD5: 34efa048b3ea9ebd0f9a1b2f1f37cd85
SHA1: 02950b2a44a2972b2d69afdc266bf50fef730ad9
SHA256: 4d223b5e94dab1176ac233043fd51750064212940d265b99e3c439ef5c516711 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx MD5: 71e673229d545afcd21d0e9eabff13e4
SHA1: 98ba76cba61fddc2f606443df931f07255c3223f
SHA256: 8e1b79a3213495106d1eb8192f083c7860378d49b6056a478aa84b0401ce184e 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx.CRAB MD5: 71e673229d545afcd21d0e9eabff13e4
SHA1: 98ba76cba61fddc2f606443df931f07255c3223f
SHA256: 8e1b79a3213495106d1eb8192f083c7860378d49b6056a478aa84b0401ce184e 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx MD5: 140c122d2ab26e66817b466057e3e2cd
SHA1: 3cc83dff9bf971c5e6998ae560e4a953af99a788
SHA256: 7d7005ccc956843608a7769e6dabfa4bf8d5daa3d1be1406ff48cabfccd1a0f1 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx.CRAB MD5: 140c122d2ab26e66817b466057e3e2cd
SHA1: 3cc83dff9bf971c5e6998ae560e4a953af99a788
SHA256: 7d7005ccc956843608a7769e6dabfa4bf8d5daa3d1be1406ff48cabfccd1a0f1 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx MD5: 6caabb81f15acdbe301f98beaa14ddd6
SHA1: 5b12a4305f7c414f41896ca2f9eabbfeb7a14472
SHA256: d21c0832a97db8966be533ffe1b3e40310a23c5de9f7cfbda389357bc0be7f8b 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx.CRAB MD5: 6caabb81f15acdbe301f98beaa14ddd6
SHA1: 5b12a4305f7c414f41896ca2f9eabbfeb7a14472
SHA256: d21c0832a97db8966be533ffe1b3e40310a23c5de9f7cfbda389357bc0be7f8b 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx MD5: 77772fdda18533fb399d31a79b5bd41e
SHA1: 93c58461bbadf31716de1c0664c4c4e617cf7e85
SHA256: 0ffc7ee508c3fbf97a3e797ca314e5170049315a560cee0a11b4040d84bc45ef 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx.CRAB MD5: 77772fdda18533fb399d31a79b5bd41e
SHA1: 93c58461bbadf31716de1c0664c4c4e617cf7e85
SHA256: 0ffc7ee508c3fbf97a3e797ca314e5170049315a560cee0a11b4040d84bc45ef 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx MD5: 13d3b94fc0d7f2c3f6bf1af906f3de06
SHA1: 9a7ab73c4fbd36429ee0ec30b72be0de0639f6c7
SHA256: 187f252095ef5fd6c4635efc0d37e8e4cbe672cfa6b0ebfc07568427e6c641ee 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx.CRAB MD5: 13d3b94fc0d7f2c3f6bf1af906f3de06
SHA1: 9a7ab73c4fbd36429ee0ec30b72be0de0639f6c7
SHA256: 187f252095ef5fd6c4635efc0d37e8e4cbe672cfa6b0ebfc07568427e6c641ee 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx MD5: a658ab33e435b66271ff2735070bc1ae
SHA1: 3bf521890aedc02e37ce1ae90156e6cc5a3d2675
SHA256: 098370223da5fe1d7e241a5572cf485d3ffa525622241c67b655eafe55fcb5d6 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx.CRAB MD5: a658ab33e435b66271ff2735070bc1ae
SHA1: 3bf521890aedc02e37ce1ae90156e6cc5a3d2675
SHA256: 098370223da5fe1d7e241a5572cf485d3ffa525622241c67b655eafe55fcb5d6 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx MD5: 0e137e1a97d9ece35730a1bcc5c725e4
SHA1: 091f9b513026a523221524ba9c647866334ab79e
SHA256: cef0ceb911413c1d37ed2bb2dca1843bca1270ee45852b2d0e100358de6982e5 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx.CRAB MD5: 0e137e1a97d9ece35730a1bcc5c725e4
SHA1: 091f9b513026a523221524ba9c647866334ab79e
SHA256: cef0ceb911413c1d37ed2bb2dca1843bca1270ee45852b2d0e100358de6982e5 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx MD5: aae7bfa272d494f8a82fb221e38c6152
SHA1: bb22016a715ba32cf1bb3855d15daad070ebee11
SHA256: 4e1c176116fd1c184456cbc72f5a9ae28ac423b7b766f54c02e99505137b5230 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx.CRAB MD5: aae7bfa272d494f8a82fb221e38c6152
SHA1: bb22016a715ba32cf1bb3855d15daad070ebee11
SHA256: 4e1c176116fd1c184456cbc72f5a9ae28ac423b7b766f54c02e99505137b5230 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM16401371[[fn=Atlas]].thmx MD5: 089003123a93a54095b84c782d64cc0d
SHA1: f052a9cbb0bfc268d99eb2460563b52a9b8c454f
SHA256: 12f1e3598c7bea2668f7fcf6e28401c14b71996cf821d494e93ba39240a1013f 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM16401371[[fn=Atlas]].thmx.CRAB MD5: 089003123a93a54095b84c782d64cc0d
SHA1: f052a9cbb0bfc268d99eb2460563b52a9b8c454f
SHA256: 12f1e3598c7bea2668f7fcf6e28401c14b71996cf821d494e93ba39240a1013f 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox MD5: c8ccb0a33a1e89dbae2b8a2c80dfbb54
SHA1: 49c842e354f3f3e945d4cc9c63cb76123911d05d
SHA256: ba0f111a8bfb4b89e0e14e2a311ba0373f347f8885c48b5515550053b0c719e9 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox.CRAB MD5: c8ccb0a33a1e89dbae2b8a2c80dfbb54
SHA1: 49c842e354f3f3e945d4cc9c63cb76123911d05d
SHA256: ba0f111a8bfb4b89e0e14e2a311ba0373f347f8885c48b5515550053b0c719e9 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox MD5: ac89297bf30514673fe1965b317310f8
SHA1: c599ede6b5c90303e53edd11452da9af15b1749d
SHA256: 566af0bc0d7c2537f74cb82bd8b1d261329c1828cc9af022f930bde043502424 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox.CRAB MD5: ac89297bf30514673fe1965b317310f8
SHA1: c599ede6b5c90303e53edd11452da9af15b1749d
SHA256: 566af0bc0d7c2537f74cb82bd8b1d261329c1828cc9af022f930bde043502424 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox MD5: ee0ad0d74bc343bb765993d1e1927715
SHA1: 0413b48c305fb886df035054555a734d90cd5712
SHA256: dc41363805e06bf8192b53d2874b5bcbf673b784c6ecbbc2a41a717152e0f3d0 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox.CRAB MD5: ee0ad0d74bc343bb765993d1e1927715
SHA1: 0413b48c305fb886df035054555a734d90cd5712
SHA256: dc41363805e06bf8192b53d2874b5bcbf673b784c6ecbbc2a41a717152e0f3d0 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox MD5: c73c05a2b3d08f3c835e46022e6a0995
SHA1: 01fad837e31568dd910860ca806513d060c22ab4
SHA256: b9dcd3cbc5850bd8cd3dca901035e17c037194f787db7ea23c191bde84a3dbf6 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox.CRAB MD5: c73c05a2b3d08f3c835e46022e6a0995
SHA1: 01fad837e31568dd910860ca806513d060c22ab4
SHA256: b9dcd3cbc5850bd8cd3dca901035e17c037194f787db7ea23c191bde84a3dbf6 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox MD5: 8d05ce5a1d952e77a66b7745521c9a4e
SHA1: 7a724bfa431318a9f2c5e1a5053e94d5374fd0d5
SHA256: d5dff5e3ebb526a3bc72bd6e842269a55ec3bbf222f3dcbda6e659a4b5b83ad3 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox.CRAB MD5: 8d05ce5a1d952e77a66b7745521c9a4e
SHA1: 7a724bfa431318a9f2c5e1a5053e94d5374fd0d5
SHA256: d5dff5e3ebb526a3bc72bd6e842269a55ec3bbf222f3dcbda6e659a4b5b83ad3 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox MD5: 8c99449400a45e9860609fb3ed01c5d2
SHA1: f0b667e7c29495a3b28fea23ea0cb11e72312288
SHA256: 16c30fde40e946ea1533e2b31b7de34d039b375abf93b3e25ec33b726b2b94c5 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox.CRAB MD5: 8c99449400a45e9860609fb3ed01c5d2
SHA1: f0b667e7c29495a3b28fea23ea0cb11e72312288
SHA256: 16c30fde40e946ea1533e2b31b7de34d039b375abf93b3e25ec33b726b2b94c5 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox MD5: b95e65f7df800345595d282671783967
SHA1: 2d6593fab6565a1b77a87e298e55fa3cd5e82907
SHA256: 659b1be0f0e31374485765126ca102fcef1dac8a742b54993e64e9192486991d 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox.CRAB MD5: b95e65f7df800345595d282671783967
SHA1: 2d6593fab6565a1b77a87e298e55fa3cd5e82907
SHA256: 659b1be0f0e31374485765126ca102fcef1dac8a742b54993e64e9192486991d 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox MD5: ed2268e6b7d03e19b10bc51cbe48dfee
SHA1: 6be77f4cd704e4322d8371413bd4eb5ac4a8ee88
SHA256: 8b80d60311bdf13af368abc18be54f1e4d02e51ba2561c6f6ffcd5d724f0228d 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox.CRAB MD5: ed2268e6b7d03e19b10bc51cbe48dfee
SHA1: 6be77f4cd704e4322d8371413bd4eb5ac4a8ee88
SHA256: 8b80d60311bdf13af368abc18be54f1e4d02e51ba2561c6f6ffcd5d724f0228d 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox MD5: 8b843a80f395b6d6c95278f33d963dc2
SHA1: 9c6e8529d59af49bc428eb27fb1884413d95c052
SHA256: 7705434148324bb8554deee1b4546563653933962f8e75ca070ae641073607f7 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox.CRAB MD5: 8b843a80f395b6d6c95278f33d963dc2
SHA1: 9c6e8529d59af49bc428eb27fb1884413d95c052
SHA256: 7705434148324bb8554deee1b4546563653933962f8e75ca070ae641073607f7 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox MD5: 53a3b1d5f08fc78d58f7a329b24c12f0
SHA1: 2aa4a8e306629ccde7bee321602fc2d3d6b1d055
SHA256: c5d06fab058d226bc0c7f01b404fa0e9f1bdcf602ee5c8ec0629d39e99eda707 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox.CRAB MD5: 53a3b1d5f08fc78d58f7a329b24c12f0
SHA1: 2aa4a8e306629ccde7bee321602fc2d3d6b1d055
SHA256: c5d06fab058d226bc0c7f01b404fa0e9f1bdcf602ee5c8ec0629d39e99eda707 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox MD5: 7e32ad78273a5800adcbac60ed9086a1
SHA1: 0a020eb56ab0b3de706b6e7d5af9beb7aaa03690
SHA256: dd80735eba4ded6b972e6b1c55b177efe94b326e8dd06698ff3748365eab2fb5 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox.CRAB MD5: 7e32ad78273a5800adcbac60ed9086a1
SHA1: 0a020eb56ab0b3de706b6e7d5af9beb7aaa03690
SHA256: dd80735eba4ded6b972e6b1c55b177efe94b326e8dd06698ff3748365eab2fb5 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox MD5: c3d72112eda09f922641157694a0e612
SHA1: 50511a09958d40049549fefe2bd5c5b975616bfe
SHA256: 4e8e5ac549866c26c81e947952a3ed965bd5f0d6e4092b18fe2de37f5940d240 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox.CRAB MD5: c3d72112eda09f922641157694a0e612
SHA1: 50511a09958d40049549fefe2bd5c5b975616bfe
SHA256: 4e8e5ac549866c26c81e947952a3ed965bd5f0d6e4092b18fe2de37f5940d240 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox MD5: bb2d0dc89e3924acd43385d5249aa377
SHA1: ac603d8e4aa8bc5c79bda9b07bdcdea2ff93d918
SHA256: 8219e86680e9d0264519035febab5c01c80590cc1fd474e678e372114a252280 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox.CRAB MD5: bb2d0dc89e3924acd43385d5249aa377
SHA1: ac603d8e4aa8bc5c79bda9b07bdcdea2ff93d918
SHA256: 8219e86680e9d0264519035febab5c01c80590cc1fd474e678e372114a252280 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox MD5: 3a5287118dcdce143e892c08edb5f41e
SHA1: b6d77ac878cdcf6dc65a48ce5942429eb7aa4901
SHA256: 3d0c69b04acdfe8095fb2da534d655b90e6963c85d3c7f0c1d6a79cf905eb100 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox.CRAB MD5: 3a5287118dcdce143e892c08edb5f41e
SHA1: b6d77ac878cdcf6dc65a48ce5942429eb7aa4901
SHA256: 3d0c69b04acdfe8095fb2da534d655b90e6963c85d3c7f0c1d6a79cf905eb100 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox MD5: 8d080a225a342e59d2e903077cd8ade2
SHA1: 8ff8379435f7cd191fe5ed7a2e3a2609293af53f
SHA256: 6e67cf55d3dea09524b4a8e392d25ebab6d61ac6bb83d6a151bfe42174707b26 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox.CRAB MD5: 8d080a225a342e59d2e903077cd8ade2
SHA1: 8ff8379435f7cd191fe5ed7a2e3a2609293af53f
SHA256: 6e67cf55d3dea09524b4a8e392d25ebab6d61ac6bb83d6a151bfe42174707b26 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox MD5: 00083f810194ec80949ea2b015deb10a
SHA1: 8c05ef9d80129a24c205b88f59d3c1ff7c460597
SHA256: 01715d366fa966d99797f59fa1f915d63882bc3eca9422ce1e6071fd57d11892 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox.CRAB MD5: 00083f810194ec80949ea2b015deb10a
SHA1: 8c05ef9d80129a24c205b88f59d3c1ff7c460597
SHA256: 01715d366fa966d99797f59fa1f915d63882bc3eca9422ce1e6071fd57d11892 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox MD5: 7b5463e779c711141bdb0aab95e6c291
SHA1: 31df7fa39a30c29bc7277132e3c015111e245f85
SHA256: 361e1f51dedfdc09067da71162bc5f157c6fbef0939389b471a2d8eae0fa501e 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox.CRAB MD5: 7b5463e779c711141bdb0aab95e6c291
SHA1: 31df7fa39a30c29bc7277132e3c015111e245f85
SHA256: 361e1f51dedfdc09067da71162bc5f157c6fbef0939389b471a2d8eae0fa501e 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl MD5: 3f7678f540f2feebf27d6ae9187ee201
SHA1: 7b37f9e01b0f6943b8b0f20543d86a2349dbf0f5
SHA256: 5230eee8d3b9babf936d7b07aaf5b6d4cf91e44ca6273c7eba80cd995997cca1 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl.CRAB MD5: 3f7678f540f2feebf27d6ae9187ee201
SHA1: 7b37f9e01b0f6943b8b0f20543d86a2349dbf0f5
SHA256: 5230eee8d3b9babf936d7b07aaf5b6d4cf91e44ca6273c7eba80cd995997cca1 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl MD5: 7c9bab85dc6f44b0680870236dc39797
SHA1: 6a4490193648de3a10a2651d4c0b7859d1ab7ca9
SHA256: 192ba13f790df8e2ddbf36abb23675c6538da6edc1e435701694aafd9e2461cb 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl.CRAB MD5: 7c9bab85dc6f44b0680870236dc39797
SHA1: 6a4490193648de3a10a2651d4c0b7859d1ab7ca9
SHA256: 192ba13f790df8e2ddbf36abb23675c6538da6edc1e435701694aafd9e2461cb 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl MD5: 3813e117db4e799353de8276040b766f
SHA1: db184f39e76e62672814a03bb41d293141bbd2c1
SHA256: f92abd100dc162b2ba2d2a38f6611d1918c0a9aa9bd8cc6a819b94bfb8c9019e 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl.CRAB MD5: 3813e117db4e799353de8276040b766f
SHA1: db184f39e76e62672814a03bb41d293141bbd2c1
SHA256: f92abd100dc162b2ba2d2a38f6611d1918c0a9aa9bd8cc6a819b94bfb8c9019e 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl MD5: b1aa46c87dc394a091e2a55110200a9b
SHA1: 6f55b2afafeb26ae792e70c0e8cffaa372b60812
SHA256: 348ce98e1dfcfe6106cbc6ad1a57721d54b16d018b921cf5ac5888d64bd105e8 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl.CRAB MD5: b1aa46c87dc394a091e2a55110200a9b
SHA1: 6f55b2afafeb26ae792e70c0e8cffaa372b60812
SHA256: 348ce98e1dfcfe6106cbc6ad1a57721d54b16d018b921cf5ac5888d64bd105e8 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl MD5: f5eb849610408d7bc90b352a583c9429
SHA1: 1a6c2c0ef4c95b9a40669b89bc484871ebccd65d
SHA256: d38622af4b4854bd60ebf74778ccda9bf60f1948b88d4425f94a6d8349875513 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl.CRAB MD5: f5eb849610408d7bc90b352a583c9429
SHA1: 1a6c2c0ef4c95b9a40669b89bc484871ebccd65d
SHA256: d38622af4b4854bd60ebf74778ccda9bf60f1948b88d4425f94a6d8349875513 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl MD5: 2ce52392f75c2a1c91bf934bc9abcfc7
SHA1: 9c01a309d640215edc93a67c6a2ced756dcb33e5
SHA256: 4f8945769454598b2deac94cc77fbe988a4dbc8a298ea4792478e5997f1d63e9 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl.CRAB MD5: 2ce52392f75c2a1c91bf934bc9abcfc7
SHA1: 9c01a309d640215edc93a67c6a2ced756dcb33e5
SHA256: 4f8945769454598b2deac94cc77fbe988a4dbc8a298ea4792478e5997f1d63e9 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl MD5: c318ee90423b931bd4cb146deeb53295
SHA1: c1381fe7719896a21d6b2ac340224728d28ef610
SHA256: 0d4099b710ed54a47a2ecda28a1cc0284c0230988fa46044471a107e9df4e184 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl.CRAB MD5: c318ee90423b931bd4cb146deeb53295
SHA1: c1381fe7719896a21d6b2ac340224728d28ef610
SHA256: 0d4099b710ed54a47a2ecda28a1cc0284c0230988fa46044471a107e9df4e184 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl MD5: 51a4d4d28d7cc5a5eef8212bee0fa975
SHA1: e832d5deaeac4ecd43953a59c76aac9f924a504f
SHA256: c5ef49dee0bd8dd02e4c8bc0e3824b673a097a9fc7009fc562efb8df1aab03b9 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl.CRAB MD5: 51a4d4d28d7cc5a5eef8212bee0fa975
SHA1: e832d5deaeac4ecd43953a59c76aac9f924a504f
SHA256: c5ef49dee0bd8dd02e4c8bc0e3824b673a097a9fc7009fc562efb8df1aab03b9 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl MD5: 379d083a1602eee30923c25a8031a9d0
SHA1: c840d2751a91ec18b8666507e212f71fe49bfed6
SHA256: 9a94a549d2df12ea627b1e4eb19f92ccf17ff5fe7e830c2d33449904b45ab87f 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl.CRAB MD5: 379d083a1602eee30923c25a8031a9d0
SHA1: c840d2751a91ec18b8666507e212f71fe49bfed6
SHA256: 9a94a549d2df12ea627b1e4eb19f92ccf17ff5fe7e830c2d33449904b45ab87f 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl MD5: 4b2043e07bdf5596e6197487f9f40d34
SHA1: 8e62bffd6f0c95864f45b0b1babdb9cc4a2ee4fa
SHA256: 9b9bec6b49991d9a439ca510b1de52021cea0bb8960669ea22af4518c2b8f4ab 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl.CRAB MD5: 4b2043e07bdf5596e6197487f9f40d34
SHA1: 8e62bffd6f0c95864f45b0b1babdb9cc4a2ee4fa
SHA256: 9b9bec6b49991d9a439ca510b1de52021cea0bb8960669ea22af4518c2b8f4ab 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl MD5: 44062a35b792b4bf1e57e17a325058ee
SHA1: f7dd767a91869f10f978f2fc79d571df9ead2ad9
SHA256: 82ae22d960a05e49e6b310f9207cdd49d429cea525059bcefb08256bafb289f2 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl.CRAB MD5: 44062a35b792b4bf1e57e17a325058ee
SHA1: f7dd767a91869f10f978f2fc79d571df9ead2ad9
SHA256: 82ae22d960a05e49e6b310f9207cdd49d429cea525059bcefb08256bafb289f2 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl MD5: be9be8e8185b1db91ee795e30c85f256
SHA1: 005003743237d086c1c3ee11fb86030bc314ab35
SHA256: 92c2d90539a79c193613f76edf4208c59c70adc5de101e0dc0ef21ac794bc2b8 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl.CRAB MD5: be9be8e8185b1db91ee795e30c85f256
SHA1: 005003743237d086c1c3ee11fb86030bc314ab35
SHA256: 92c2d90539a79c193613f76edf4208c59c70adc5de101e0dc0ef21ac794bc2b8 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx MD5: c0f7cf1e3a872e16426d93beb364e06b
SHA1: 75b1316d4c8f93c7d49768e7b5e835c850985b3c
SHA256: bb4a654c0f191513789f4f013f1122b1cbaeac16dcdbef6d71a79f2de448f01a 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx.CRAB MD5: c0f7cf1e3a872e16426d93beb364e06b
SHA1: 75b1316d4c8f93c7d49768e7b5e835c850985b3c
SHA256: bb4a654c0f191513789f4f013f1122b1cbaeac16dcdbef6d71a79f2de448f01a 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835231[[fn=Text Cover with TOC (Student Report Blue design)]].docx MD5: b869abad1cb2199f2195b4b5ec4d462a
SHA1: 52098cf58ca2901d5a40d58dd59784d53213eeca
SHA256: 3f9e268bb8cd8d4d5190cda23992125947e255ac902b43c0e51418684ef9f492 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835231[[fn=Text Cover with TOC (Student Report Blue design)]].docx.CRAB MD5: b869abad1cb2199f2195b4b5ec4d462a
SHA1: 52098cf58ca2901d5a40d58dd59784d53213eeca
SHA256: 3f9e268bb8cd8d4d5190cda23992125947e255ac902b43c0e51418684ef9f492 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835232[[fn=Text Cover (Student Report Blue design)]].docx MD5: fa72bf3a655b4c5affc16a70a93bea15
SHA1: ccab411d9d9cd942d51c88b2f7cd91eda572c60c
SHA256: 8073145784513807066d12a4b5548c5f43bbd757078f96e1fd808dfe4a25bfc3 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835232[[fn=Text Cover (Student Report Blue design)]].docx.CRAB MD5: fa72bf3a655b4c5affc16a70a93bea15
SHA1: ccab411d9d9cd942d51c88b2f7cd91eda572c60c
SHA256: 8073145784513807066d12a4b5548c5f43bbd757078f96e1fd808dfe4a25bfc3 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx MD5: 78e72cd292c5351eca5a8375a13457e6
SHA1: 2a3ed44e144636294684441b40f0036ae3820fa5
SHA256: 5af907563eba64470e8671bd0043a88a7bb0641215a7761d3e312d7b8f85e621 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.CRAB MD5: 78e72cd292c5351eca5a8375a13457e6
SHA1: 2a3ed44e144636294684441b40f0036ae3820fa5
SHA256: 5af907563eba64470e8671bd0043a88a7bb0641215a7761d3e312d7b8f85e621 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835264[[fn=Cover Page (Annual Report Red and Black design)]].docx MD5: e673fd9791f449b78ba95a84be2c3e45
SHA1: 49b1ff7ffa4a651dad8258802be372915ccb1245
SHA256: 23dced46bccd630948415d819aac4135629e178bedf6ff80785534f8ca5b1754 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835264[[fn=Cover Page (Annual Report Red and Black design)]].docx.CRAB MD5: e673fd9791f449b78ba95a84be2c3e45
SHA1: 49b1ff7ffa4a651dad8258802be372915ccb1245
SHA256: 23dced46bccd630948415d819aac4135629e178bedf6ff80785534f8ca5b1754 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835265[[fn=Cover Page (Annual Report Timeless design)]].docx MD5: 6e26733cbce8340543b8eb230088fef6
SHA1: 1e188f87bc4dec473b7756285fe29de238f4d931
SHA256: f52af90c611a18e2c8f51635d42bff50e4162ba1fd8da13f43962654942cf198 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835265[[fn=Cover Page (Annual Report Timeless design)]].docx.CRAB MD5: 6e26733cbce8340543b8eb230088fef6
SHA1: 1e188f87bc4dec473b7756285fe29de238f4d931
SHA256: f52af90c611a18e2c8f51635d42bff50e4162ba1fd8da13f43962654942cf198 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835266[[fn=Cover Letter (Chronological Resume Simple design)]].docx MD5: 0e39b656e93e1f2d94474fc53ce861f4
SHA1: 5fa79a49ebcd3d308b475323afb1e8bdce0aa648
SHA256: 50c22d6a352e410ba7c7a735115ac3bff327158e7640659c3100e720d3726521 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835266[[fn=Cover Letter (Chronological Resume Simple design)]].docx.CRAB MD5: 0e39b656e93e1f2d94474fc53ce861f4
SHA1: 5fa79a49ebcd3d308b475323afb1e8bdce0aa648
SHA256: 50c22d6a352e410ba7c7a735115ac3bff327158e7640659c3100e720d3726521 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835267[[fn=Cover with Logo (Annual Report Red and Black design)]].docx MD5: 1256509515d9827654d834f1184d3f7a
SHA1: 6008657a375eb6430ea942b8fe5029a87b49564d
SHA256: 533091ded7c4fcaef3fae1b8032b61eb5991345dc27cc6146b12595ec8568277 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835267[[fn=Cover with Logo (Annual Report Red and Black design)]].docx.CRAB MD5: 1256509515d9827654d834f1184d3f7a
SHA1: 6008657a375eb6430ea942b8fe5029a87b49564d
SHA256: 533091ded7c4fcaef3fae1b8032b61eb5991345dc27cc6146b12595ec8568277 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835268[[fn=Photo Cover (Student Report Blue design)]].docx MD5: 14b5315288999531d81f9314e7e34776
SHA1: f44a6a7ccd4ac23dfe6831816e3a12e2627c69c8
SHA256: d601b2996924f0f8fd2bcd3524b03bcaa4c18e35a7f018d75af8bca9c0ec4a1e 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835268[[fn=Photo Cover (Student Report Blue design)]].docx.CRAB MD5: 14b5315288999531d81f9314e7e34776
SHA1: f44a6a7ccd4ac23dfe6831816e3a12e2627c69c8
SHA256: d601b2996924f0f8fd2bcd3524b03bcaa4c18e35a7f018d75af8bca9c0ec4a1e 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835269[[fn=Photo Cover with TOC (Student Report blue design)]].docx MD5: eab6473a699d1159127435b25e8bc96c
SHA1: 6d98a3ce80d7e37ff2915d29315a5283d22472c7
SHA256: 243adc5ea466e188024d5c4fbd7efd2015d416af72f7c588122f9f0f1d3057ba 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835269[[fn=Photo Cover with TOC (Student Report blue design)]].docx.CRAB MD5: eab6473a699d1159127435b25e8bc96c
SHA1: 6d98a3ce80d7e37ff2915d29315a5283d22472c7
SHA256: 243adc5ea466e188024d5c4fbd7efd2015d416af72f7c588122f9f0f1d3057ba 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835270[[fn=Photo Sidebar (Annual Report Red and Black design)]].docx MD5: d53cd613cffabd7504960f313af39bfd
SHA1: cf82d8f7ed6e7d1f179a0372a8715ce2ea0781ab
SHA256: 37a0d1fd5249d3b46754cc02db73add8ef6633935f289c6f0d072c55e3ae31c6 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835270[[fn=Photo Sidebar (Annual Report Red and Black design)]].docx.CRAB MD5: d53cd613cffabd7504960f313af39bfd
SHA1: cf82d8f7ed6e7d1f179a0372a8715ce2ea0781ab
SHA256: 37a0d1fd5249d3b46754cc02db73add8ef6633935f289c6f0d072c55e3ae31c6 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835271[[fn=Sample Table (Annual Report Red and Black design)]].docx MD5: 25e86197f269606061e99c525b826b9d
SHA1: fb1fb02b7866d5d58e7863e39ac1fe52af7b4c1c
SHA256: 08e70e5b5086a7850624dd67a23db8546e9a014e3b84194cc143d9c6d4e75960 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835271[[fn=Sample Table (Annual Report Red and Black design)]].docx.CRAB MD5: 25e86197f269606061e99c525b826b9d
SHA1: fb1fb02b7866d5d58e7863e39ac1fe52af7b4c1c
SHA256: 08e70e5b5086a7850624dd67a23db8546e9a014e3b84194cc143d9c6d4e75960 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835272[[fn=Sample Table (Annual Report Timeless design)]].docx MD5: 61388293531b46cd5f842f527b2f9c4f
SHA1: 7e6c8d8ee04c8bd786a38e503a833b087cb480ae
SHA256: fba55f3ce489ff3e3cfd43287a9c69c11d80c8480f0075dda9a0e517670455b0 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835272[[fn=Sample Table (Annual Report Timeless design)]].docx.CRAB MD5: 61388293531b46cd5f842f527b2f9c4f
SHA1: 7e6c8d8ee04c8bd786a38e503a833b087cb480ae
SHA256: fba55f3ce489ff3e3cfd43287a9c69c11d80c8480f0075dda9a0e517670455b0 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02836362[[fn=Cover letter (Resume Timeless Design)]].docx MD5: 22854804b436b218cc99ab26875eb0a0
SHA1: 1b127643d3a961e45bdd3e0d27e7fa12462d8fbc
SHA256: 7bd6a51d444bdd7104c5ca3f528e03cc79e4c6c15d65c8158d7cef38669fe969 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02836362[[fn=Cover letter (Resume Timeless Design)]].docx.CRAB MD5: 22854804b436b218cc99ab26875eb0a0
SHA1: 1b127643d3a961e45bdd3e0d27e7fa12462d8fbc
SHA256: 7bd6a51d444bdd7104c5ca3f528e03cc79e4c6c15d65c8158d7cef38669fe969 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx MD5: 612b1dc58dbcfbfd17bfad854fb703f5
SHA1: 724806bfdeba99459533cb105f7444d23bd86283
SHA256: 950496b0baa7be92a9ebc70acf6e40b02ffe0ae7db72b674741fd97002dce3f0 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx.CRAB MD5: 612b1dc58dbcfbfd17bfad854fb703f5
SHA1: 724806bfdeba99459533cb105f7444d23bd86283
SHA256: 950496b0baa7be92a9ebc70acf6e40b02ffe0ae7db72b674741fd97002dce3f0 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx MD5: be5b4996fd89147059141be0f4f7aaad
SHA1: d6d318d3d3b7585dda2417a77dc05928573c500d
SHA256: e03a9bb3500e1ebb9a09e27b3eb88784bf500357200bf38245364db6f267a7c0 		Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx.CRAB MD5: be5b4996fd89147059141be0f4f7aaad
SHA1: d6d318d3d3b7585dda2417a77dc05928573c500d
SHA256: e03a9bb3500e1ebb9a09e27b3eb88784bf500357200bf38245364db6f267a7c0 		Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\1033\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Word Document Bibliography Styles\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Word Document Building Blocks\1033\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Word Document Building Blocks\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\LiveContent\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\Normal.dotm - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\Normal.dotm.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\Welcome to Word.dotx - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Templates\Welcome to Word.dotx.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\UProof\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Vault\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Word\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Microsoft\Word\STARTUP\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Extensions\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Crash Reports\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Pending Pings\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\profiles.ini - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\profiles.ini.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\addons.json - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\addons.json.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\addonStartup.json.lz4 - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\addonStartup.json.lz4.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\blocklist.xml - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\blocklist.xml.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\bookmarkbackups\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\cert8.db - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\cert8.db.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\compatibility.ini - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\compatibility.ini.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\containers.json - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\containers.json.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\content-prefs.sqlite - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\content-prefs.sqlite.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\cookies.sqlite - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\cookies.sqlite.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\crashes\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\crashes\events\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651440860.2d520ad0-8005-4317-b4fd-571af846ed8d.new-profile.jsonlz4 - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651440860.2d520ad0-8005-4317-b4fd-571af846ed8d.new-profile.jsonlz4.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651441015.321b9820-ddf0-4472-8833-27c2104c93fa.main.jsonlz4 - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651441015.321b9820-ddf0-4472-8833-27c2104c93fa.main.jsonlz4.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651456011.5f95b583-d699-497d-975d-4dba64e21259.main.jsonlz4 - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\archived\2017-08\1503651456011.5f95b583-d699-497d-975d-4dba64e21259.main.jsonlz4.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\archived\2017-08\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\archived\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\session-state.json - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\session-state.json.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\state.json - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\datareporting\state.json.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\extensions.json - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\extensions.json.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\favicons.sqlite - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\favicons.sqlite.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-gmpopenh264\1.6\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-gmpopenh264\1.6\gmpopenh264.info - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-gmpopenh264\1.6\gmpopenh264.info.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-gmpopenh264\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\LICENSE.txt - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\LICENSE.txt.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\manifest.json - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\manifest.json.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp-widevinecdm\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\gmp\WINNT_x86_64-msvc\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\handlers.json - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\handlers.json.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\key3.db - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\key3.db.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\minidumps\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\permissions.sqlite - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\permissions.sqlite.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\places.sqlite - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\places.sqlite.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\pluginreg.dat - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\pluginreg.dat.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\prefs.js - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\prefs.js.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\saved-telemetry-pings\321b9820-ddf0-4472-8833-27c2104c93fa - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\saved-telemetry-pings\321b9820-ddf0-4472-8833-27c2104c93fa.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\saved-telemetry-pings\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\search.json.mozlz4 - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\search.json.mozlz4.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\secmod.db - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\secmod.db.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\sessionCheckpoints.json - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\sessionCheckpoints.json.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\sessionstore-backups\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\sessionstore-backups\previous.js - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\sessionstore-backups\previous.js.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\sessionstore-backups\upgrade.js-20170814072924 - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\sessionstore-backups\upgrade.js-20170814072924.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\sessionstore.js - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\sessionstore.js.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\SiteSecurityServiceState.txt - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\SiteSecurityServiceState.txt.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage.sqlite - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage.sqlite.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\chrome\.metadata - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\chrome\.metadata-v2 - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\chrome\.metadata-v2.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\chrome\.metadata.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\chrome\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\chrome\idb\2918063365piupsah.files\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\chrome\idb\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\.metadata - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\.metadata-v2 - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\.metadata-v2.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\.metadata.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\storage\permanent\moz-safe-about+home\idb\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\times.json - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\times.json.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\webappsstore.sqlite - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\webappsstore.sqlite.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\xulstore.json - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Mozilla\Firefox\Profiles\i6gc44p4.default\xulstore.json.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\NzZfBRffU.gif - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\NzZfBRffU.gif.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\QO6C.pdf - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\QO6C.pdf.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Skype\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Skype\RootTools\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Skype\RootTools\roottools.conf - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Skype\RootTools\roottools.conf.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\sLivwNIVhI-acv9KYt.wav - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\sLivwNIVhI-acv9KYt.wav.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\sOc9HFGjfdRL.mp4 - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\sOc9HFGjfdRL.mp4.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\ssWXjNJMpxPjy0RSh1p_.ots - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\ssWXjNJMpxPjy0RSh1p_.ots.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\Sun\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Sun\Java\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\Sun\Java\Deployment\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\AppData\Roaming\TJzRR99g_04.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\TJzRR99g_04.bmp.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\U1cYWKMQhIFnmv.png - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\U1cYWKMQhIFnmv.png.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\vJP1qxGfwRfh.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\vJP1qxGfwRfh.mp3.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\W02IZ8W8.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\W02IZ8W8.pptx.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\WBlnF.xls - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\WBlnF.xls.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\wJ1QEd.flv - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\wJ1QEd.flv.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\wspnyXL.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\wspnyXL.mkv.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\wZyb.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\wZyb.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\xVXRkU.wav - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\xVXRkU.wav.CRAB - Access
C:\Users\Nd9E1FYi\AppData\Roaming\ye-zc9.docx - Access, Read, Write
C:\Users\Nd9E1FYi\AppData\Roaming\ye-zc9.docx.CRAB - Access
C:\Users\Nd9E1FYi\AppData\RoamingqTP35.exe MD5: 64fe3cc06265bca6cc175cecfc16fc2e
SHA1: 3f02ee202bd9040c25a3caf6af905345e458dc46
SHA256: 063cf82cd52acb6a0539a6ff59f72fb5de473293a06c470a92c6d35a151b73e9 		Access, Read, Write
C:\Users\Nd9E1FYi\Application Data\\CRAB-DECRYPT.txt - Access
C:\Users\Nd9E1FYi\Contacts\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Cookies\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\\CRAB-DECRYPT.txt MD5: 6a601666a0c7a954c5dcc81b4f476e2f
SHA1: 5874ddee58a8cb328e5c1f68aca5ff7178901d8a
SHA256: daad50eb03aa9ae396d0223b0dec2c6ccbe4db14324ec0e03872d8fd98a79ec9 		Access, Write
C:\Users\Nd9E1FYi\Desktop - Access
C:\Users\Nd9E1FYi\Desktop\1bpDeojNY.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\1bpDeojNY.mkv.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\8ANG45s-M.png - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\8ANG45s-M.png.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\_Wm7kki7DgA3B5.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\_Wm7kki7DgA3B5.wav.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\A 9Oefy3.jpg - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\A 9Oefy3.jpg.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\a-lLcBqkNo0RJG2z.mp4 - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\a-lLcBqkNo0RJG2z.mp4.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\Au9hR3twSX8g2051qZl.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\Au9hR3twSX8g2051qZl.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\2kU40FT5jILta3Q.ots - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\2kU40FT5jILta3Q.ots.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\2yagpCprWdKgC2scR.m4a - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\2yagpCprWdKgC2scR.m4a.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\h4pimh4sgK50.swf - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\h4pimh4sgK50.swf.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\iaY8BIN_Ck.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\iaY8BIN_Ck.gif.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\lixRrd6cN_iDgM01kX.m4a - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\lixRrd6cN_iDgM01kX.m4a.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\VFrEBVJ.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\BLmcr9LSO0w4rDxAY08\VFrEBVJ.gif.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\Bprz1OZFvY6Fdl.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\Bprz1OZFvY6Fdl.wav.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\cBGy__kii3.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\cBGy__kii3.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Desktop\dh6vAu4ORBB.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\dh6vAu4ORBB.gif.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\DOC6131166051-PDF.js - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\DOC6131166051-PDF.js.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\DOC613~1.JS - Access
C:\Users\Nd9E1FYi\Desktop\DuYjI_5DnwCjkTeKrN.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\DuYjI_5DnwCjkTeKrN.bmp.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\eXcXexGNR8.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\eXcXexGNR8.bmp.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\FGn1g2A5L35Dban.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\FGn1g2A5L35Dban.avi.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\FxUvkMkkJlA0u3uO.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\FxUvkMkkJlA0u3uO.wav.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\gQz9z2t2-T6sBFh.ods - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\gQz9z2t2-T6sBFh.ods.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\GrVNye2A_G.m4a - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\GrVNye2A_G.m4a.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\hbpLjDWaRc.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\hbpLjDWaRc.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\KLQs0N5HQVpYWEwm.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\KLQs0N5HQVpYWEwm.avi.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\KOHm3 dV9oyll.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\KOHm3 dV9oyll.mkv.CRAB - Access
laxodaromowuku himefuvuriyuseyu zegiyevufebucena sanavazobijayu - Access
C:\Users\Nd9E1FYi\Desktop\LjIGlO1g4.jpg - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\LjIGlO1g4.jpg.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\lv-MFQ.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\lv-MFQ.wav.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\MzXcX bzXrqd45Lfz4s.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\MzXcX bzXrqd45Lfz4s.bmp.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\PCTxqfmg90.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\PCTxqfmg90.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\pLBOkTAFuYRgMO.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\pLBOkTAFuYRgMO.gif.CRAB - Access
powershell.exe - Access
C:\Users\Nd9E1FYi\Desktop\Q _Vg7gr8H.mp4 - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\Q _Vg7gr8H.mp4.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\A2LolHZayGTsHiI6.m4a - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\A2LolHZayGTsHiI6.m4a.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\2oS82VM\3xZTjcYNMEA.jpg - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\2oS82VM\3xZTjcYNMEA.jpg.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\2oS82VM\4DdBg.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\2oS82VM\4DdBg.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\2oS82VM\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\2oS82VM\q8_fCWTtYsp.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\2oS82VM\q8_fCWTtYsp.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\2QWqJ.png - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\2QWqJ.png.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\40xf9IqVMYI.m4a - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\40xf9IqVMYI.m4a.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\owR x2a.swf - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\owR x2a.swf.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\TQB8IjiKavnd9-4DZ\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\TQB8IjiKavnd9-4DZ\emVhgx6y97.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\TQB8IjiKavnd9-4DZ\emVhgx6y97.mkv.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\TQB8IjiKavnd9-4DZ\l6Bs1VDS IveszkK_T.swf - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\VPhwHa8l1\TQB8IjiKavnd9-4DZ\l6Bs1VDS IveszkK_T.swf.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\XhgAzlnnal4On.ods - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\XhgAzlnnal4On.ods.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\YLRzWU41I lCyJDHV C6.png - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\TaihMyjD\YLRzWU41I lCyJDHV C6.png.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\vXvj4GLL.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\vXvj4GLL.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\woCvVol6lG6hpZs1f-.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\woCvVol6lG6hpZs1f-.mkv.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\YEJo-cDCntFKzkvH4cb.pdf - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\YEJo-cDCntFKzkvH4cb.pdf.CRAB - Access
C:\Users\Nd9E1FYi\Desktop\yOuNI.ppt - Access, Read, Write
C:\Users\Nd9E1FYi\Desktop\yOuNI.ppt.CRAB - Access
C:\Users\Nd9E1FYi\Documents\-1nTMjoJ7ib3ZR0e.odp - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\-1nTMjoJ7ib3ZR0e.odp.CRAB - Access
C:\Users\Nd9E1FYi\Documents\0Ai_ wHAH.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\0Ai_ wHAH.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\1PJlex.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\1PJlex.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\1ulDdE.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\1ulDdE.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\2Hv5hFFMzd5aNPk.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\2Hv5hFFMzd5aNPk.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\2LGO84j-W4Ss.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\2LGO84j-W4Ss.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\3qZsnXbZ8z1egA.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\3qZsnXbZ8z1egA.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\3SReUsWYQe.xls - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\3SReUsWYQe.xls.CRAB - Access
C:\Users\Nd9E1FYi\Documents\4pdLU7.pdf - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\4pdLU7.pdf.CRAB - Access
C:\Users\Nd9E1FYi\Documents\4RmmFCk0BX7QahWLqVx5.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\4RmmFCk0BX7QahWLqVx5.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\5vN57VGzAE.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\5vN57VGzAE.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\6eUPbghm7ZBluxc.ppt - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\6eUPbghm7ZBluxc.ppt.CRAB - Access
C:\Users\Nd9E1FYi\Documents\6ng6JlXHb8hwuQ.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\6ng6JlXHb8hwuQ.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\7_Zy.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\7_Zy.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\7oAyWmRuk6Rev8e.ppt - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\7oAyWmRuk6Rev8e.ppt.CRAB - Access
C:\Users\Nd9E1FYi\Documents\95qK9jgeM.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\95qK9jgeM.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\9ck.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\9ck.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\_3noyG57lzSpeak.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\_3noyG57lzSpeak.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\_wnatvZlC6XqeL.ppt - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\_wnatvZlC6XqeL.ppt.CRAB - Access
C:\Users\Nd9E1FYi\Documents\A8oskYh.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\A8oskYh.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\B1zUmc.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\B1zUmc.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\BHVRr3kYc.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\BHVRr3kYc.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\BkxfwmXNXil_cYhxfQs.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\BkxfwmXNXil_cYhxfQs.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\CBQF.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\CBQF.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\CJMNuW 4cb0wpI.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\CJMNuW 4cb0wpI.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Documents\D1dhLhbgxoT.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\D1dhLhbgxoT.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\d2JVpicU.ots - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\d2JVpicU.ots.CRAB - Access
C:\Users\Nd9E1FYi\Documents\dLkR7Xv.pdf - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\dLkR7Xv.pdf.CRAB - Access
C:\Users\Nd9E1FYi\Documents\DP6fTEj02K06.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\DP6fTEj02K06.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\DZBYR6C6eJk cv.ppt - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\DZBYR6C6eJk cv.ppt.CRAB - Access
C:\Users\Nd9E1FYi\Documents\ea-CnW.odt - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\ea-CnW.odt.CRAB - Access
C:\Users\Nd9E1FYi\Documents\eCeaLvu8v-ssV7jBsi.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\eCeaLvu8v-ssV7jBsi.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\EJg4n2H-eOKc-FT-vy.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\EJg4n2H-eOKc-FT-vy.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\eTgm6R0B9s.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\eTgm6R0B9s.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\fQ9SmMLDV5wcEGYOA.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\fQ9SmMLDV5wcEGYOA.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\fXjGYhYKUU9N5 9E.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\fXjGYhYKUU9N5 9E.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\ggEd2ZFiTn.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\ggEd2ZFiTn.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\Gj1AETY8gGZf_ZpBFT.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\Gj1AETY8gGZf_ZpBFT.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\gUtLmVES.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\gUtLmVES.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\H68iskuDWS.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\H68iskuDWS.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\HbIBqmIdwFh5l3CkQWW.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\HbIBqmIdwFh5l3CkQWW.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\HGetLP aV.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\HGetLP aV.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\i-UF7_g9OFxd.ots - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\i-UF7_g9OFxd.ots.CRAB - Access
C:\Users\Nd9E1FYi\Documents\JPYL7tZbQpiqjE0ymjrJ.pps - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\JPYL7tZbQpiqjE0ymjrJ.pps.CRAB - Access
C:\Users\Nd9E1FYi\Documents\JVuFz.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\JVuFz.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\jXQiT7GR.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\jXQiT7GR.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\K5Mygl.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\K5Mygl.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\LHGY.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\LHGY.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\M_CHyV1AF6ug5VOwl.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\M_CHyV1AF6ug5VOwl.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\Mc2EgDqsDljYTmV.pdf - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\Mc2EgDqsDljYTmV.pdf.CRAB - Access
C:\Users\Nd9E1FYi\Documents\mCux0hJieHBSy1 5U1.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\mCux0hJieHBSy1 5U1.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\mFFs.odt - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\mFFs.odt.CRAB - Access
C:\Users\Nd9E1FYi\Documents\MfNXQZkG0M.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\MfNXQZkG0M.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\mJGjStuw.odp - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\mJGjStuw.odp.CRAB - Access
C:\Users\Nd9E1FYi\Documents\MMcXOPb7kn8VzqaF4K.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\MMcXOPb7kn8VzqaF4K.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\My Music\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Documents\My Pictures\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Documents\My Videos\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Documents\MyVpu.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\MyVpu.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\n4OwU.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\n4OwU.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\Ndo7yk7mA1 4f9Z.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\Ndo7yk7mA1 4f9Z.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\OQgO-r48LdFGEy63aCY.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\OQgO-r48LdFGEy63aCY.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\Outlook Files\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Documents\Outlook Files\ldkhh@oedd.de.pst - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\Outlook Files\ldkhh@oedd.de.pst.CRAB - Access
C:\Users\Nd9E1FYi\Documents\P9fCWBOY-l.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\P9fCWBOY-l.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\pOCdHdUN5EEiedm5Ct.odp - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\pOCdHdUN5EEiedm5Ct.odp.CRAB - Access
C:\Users\Nd9E1FYi\Documents\pUsocY.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\pUsocY.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\q8mF0_KHya0K9utMH0cG.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\q8mF0_KHya0K9utMH0cG.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\qNm_xzCD.csv - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\qNm_xzCD.csv.CRAB - Access
C:\Users\Nd9E1FYi\Documents\QO EUigo4EXK9olc0XpX.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\QO EUigo4EXK9olc0XpX.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\r1sp-wV96nAjkRK.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\r1sp-wV96nAjkRK.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\r6PXFHzw-.doc - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\r6PXFHzw-.doc.CRAB - Access
C:\Users\Nd9E1FYi\Documents\REkt.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\REkt.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\RHbIT0mnhhyB.odt - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\RHbIT0mnhhyB.odt.CRAB - Access
C:\Users\Nd9E1FYi\Documents\RlQf78f7r3L7_m.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\RlQf78f7r3L7_m.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\Rr9y.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\Rr9y.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\S9-7VoNLm5We-.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\S9-7VoNLm5We-.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\s_wtt21h2.doc - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\s_wtt21h2.doc.CRAB - Access
C:\Users\Nd9E1FYi\Documents\SFJfWe_xbxjr_0QHJ7.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\SFJfWe_xbxjr_0QHJ7.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\sYdi1iD2SlroiBmUO1.odp - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\sYdi1iD2SlroiBmUO1.odp.CRAB - Access
C:\Users\Nd9E1FYi\Documents\T6SK.csv - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\T6SK.csv.CRAB - Access
C:\Users\Nd9E1FYi\Documents\T87fWEkNQqVgt.pps - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\T87fWEkNQqVgt.pps.CRAB - Access
C:\Users\Nd9E1FYi\Documents\u5yfJ5Dj8.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\u5yfJ5Dj8.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\uok42anf6rkWD5o.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\uok42anf6rkWD5o.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\uXwt eePK.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\uXwt eePK.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\UZGaw3RhFkNhQARy6.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\UZGaw3RhFkNhQARy6.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\w7n_pc.csv - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\w7n_pc.csv.CRAB - Access
C:\Users\Nd9E1FYi\Documents\WAsSzGR_aBTObV.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\WAsSzGR_aBTObV.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\wbxbaYD9AL.rtf - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\wbxbaYD9AL.rtf.CRAB - Access
C:\Users\Nd9E1FYi\Documents\WindowsPowerShell\Modules - Access
C:\Users\Nd9E1FYi\Documents\wRaq.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\wRaq.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\wVGypC6c_8.rtf - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\wVGypC6c_8.rtf.CRAB - Access
C:\Users\Nd9E1FYi\Documents\x-tAr U1thhtmy24.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\x-tAr U1thhtmy24.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\X92otNpR-x5Zma_ Dmt_.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\X92otNpR-x5Zma_ Dmt_.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\xHjYo.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\xHjYo.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\xmFZUHlNX2960gz.docx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\xmFZUHlNX2960gz.docx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\YafdM6xMz.pptx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\YafdM6xMz.pptx.CRAB - Access
C:\Users\Nd9E1FYi\Documents\YUFw65UL.pps - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\YUFw65UL.pps.CRAB - Access
C:\Users\Nd9E1FYi\Documents\yVJ4yghUyczj_wPOEFm.ots - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\yVJ4yghUyczj_wPOEFm.ots.CRAB - Access
C:\Users\Nd9E1FYi\Documents\Z0wcTdfJmjLHe2Dd.xlsx - Access, Read, Write
C:\Users\Nd9E1FYi\Documents\Z0wcTdfJmjLHe2Dd.xlsx.CRAB - Access
C:\Users\Nd9E1FYi\Downloads\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Favorites\360 Safeguard.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\360 Safeguard.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Avito.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Avito.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Bing.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Bing.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Favorites\Daily Mail.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Daily Mail.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\eBay UK.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\eBay UK.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Google Egypt.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Google Egypt.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Google file storage.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Google file storage.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Google France.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Google France.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Google Japan.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Google Japan.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Google Russia.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Google Russia.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Google Taiwan.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Google Taiwan.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Google Turkey.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Google Turkey.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Hao123.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Hao123.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Links\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Favorites\MSN.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\MSN.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Nicovideo.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Nicovideo.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Sohu.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Sohu.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Twitch.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Twitch.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Yahoo News Japan.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Yahoo News Japan.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Yandex.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Yandex.url.CRAB - Access
C:\Users\Nd9E1FYi\Favorites\Zhihu.url - Access, Read, Write
C:\Users\Nd9E1FYi\Favorites\Zhihu.url.CRAB - Access
C:\Users\Nd9E1FYi\Links\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Music\4HyC47VsRdMug7Gc\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Music\_SkRz7uqznuwQ.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Music\_SkRz7uqznuwQ.wav.CRAB - Access
C:\Users\Nd9E1FYi\Music\aqUncS51gyQ66kdm0p.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\aqUncS51gyQ66kdm0p.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\\CRAB-DECRYPT.txt - Access
C:\Users\Nd9E1FYi\Music\EYd9uzm2uBvXNM.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\EYd9uzm2uBvXNM.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\IGFj0BTIDDvf5Dt3A.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Music\IGFj0BTIDDvf5Dt3A.wav.CRAB - Access
C:\Users\Nd9E1FYi\Music\P_Px\29sQJgTJn6vfV.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\P_Px\29sQJgTJn6vfV.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\P_Px\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Music\P_Px\h6GPodAi0hSbAnF_r.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\P_Px\h6GPodAi0hSbAnF_r.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\P_Px\hwDUcpa1JBujJ.m4a - Access, Read, Write
C:\Users\Nd9E1FYi\Music\P_Px\hwDUcpa1JBujJ.m4a.CRAB - Access
C:\Users\Nd9E1FYi\Music\P_Px\tets6 HWEXzv8Da26Fcf.m4a - Access, Read, Write
C:\Users\Nd9E1FYi\Music\P_Px\tets6 HWEXzv8Da26Fcf.m4a.CRAB - Access
C:\Users\Nd9E1FYi\Music\P_Px\wgRWvQJa8iJ_hMepL6.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\P_Px\wgRWvQJa8iJ_hMepL6.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\P_Px\yMjOMRUyemD4dlr0n.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\P_Px\yMjOMRUyemD4dlr0n.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\qIcNo.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Music\qIcNo.wav.CRAB - Access
C:\Users\Nd9E1FYi\Music\QM80RPucM\4Z-EgFIopteJ7\6dmfdQmH3.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Music\QM80RPucM\4Z-EgFIopteJ7\6dmfdQmH3.wav.CRAB - Access
C:\Users\Nd9E1FYi\Music\QM80RPucM\4Z-EgFIopteJ7\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Music\QM80RPucM\4Z-EgFIopteJ7\dTH__zhIamvc98.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\QM80RPucM\4Z-EgFIopteJ7\dTH__zhIamvc98.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\QM80RPucM\4Z-EgFIopteJ7\up YA1Y8oxDA.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\QM80RPucM\4Z-EgFIopteJ7\up YA1Y8oxDA.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\QM80RPucM\4Z-EgFIopteJ7\Y9fRCStGrxko.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Music\QM80RPucM\4Z-EgFIopteJ7\Y9fRCStGrxko.wav.CRAB - Access
C:\Users\Nd9E1FYi\Music\QM80RPucM\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Music\QM80RPucM\o-VexDI.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\QM80RPucM\o-VexDI.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\QM80RPucM\vyyOJqo UsqlQbEZP9f.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\QM80RPucM\vyyOJqo UsqlQbEZP9f.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\8cYqNm-.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\8cYqNm-.wav.CRAB - Access
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\b8AGJwR.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\b8AGJwR.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\6tl6Y7XkOe6_wGtiQB.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\6tl6Y7XkOe6_wGtiQB.wav.CRAB - Access
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\CrvQe_4CUjzS\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\nTbDCTW818Aix\9JYy0zhGPBA.m4a - Access, Read, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\nTbDCTW818Aix\9JYy0zhGPBA.m4a.CRAB - Access
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\nTbDCTW818Aix\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\nTbDCTW818Aix\OCc9jwfTXSSXCwIQ3FwT.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\nTbDCTW818Aix\OCc9jwfTXSSXCwIQ3FwT.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\nTbDCTW818Aix\w13AP63T9TkT.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\nTbDCTW818Aix\w13AP63T9TkT.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\nTbDCTW818Aix\xT6biou.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\K6jyK5\nTbDCTW818Aix\xT6biou.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\pMUVN.mp3 - Access, Read, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\pMUVN.mp3.CRAB - Access
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\vEyv.wav - Access, Read, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\vEyv.wav.CRAB - Access
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\wDDlTMUtzuPRjXldKW.m4a - Access, Read, Write
C:\Users\Nd9E1FYi\Music\Rv_iuPdDeifu2Bq\wDDlTMUtzuPRjXldKW.m4a.CRAB - Access
C:\Users\Nd9E1FYi\My Documents\\CRAB-DECRYPT.txt - Access
C:\Users\Nd9E1FYi\NetHood\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\ntuser.dat.LOG1 - Access
C:\Users\Nd9E1FYi\ntuser.dat.LOG2 - Access
C:\Users\Nd9E1FYi\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf - Access
C:\Users\Nd9E1FYi\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms - Access
C:\Users\Nd9E1FYi\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms - Access
C:\Users\Nd9E1FYi\ntuser.ini - Access, Read, Write
C:\Users\Nd9E1FYi\ntuser.ini.CRAB - Access
C:\Users\Nd9E1FYi\OneDrive\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\-suVf3QALoxUB6G.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\-suVf3QALoxUB6G.bmp.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\7luG_S6_dk4.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\7luG_S6_dk4.bmp.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\4sHYt1PZi2kf6WB Yio.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\4sHYt1PZi2kf6WB Yio.bmp.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\7blSwi6 bzIYzalyCH.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\7blSwi6 bzIYzalyCH.bmp.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\90 LAKKb8MCrS\BTVMj1YZkz_L.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\90 LAKKb8MCrS\BTVMj1YZkz_L.gif.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\90 LAKKb8MCrS\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\90 LAKKb8MCrS\OtJtmd5OKPOGSV.jpg - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\90 LAKKb8MCrS\OtJtmd5OKPOGSV.jpg.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\AF ELxZt.png - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\AF ELxZt.png.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\hRpeMa7SM_JlY\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\hRpeMa7SM_JlY\dsm FADw.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\hRpeMa7SM_JlY\dsm FADw.gif.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\hRpeMa7SM_JlY\u5laif2gx_ ExgVR.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\hRpeMa7SM_JlY\u5laif2gx_ ExgVR.gif.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\TpypYqcZeqwuEglAORq\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\TpypYqcZeqwuEglAORq\FNX1KY3uQNJM.png - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\TpypYqcZeqwuEglAORq\FNX1KY3uQNJM.png.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\TpypYqcZeqwuEglAORq\g5xE-kCe400N.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\TpypYqcZeqwuEglAORq\g5xE-kCe400N.gif.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\TpypYqcZeqwuEglAORq\WgZ209V6i5TMyq9IY.jpg - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\GeWoeF\TpypYqcZeqwuEglAORq\WgZ209V6i5TMyq9IY.jpg.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\ntf8-Qny2wH4n07.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\ntf8-Qny2wH4n07.gif.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\y4sU31V.jpg - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\9YFb-ocGCZm_JclJL\y4sU31V.jpg.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\_PS6\_kqnSVMKLm1YPTlG.jpg - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\_PS6\_kqnSVMKLm1YPTlG.jpg.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\_PS6\AIWfKT0Hj1zN0p.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\_PS6\AIWfKT0Hj1zN0p.bmp.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\_PS6\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\_PS6\E1G0z.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\_PS6\E1G0z.bmp.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\_PS6\GjwZzYwJT3voIw.png - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\_PS6\GjwZzYwJT3voIw.png.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\_PS6\MZQBS.png - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\_PS6\MZQBS.png.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\_PS6\nAZmaw4Er41A\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\_PS6\sJlVys1tFGQ_V0pAe.bmp - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\_PS6\sJlVys1tFGQ_V0pAe.bmp.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\BsTKhUmEmMsofD 80x\1qsQJw5gi.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\BsTKhUmEmMsofD 80x\1qsQJw5gi.gif.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\BsTKhUmEmMsofD 80x\4jGlepj\3AmzVOB.png - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\BsTKhUmEmMsofD 80x\4jGlepj\3AmzVOB.png.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\BsTKhUmEmMsofD 80x\4jGlepj\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\BsTKhUmEmMsofD 80x\4jGlepj\EfPM3dZRh.jpg - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\BsTKhUmEmMsofD 80x\4jGlepj\EfPM3dZRh.jpg.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\BsTKhUmEmMsofD 80x\4jGlepj\fYfmGknK PI.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\BsTKhUmEmMsofD 80x\4jGlepj\fYfmGknK PI.gif.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\BsTKhUmEmMsofD 80x\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\Camera Roll\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Nd9E1FYi\Pictures\DYUmLcxN.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\DYUmLcxN.gif.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\lntr0HHuhYtnp-.gif - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\lntr0HHuhYtnp-.gif.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\QVpUXBjfw.jpg - Access, Read, Write
C:\Users\Nd9E1FYi\Pictures\QVpUXBjfw.jpg.CRAB - Access
C:\Users\Nd9E1FYi\Pictures\Saved Pictures\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\PrintHood\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Recent\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Saved Games\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Searches\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Searches\Everywhere.search-ms - Access, Read, Write
C:\Users\Nd9E1FYi\Searches\Everywhere.search-ms.CRAB - Access
C:\Users\Nd9E1FYi\Searches\Indexed Locations.search-ms - Access, Read, Write
C:\Users\Nd9E1FYi\Searches\Indexed Locations.search-ms.CRAB - Access
C:\Users\Nd9E1FYi\SendTo\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Start Menu\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Templates\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Videos\-pw1E7K.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\-pw1E7K.avi.CRAB - Access
C:\Users\Nd9E1FYi\Videos\\CRAB-DECRYPT.txt - Access
C:\Users\Nd9E1FYi\Videos\Cuo6SPOjWWTGl7OOS.flv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\Cuo6SPOjWWTGl7OOS.flv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\54q7Emi00InmUiBh4.flv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\54q7Emi00InmUiBh4.flv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\7RcaJ-B-FulbWnBijcXE.flv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\7RcaJ-B-FulbWnBijcXE.flv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\iVwcNous96VML39.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\iVwcNous96VML39.mkv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\0iq_\1oCEz.mp4 - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\0iq_\1oCEz.mp4.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\0iq_\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\0iq_\wq0VTY0S19vaT4.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\0iq_\wq0VTY0S19vaT4.avi.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\6N8045c-SOWtMc.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\6N8045c-SOWtMc.avi.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\8aPatwAh6P3H4-.flv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\8aPatwAh6P3H4-.flv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\CdaMBp8nKQu.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\CdaMBp8nKQu.avi.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\fV4Fc3O\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\fV4Fc3O\gmHZ.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\fV4Fc3O\gmHZ.mkv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\fV4Fc3O\YkYfpbbQRLzkj-iDSU.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\fV4Fc3O\YkYfpbbQRLzkj-iDSU.mkv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\mMxRmF1CC.mp4 - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\mMxRmF1CC.mp4.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\noh4ZMY.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\noh4ZMY.avi.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\QLZ1qryy.mp4 - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3bUx\QLZ1qryy.mp4.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3WBZ.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\3WBZ.mkv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\6 a4m\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\6 a4m\HK2dS 8.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\6 a4m\HK2dS 8.avi.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\6 a4m\N EkZNbc1o3WN.flv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\6 a4m\N EkZNbc1o3WN.flv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\6 a4m\uYKBTfxUAvyzIn-4.flv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\6 a4m\uYKBTfxUAvyzIn-4.flv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\6 a4m\vRoQOnjztauZ.mp4 - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\6 a4m\vRoQOnjztauZ.mp4.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\EiMPnwUb_7vMWhYd7wv.flv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\EiMPnwUb_7vMWhYd7wv.flv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\MVjr4a.mp4 - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\MVjr4a.mp4.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\R0rwP4.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\R0rwP4.avi.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\WIq3ApVMmH.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\WIq3ApVMmH.mkv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\Y59DUvi4K\0LjUzOYL0mzm_UXICi_Z.mkv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\Y59DUvi4K\0LjUzOYL0mzm_UXICi_Z.mkv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\Y59DUvi4K\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\Y59DUvi4K\Mzuva081Ecml_PBXx.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\mZk5bgskOhvBE8C8CFq\Y59DUvi4K\Mzuva081Ecml_PBXx.avi.CRAB - Access
C:\Users\Nd9E1FYi\Videos\KJdEBKv\x9hlPaP1ozUu.mp4 - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\KJdEBKv\x9hlPaP1ozUu.mp4.CRAB - Access
C:\Users\Nd9E1FYi\Videos\M7iYqPEbNDAkD6K.mp4 - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\M7iYqPEbNDAkD6K.mp4.CRAB - Access
C:\Users\Nd9E1FYi\Videos\PVcWLp.flv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\PVcWLp.flv.CRAB - Access
C:\Users\Nd9E1FYi\Videos\Pz0WplIg7eOK1qIe0.swf - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\Pz0WplIg7eOK1qIe0.swf.CRAB - Access
C:\Users\Nd9E1FYi\Videos\u4ggu.avi - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\u4ggu.avi.CRAB - Access
C:\Users\Nd9E1FYi\Videos\Xu9u_e.flv - Access, Read, Write
C:\Users\Nd9E1FYi\Videos\Xu9u_e.flv.CRAB - Access
C:\Users\Public\AccountPictures\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Public\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Public\Desktop\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Documents\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Public\Documents\My Music\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Public\Documents\My Pictures\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Public\Documents\My Videos\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Public\Downloads\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Public\Libraries\\CRAB-DECRYPT.txt - Access, Write
C:\Users\Public\Libraries\RecordedTV.library-ms - Access, Read, Write
C:\Users\Public\Libraries\RecordedTV.library-ms.CRAB - Access
C:\Users\Public\Music\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Videos\\CRAB-DECRYPT.txt - Access
C:\Windows - Access
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll - Access
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config - Access, Read
C:\Windows\system32 - Access
laxodaromowuku himefuvuriyuseyu zegiyevufebucena sanavazobijayu - Access
C:\Windows\System32\Wbem - Access
C:\Windows\System32\WindowsPowerShell\v1.0\ - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\HelpV3.format.ps1xml - Access, Read
C:\Windows\system32\WindowsPowerShell\v1.0\Modules - Access
c:\windows\system32\windowspowershell\v1.0\Modules\AppBackgroundTask - Access
c:\windows\system32\windowspowershell\v1.0\Modules\AppBackgroundTask\AppBackgroundTask.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\AppLocker - Access
c:\windows\system32\windowspowershell\v1.0\Modules\AppLocker\AppLocker.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Appx - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Appx\Appx.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\AssignedAccess - Access
c:\windows\system32\windowspowershell\v1.0\Modules\AssignedAccess\AssignedAccess.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\AssignedAccess\AssignedAccess.psm1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\BitLocker - Access
c:\windows\system32\windowspowershell\v1.0\Modules\BitLocker\BitLocker.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psm1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\BitsTransfer - Access
c:\windows\system32\windowspowershell\v1.0\Modules\BitsTransfer\BitsTransfer.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\BranchCache - Access
c:\windows\system32\windowspowershell\v1.0\Modules\BranchCache\BranchCache.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\CimCmdlets - Access
c:\windows\system32\windowspowershell\v1.0\Modules\CimCmdlets\CimCmdlets.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Defender - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Defender\Defender.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\DirectAccessClientComponents - Access
c:\windows\system32\windowspowershell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Dism - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Dism\Dism.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dism\Dism.psm1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\DnsClient - Access
c:\windows\system32\windowspowershell\v1.0\Modules\DnsClient\DnsClient.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\EventTracingManagement - Access
c:\windows\system32\windowspowershell\v1.0\Modules\EventTracingManagement\EventTracingManagement.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\International - Access
c:\windows\system32\windowspowershell\v1.0\Modules\International\International.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\iSCSI - Access
c:\windows\system32\windowspowershell\v1.0\Modules\iSCSI\iSCSI.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\ISE - Access
c:\windows\system32\windowspowershell\v1.0\Modules\ISE\ISE.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psm1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Kds - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Kds\Kds.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Archive - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Archive\en-US - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Archive\en-US\en-US.cdxml - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Archive\en-US\en-US.dll - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Archive\en-US\en-US.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Archive\en-US\en-US.psm1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Archive\en-US\en-US.xaml - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Commands.Management - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Commands.Management\Microsoft.PowerShell.Commands.Management.dll - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Commands.Utility - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Diagnostics - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Diagnostics\Microsoft.PowerShell.Diagnostics.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Host - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Host\Microsoft.PowerShell.Host.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Management - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Management\en-US\Microsoft.PowerShell.Management.psd1 - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Management\en\Microsoft.PowerShell.Management.psd1 - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Commands.Management.dll - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Commands.Management.dll\Microsoft.PowerShell.Commands.Management.dll - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1 - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Management\PSGetModuleInfo.xml - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.ODataUtils - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US\en-US.cdxml - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US\en-US.dll - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US\en-US.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US\en-US.psm1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US\en-US.xaml - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\Microsoft.PowerShell.ODataUtils.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\Microsoft.PowerShell.ODataUtils.psm1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\Microsoft.PowerShell.ODataUtilsHelper.ps1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Security - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\en-US\Microsoft.PowerShell.Utility.psd1 - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\en\Microsoft.PowerShell.Utility.psd1 - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Commands.Utility.dll\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1 - Access, Read
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1 - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\PSGetModuleInfo.xml - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.WSMan.Management\Microsoft.WSMan.Management.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\MMAgent\MMAgent.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\MsDtc\MsDtc.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\NetAdapter - Access
c:\windows\system32\windowspowershell\v1.0\Modules\NetAdapter\NetAdapter.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\NetConnection - Access
c:\windows\system32\windowspowershell\v1.0\Modules\NetConnection\NetConnection.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\NetEventPacketCapture - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\NetEventPacketCapture.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\NetLbfo\NetLbfo.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetNat\NetNat.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetQos\NetQos.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetSecurity\NetSecurity.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\NetSwitchTeam.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetTCPIP\NetTCPIP.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus\NetworkConnectivityStatus.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetworkSwitchManager\NetworkSwitchManager.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetworkTransition\NetworkTransition.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PcsvDevice\PcsvDevice.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PKI\PKI.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PnpDevice\PnpDevice.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PrintManagement\PrintManagement.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\PSDesiredStateConfiguration.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSDiagnostics\PSDiagnostics.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSDiagnostics\PSDiagnostics.psm1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\PSScheduledJob - Access
c:\windows\system32\windowspowershell\v1.0\Modules\PSScheduledJob\PSScheduledJob.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\PSWorkflow - Access
c:\windows\system32\windowspowershell\v1.0\Modules\PSWorkflow\PSWorkflow.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\PSWorkflowUtility - Access
c:\windows\system32\windowspowershell\v1.0\Modules\PSWorkflowUtility\PSWorkflowUtility.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\ScheduledTasks - Access
c:\windows\system32\windowspowershell\v1.0\Modules\ScheduledTasks\ScheduledTasks.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\SecureBoot - Access
c:\windows\system32\windowspowershell\v1.0\Modules\SecureBoot\SecureBoot.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\SmbShare - Access
c:\windows\system32\windowspowershell\v1.0\Modules\SmbShare\SmbShare.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbWitness\SmbWitness.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\StartLayout\StartLayout.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Storage\Storage.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\TLS\TLS.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\TroubleshootingPack.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\TrustedPlatformModule.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\VpnClient\VpnClient.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Wdac\Wdac.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsDeveloperLicense\WindowsDeveloperLicense.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\WindowsErrorReporting.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\WindowsErrorReporting.psm1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsSearch\WindowsSearch.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsUpdate\WindowsUpdate.psd1 - Access
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Access
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config - Access
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\typesv3.ps1xml - Access
C:\Windows\system32\wldp.dll - Access
Z:\0in5AWEIxKMUstDhHc.pps - Access
Z:\0l49yVa27V3fbp0.wav - Access
Z:\0nDSOdqmLj8q.flv - Access
Z:\0UnRrqmweUZEv2O.doc - Access
Z:\0uoW8iDiO9C0q.jpg - Access
Z:\1F9dzJR3Dq.wav - Access
Z:\1fn93wGZjdanZB.docx - Access
Z:\1ngG8KQUVLO.m4a - Access
Z:\1taL0c72JXkGj.docx - Access
Z:\2V4nNeRhoBFj576c7yH.odp - Access
Z:\2XzzHT1hfS0s9l.docx - Access
Z:\30yCZTi8h1x.ppt - Access
Z:\3f8x8CrYapPiNap.bmp - Access
Z:\42d71SFHtTn0.ppt - Access
Z:\4GjkdoqNU7goI.png - Access
Z:\4gn85VfichSpHdBliF7.odt - Access
Z:\4wTKrcVkUP.mp4 - Access
Z:\4yXte0uXIFucLv4.odt - Access
Z:\4z3uag.rtf - Access
Z:\5nMxkl.mkv - Access
Z:\5X5bvQKCD.pdf - Access
Z:\5Z53F1qndo.mp4 - Access
Z:\6dWSrqDXT.gif - Access
Z:\6FHTeIALuazFh6S.mp3 - Access
Z:\6swVov0.docx - Access
Z:\7eOistArUshTqU.mkv - Access
Z:\7GrhyEMiwBBm2mof.ots - Access
Z:\86j9DrKplH4.m4a - Access
Z:\8KdP1zVgyza2WB4YuYBy.gif - Access
Z:\8qGeXH1kIXTzNAwh1.pptx - Access
Z:\8tUbiYEgTdW.odp - Access
Z:\991tuWIWnfwOaO.rtf - Access
Z:\9C7SUj.mp3 - Access
Z:\9HqwEbX7Ln7H.wav - Access
Z:\9Mb9yKA.png - Access
Z:\9N07GKsKkqcxa3TT.gif - Access
Z:\9nXLd1stH.avi - Access
Z:\9oWgPalpl4eZPpCd.pdf - Access
Z:\9ZTbafp.mp3 - Access
Z:\a7Qw6I.rtf - Access
Z:\A8bmjbQ.flv - Access
Z:\AEAoxD1Men.bmp - Access
Z:\AeKHMJrNCDYUq.ots - Access
Z:\af21bQ5qW.ots - Access
Z:\aHSgQEUnQ.gif - Access
Z:\AJTRrzlFP.ppt - Access
Z:\ApDFPQwO402DkMuco.xls - Access
Z:\aQV013X.ots - Access
Z:\ashgeHC2PQdqLQk7.wav - Access
Z:\aVTaxRUSrZtHvgszoz.pptx - Access
Z:\aWJXG7BTk6.docx - Access
Z:\AXHKm6GyRoXWvxAR1nK.pdf - Access
Z:\aXQim1G3bdkTaexwp.odp - Access
Z:\aXUpRcAz27mPKX.bmp - Access
Z:\AyUhCaK.pdf - Access
Z:\B1jyWDTc76Rz9y3Upp.mkv - Access
Z:\b32L7cLeqU2oCZ.flv - Access
Z:\bagG03Siv8fZOaNznAH.pps - Access
Z:\BCcVJ1ufkJ.ots - Access
Z:\bCtdCwG6b1aq.pdf - Access
Z:\BhX74jJaOIdhyhcSe5G9.xlsx - Access
Z:\bizZxIqHANu2cm8BJxR8.odp - Access
Z:\BKUsAPb4ObOA3nffiu.gif - Access
Z:\bmZb8.ots - Access
Z:\BokNObz8UcZzwf.avi - Access
Z:\BQFGGXzv3.ppt - Access
Z:\brgVKnP3IVGPPX.pps - Access
Z:\BSTdcQ8gXiWpbdQJ9j9.m4a - Access
Z:\byOgrXTqMWyQA.swf - Access
Z:\caihllUFFbcI.wav - Access
Z:\CDcBqXoR8.xls - Access
Z:\cdUeFalzm2mB.ods - Access
Z:\ceEw3OhIGAO0766qFm0B.m4a - Access
Z:\CEkSQb1l9V40Cea.xls - Access
Z:\\CRAB-DECRYPT.txt - Access
Z:\cRZ0MtepZOGtVnmrc.pdf - Access
Z:\ctwtFUQdhyq9B0.flv - Access
Z:\cUJr74E.bmp - Access
Z:\cutoBa.ods - Access
Z:\cxc1c8A9xEZm1pp.xlsx - Access
Z:\d8qsFgy6NUR5eQtZvA.pps - Access
Z:\D9xhD4Vtl9zeKaqi.mkv - Access
Z:\dHIr0PyqgW0.odp - Access
Z:\DHPDPLo.odt - Access
Z:\dHSAr.gif - Access
Z:\diCHxx1R37p96mJV.ppt - Access
Z:\Dj56CGtKFxmm4j0.odp - Access
Z:\DLkdqSFl1CQPIWIFI.odt - Access
Z:\dp9u7AdNvM4gE.mp3 - Access
Z:\DR2HdhXM7A.xls - Access
Z:\drKebb7BNUgYcBRuo.m4a - Access
Z:\Dt6fR5uK1o7A3G9Az9xZ.swf - Access
Z:\DTxMcdBSiMydDh.ots - Access
Z:\dWi8QA6EVif9AdQ964.flv - Access
Z:\dXDD6Vxqyd8jeu.ots - Access
Z:\e9iHCx5Vx23avMo.flv - Access
Z:\eCV9B6Keul.docx - Access
Z:\EdkUgdunNhUsDwiV5VL.xlsx - Access
Z:\EJbZxMj.png - Access
Z:\EmullYJgNTq8y.odt - Access
Z:\EONMy4FO98J1ipDWLzTP.gif - Access
Z:\ePjafyFSVAy.odp - Access
Z:\Er77NKOfBV.pptx - Access
Z:\f3n4Cqr.flv - Access
Z:\f9u0K1jcf0QP3CTM.wav - Access
Z:\fJJNxlZPFcIOL7N8L.pps - Access
Z:\FnlnIo8c7yqjr.docx - Access
Z:\FSEmJ5n1uMSloscL.pdf - Access
Z:\FsFwfuaCG.csv - Access
Z:\Ft1MOn1CIc.pdf - Access
Z:\fUHonlL.swf - Access
Z:\FwXHW.ods - Access
Z:\GafAVMmaQERttbRLW.jpg - Access
Z:\gBya9RjXQ5HVsyeT1gt.flv - Access
Z:\ggNuzUYFd.swf - Access
Z:\gr07JV38A.gif - Access
Z:\gtMj5dvrEffpxCN.pdf - Access
Z:\haBoE0.mp3 - Access
Z:\HCn2qrul7ygqoS.mkv - Access
Z:\hjOwYAb7YQ2odlEyn.avi - Access
Z:\HkvYL3k.odt - Access
Z:\HPloVL0oZ.docx - Access
Z:\ib3F5TJ.png - Access
Z:\ibePv6Lj2e91qk.xlsx - Access
Z:\IbgNETou.avi - Access
Z:\ij5BP3IVD95.xls - Access
Z:\IKsof.pps - Access
Z:\InBvUlw.pptx - Access
Z:\iR5AlC5ioa.odp - Access
Z:\IT6h99wlQ8kMSRWY.mp4 - Access
Z:\ivgKlBjI9.wav - Access
Z:\IWEBAEoUidzls4DEURs.png - Access
Z:\iWJTz4KEmPveSMxUQ8.bmp - Access
Z:\iYqEjip6ZD7yL0q2o40t.mkv - Access
Z:\j1HIB7qSx.mkv - Access
Z:\j22nZgN.ppt - Access
Z:\JB0dwuDHOu.gif - Access
Z:\JGRRP.jpg - Access
Z:\JijZUlwsABe0xQXl.m4a - Access
Z:\JIofEOBdEma0DMUbK.flv - Access
Z:\jLzvb0vT3n52cwbHU6Y.mp4 - Access
Z:\Jo92bs8aTj1Vj0c.ppt - Access
Z:\jOJaIjFheEW0T.xls - Access
Z:\JoVvFlGh27b31AC0CwDF.png - Access
Z:\JRxsV.bmp - Access
Z:\JVOUo4viHF8su3w5.odt - Access
Z:\k45e5zDG7.ods - Access
Z:\Keq3DmENGzTu.ppt - Access
Z:\KFk2iz2CjAH.xlsx - Access
Z:\Kh4ML0UlDG8G3xTW7.m4a - Access
Z:\kjDb0JPxXV.bmp - Access
Z:\klftX5pih07o.wav - Access
Z:\KLpg3Rdw1l.pps - Access
Z:\kmaCVAfM6c.m4a - Access
Z:\Kn7qhmeLrMy5AdqLU92.xlsx - Access
Z:\kpsjXydZA9PotWH4.xlsx - Access
Z:\KtzEQVEZQWFLdAY3Qn.odt - Access
Z:\kxq03SULHIq.mp3 - Access
Z:\l7JxDWOVk.mp3 - Access
Z:\LBzJZ0Sa2cEQ2n6qcw3.csv - Access
Z:\lEAREuPn69.mp4 - Access
Z:\lEmsyCR.ods - Access
Z:\LezTzJpVLGFgKhSzkk.m4a - Access
Z:\lfR9rINk9dEZ.mp4 - Access
Z:\LfWkkMwiKa4.ods - Access
Z:\LOFKJdnEn4MzMXm.rtf - Access
Z:\Lp3sHpFPOeag.mp4 - Access
Z:\LRgNGE3acWIgEa.gif - Access
Z:\m9asRMP8HoSL6.avi - Access
Z:\mn3To5BSC6.gif - Access
Z:\mnb7We8LDQ6wrfuL.ots - Access
Z:\MR8b0p2eb.docx - Access
Z:\MSGyIwhbxwdO.ots - Access
Z:\mW4UoHVdQjsL.flv - Access
Z:\n1oIgSCOHCUfCFKnMot5.wav - Access
Z:\N56ssz.pps - Access
Z:\n9qfkqWXJ24VCxo.pps - Access
Z:\NjZEnmit.pdf - Access
Z:\np5Lm.flv - Access
Z:\Nu17HJT.doc - Access
Z:\nucEj.ots - Access
Z:\NXOcFmcZH0kfs1V2.xls - Access
Z:\nyYkSXYcJ3N.xlsx - Access
Z:\o31FKcUml.odt - Access
Z:\o4isx.png - Access
Z:\Ogn94.wav - Access
Z:\Or93WHIBFD2VZ2c.docx - Access
Z:\OUzRKAK.odp - Access
Z:\oXr639hN3x86Bhd.avi - Access
Z:\OxsstRqW1jSBVg9mfGKW.rtf - Access
Z:\oxutnkIjKB.mp3 - Access
Z:\p1AcZbp.gif - Access
Z:\P1jVB9gi5QH3vMspsV.mp4 - Access
Z:\p87Mkvx4n6eR91T.pdf - Access
Z:\P9p5SRi7OL0lv.mp3 - Access
Z:\PCEJlbmpwZ68QNsWdvWo.mp4 - Access
Z:\PD2J8WWYx87xI0ZI.odp - Access
Z:\pEtobMGPdVk4C2adw.csv - Access
Z:\pGRiU.docx - Access
Z:\PlmVZkn.csv - Access
Z:\pnOgbKINM1qNAlrGulmO.avi - Access
Z:\PW0S4nrI2WlYOAIrz.avi - Access
Z:\pWw3Texk6CwVcTz.odp - Access
Z:\Pwx0NeK5H26N3X7a.ppt - Access
Z:\pzNmYBUWbUH.ods - Access
Z:\Q55M7RMlQ1.ods - Access
Z:\q6bC91bzrR.mp4 - Access
Z:\QahKCn8ueyqJ7tcTfc.ppt - Access
Z:\qai0Z93lFXyA0a.flv - Access
Z:\qaJqcQYga.png - Access
Z:\QbYwYSoMD3beKw.mkv - Access
Z:\qCc7INt1lZdUfK.mkv - Access
Z:\QeR6tf3.m4a - Access
Z:\qfhJe21I1iEPfDSocb1f.bmp - Access
Z:\qI3Ls7msTJ7Z5.gif - Access
Z:\QkLjJ0I.mkv - Access
Z:\qmtME3h8QVa74sICzw.m4a - Access
Z:\qnnrT9SEOOv4oMd88.jpg - Access
Z:\QoeoAcaeeahNH1u.gif - Access
Z:\qU7Og9CaR8xuh.rtf - Access
Z:\Qz05DmCXS7.jpg - Access
Z:\RaZrRuMAHW1D9.csv - Access
Z:\reR9RHCDTohDYK3Ff2Y.doc - Access
Z:\RH3IiU0yMrDFNR6DKs.pdf - Access
Z:\rKWXelaLEZJ.rtf - Access
Z:\rLuJ2.avi - Access
Z:\rmkutDE080.jpg - Access
Z:\rp59XRK0hPQE.csv - Access
Z:\rTl3TzrdncuxVDUwQq.avi - Access
Z:\rufq1skQBAfqcl.flv - Access
Z:\RxFoEpC5uC.xlsx - Access
Z:\rYQhITml8s4Mffbv10w.pptx - Access
Z:\rYZw8NqY13.ots - Access
Z:\sbZAE.wav - Access
Z:\SDaBMuPeRu.doc - Access
Z:\sDKhau.doc - Access
Z:\sEi0K8sZnqEl5.avi - Access
Z:\sifLLk9MkzE.rtf - Access
Z:\SkCFLGl.pptx - Access
Z:\SlLKD2xxbJU8.mkv - Access
Z:\Sly3qKgO3ATm8o.rtf - Access
Z:\SmlQzbt58YRNZL1.ots - Access
Z:\SNRKtKQZn5jdD5Qp.odp - Access
Z:\spHYAF9ViIqM9vtOW.avi - Access
Z:\SPmVqqj8wFtWH.swf - Access
Z:\SqQA6.odt - Access
Z:\St0RmHrDVByM7p25RVJ.bmp - Access
Z:\STk5oD5FdXN.ods - Access
Z:\T8EpXefSMHECv.gif - Access
Z:\tbDCg9D.bmp - Access
Z:\tC427X.doc - Access
Z:\tCssBJQX8FXIL.rtf - Access
Z:\Tdjnpl4mS5gutb0FZJX9.jpg - Access
Z:\TdlMonCmeQCgkgR.rtf - Access
Z:\tHwCdQmMoSd.xlsx - Access
Z:\TkryzlAhWDjxy.avi - Access
Z:\tMBfWUGp.xlsx - Access
Z:\TWOSOYcL.rtf - Access
Z:\U3bDAfX7RABVK6AIAEZ.csv - Access
Z:\u3j1lsXp4o0dJ.flv - Access
Z:\u83WZ8EHqHRLwl.ppt - Access
Z:\U9PpB.swf - Access
Z:\uaDwX5CMU5U3ucB.ppt - Access
Z:\uGfnva.docx - Access
Z:\UHagWXyAwvvYR6B2f.odt - Access
Z:\ukO9D2qllnBsxnQ.pptx - Access
Z:\UmBm0ITsbHYon7XWq4F.mp4 - Access
Z:\uPbNb139dTSMCdhFwG.flv - Access
Z:\usc0a0c3QarsfV.docx - Access
Z:\UsVrBfwU9tuC5KFqX2K.swf - Access
Z:\UX0CIrthkmniE.xlsx - Access
Z:\Uxo8b6v.m4a - Access
Z:\uxr0VgIKyabrfeDqhyX.swf - Access
Z:\V2B1F8D.ppt - Access
Z:\vDGdxB.xlsx - Access
Z:\vhzlvnYmCpbfD.mkv - Access
Z:\VI1xj.mp3 - Access
Z:\Vi3sQD.pptx - Access
Z:\vJvHFLFe.pps - Access
Z:\vLMfJAjyPseo6Kmg.mp3 - Access
Z:\VS9DW.swf - Access
Z:\vspqQ0o2tOKgZZ.mp3 - Access
Z:\Vtrqfx.odp - Access
Z:\VZ60ie.ppt - Access
Z:\wMw0OlwWKG.wav - Access
Z:\wtAmsr1H.csv - Access
Z:\wwWTiMqjx6hY7AqmcQRC.rtf - Access
Z:\X2ZrVB60bDAK3cZl14f.gif - Access
Z:\XB4dDmeUIpvrtaFxi.wav - Access
Z:\xEUQNFb1AtDa2EwjJi3V.mkv - Access
Z:\xgvcXmhtLB.docx - Access
Z:\XMjApX5V6.xlsx - Access
Z:\XmnJxoBkEp9WD4cyN.gif - Access
Z:\xQ6SLR9y03J4ITfu7P.flv - Access
Z:\xQkZa3z95fozLz9l.gif - Access
Z:\XVkMbKypLIiLe059.docx - Access
Z:\XvsUo.m4a - Access
Z:\y0T1Oh7jZZrC632.xls - Access
Z:\ySIriF.odp - Access
Z:\yUtPCopr3.wav - Access
Z:\z6JgWitYLK.pdf - Access
Z:\z8zLOOgA3oe.odp - Access
Z:\Zco6FDtNcxUboIRnw.jpg - Access
Z:\ZcRis.ppt - Access
Z:\ZfiqBIWgc6yC8hqpAMBh.xlsx - Access
Z:\zg8vtsMD.jpg - Access
Z:\zKrYkW7P9h.odp - Access
Z:\ZluEZ8VfU.ppt - Access
Z:\zP0nKisr4oLuznV8Y.pptx - Access
Z:\ZRjAo5mazeN.mp3 - Access
Z:\ZURHdOemF1Sio2JJg0.m4a - Access
Z:\zvb7Mnw3iSwviEopdWc.xlsx - Access
Z:\ZvphsNc.jpg - Access
Z:\ZWHKH4ncD.avi - Access
Z:\Zz3XIk0KMIqhIY4WEe.flv - Access
Registry (58)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\.JS Access, Read
HKEY_CLASSES_ROOT\JSFile\ScriptEngine Access, Read
HKEY_CURRENT_USER Access
HKEY_CURRENT_USER\Control Panel\International Access, Read
HKEY_CURRENT_USER\Environment Access, Read
HKEY_CURRENT_USER\Keyboard Layout\Preload Access, Read
HKEY_CURRENT_USER\SOFTWARE\Microsoft\.NETFramework\XML Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Access, Write
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\XML Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script\Features Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN Access, Read
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient Access
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging Access
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging Access
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription Access
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Winevt\Publishers\{5037b0a0-3a31-5cd2-ff19-103e9f160a74} Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters Access, Read
Mutex (2)
»
Mutex Name Operations
Global\PowerShell_CommandAnalysis_Lock_S-1-5-21-2172869166-1497266965-2109836178-1000 Access, Delete
Global\pc_group=WORKGROUP&ransom_id=58de2295a283c81 Access
URL (6)
»
URL Operations
92.63.197.38/letsgo.exe?LbPUer GET
ipv4bot.whatismyipaddress.com/ GET
77.244.219.151/seyst POST
77.244.219.151/eighge POST
77.244.219.151/store?steepl=aiplau&sauf=iesay POST
77.244.219.151/eighph?soref=eezaui POST
IP (3)
»
IP Protocols
92.63.197.38 HTTP, TCP
109.234.35.56 DNS, UDP
77.244.219.151 HTTP, TCP
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image