flash

script.exe.7582a080.0x0000000002360000-0x0000000002401fff.exe

Status: finished
Submission Time: 31.07.2020 02:14:16
Malicious
Ransomware
Phishing
Evader
HTMLPhisher Sodinokibi

Comments

Tags

Details

  • Analysis ID:
    254449
  • API (Web) ID:
    404440
  • Analysis Started:
    31.07.2020 02:14:17
  • Analysis Finished:
    31.07.2020 02:27:29
  • MD5:
    d5b831131e93aa30512ca34b0085980d
  • SHA1:
    0a55c8164e612ff9bf28ba493885ca040e5840ad
  • SHA256:
    be5a6314e4c9911fb51c7471c50e900a8645d31111baee36038f8dc0cc891643
  • Technologies:
Full Report Engine Info Verdict Score Reports

malicious

System: w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

IPs

IP Country Detection
162.144.17.96
United States
217.160.0.51
Germany
108.167.161.213
United States
Click to see the 97 hidden entries
46.30.58.168
Germany
83.138.86.102
Germany
104.18.50.89
United States
217.160.0.208
Germany
18.202.227.122
United States
92.53.96.250
Russian Federation
198.46.93.64
United States
178.77.86.131
Germany
104.31.77.205
United States
185.165.184.24
Romania
104.152.109.92
United States
50.87.169.151
United States
172.67.142.212
United States
107.191.63.1
United States
188.226.138.70
European Union
35.208.109.165
United States
213.186.33.18
France
192.252.146.15
United States
104.131.161.191
United States
51.15.85.234
France
51.77.137.26
France
80.240.20.142
Germany
35.185.122.102
United States
185.98.131.132
France
192.42.116.41
Netherlands
184.168.131.241
United States
159.253.19.44
Estonia
141.138.169.215
Netherlands
85.214.155.19
Germany
199.16.128.113
Canada
151.101.66.159
United States
77.111.240.1
Denmark
89.234.180.47
France
217.182.126.186
France
104.28.13.75
United States
159.89.213.59
United States
192.99.7.155
Canada
149.28.106.195
United States
109.95.157.35
Poland
23.106.221.179
United States
198.54.125.174
United States
50.87.137.220
United States
185.50.197.168
Spain
104.24.121.17
United States
96.127.180.186
United States
141.98.100.35
Romania
185.161.140.75
Netherlands
37.9.175.9
Slovakia (SLOVAK Republic)
104.31.82.80
United States
50.116.72.208
United States
95.217.73.113
Germany
145.239.0.194
France
107.191.48.119
United States
185.232.187.133
Netherlands
213.159.29.75
Turkey
78.47.106.17
Germany
50.116.53.94
United States
77.240.183.196
Czech Republic
94.231.103.165
Denmark
68.65.120.201
United States
35.209.103.2
United States
3.94.148.248
United States
178.33.92.20
France
87.254.25.84
United Kingdom
185.21.42.205
Denmark
144.217.72.25
Canada
52.28.116.69
United States
81.19.215.5
United Kingdom
217.70.186.111
France
213.186.33.50
France
85.214.17.182
Germany
51.75.16.76
France
70.32.23.18
United States
45.79.138.92
United States
176.62.169.242
Belgium
37.34.48.68
Netherlands
37.152.88.204
Spain
172.67.207.210
United States
185.157.56.11
Norway
69.89.31.185
United States
134.119.246.152
Germany
77.111.95.167
Hungary
75.151.98.76
United States
178.62.210.148
European Union
35.189.90.49
United States
52.9.200.151
United States
91.199.212.52
United Kingdom
193.34.145.202
Germany
213.128.76.181
Turkey
184.168.131.233
United States
104.27.133.249
United States
134.119.88.129
Germany
195.154.29.241
France
195.210.46.50
Kazakhstan
77.72.0.142
United Kingdom
3.234.181.234
United States
104.233.202.79
United States

Domains

Name IP Detection
parksideseniorliving.net
104.152.109.92
glas-kuck.de
145.239.0.194
skyboundnutrition.co.uk
18.202.227.122
Click to see the 97 hidden entries
biketruck.de
77.111.240.1
egpu.fr
89.234.180.47
pajagus.fr
107.191.63.1
dreamvoiceclub.org
162.144.17.96
thesilkroadny.com
149.28.106.195
apmollerpension.com
159.89.213.59
medicalsupportco.com
184.168.131.241
pilotgreen.com
188.226.138.70
elex.is
77.240.183.196
kafkacare.com
3.94.148.248
mrcar.nl
37.34.48.68
rs-danmark.dk
185.21.42.205
alcye.com
68.65.120.201
cascinarosa33.it
217.70.186.111
patriotcleaning.net
172.67.142.212
ncn.nl
185.232.187.133
soundseeing.net
178.77.86.131
optigas.com
45.79.138.92
innovationgames-brabant.nl
51.15.85.234
reygroup.pt
178.33.92.20
amorbellezaysalud.com
198.54.125.174
hepishopping.com
23.106.221.179
masecologicos.com
192.42.116.41
jacquesgarcianoto.com
69.89.31.185
nxtstg.org
78.47.106.17
unboxtherapy.site
104.18.50.89
bruut.online
141.138.169.215
donau-guides.eu
85.214.17.182
mjk.digital
83.138.86.102
volta.plus
213.186.33.50
therapybusinessacademy.com
217.160.0.208
aceroprime.com
192.252.146.15
tetameble.pl
109.95.157.35
pinkxgayvideoawards.com
192.99.7.155
awaitspain.com
185.50.197.168
nalliasmali.net
199.16.128.113
carolynfriedlander.com
107.191.48.119
distrifresh.com
185.161.140.75
parisschool.ru
159.253.19.44
lunoluno.com
176.62.169.242
mangimirossana.it
80.240.20.142
mindfuelers.com
35.185.122.102
anleggsregisteret.no
185.157.56.11
hekecrm.com
172.67.207.210
sellthewrightway.com
141.98.100.35
arearugcleaningnyc.com
96.127.180.186
auto-opel.ro
185.165.184.24
richardiv.com
35.208.109.165
profibersan.com
213.159.29.75
suonenjoen.fi
95.217.73.113
metriplica.academy
37.152.88.204
bumbipdeco.site
45.32.211.218
bescomedical.de
46.30.58.168
uci-france.fr
213.186.33.18
goodherbalhealth.com
50.87.137.220
neonodi.be
185.98.131.132
powershell.su
51.77.137.26
ufovidmag.com
75.151.98.76
rvside.com
104.31.82.80
terraflair.de
134.119.246.152
latteswithleslie.com
198.46.93.64
liveyourheartout.co
50.87.169.151
zuerich-umzug.ch
149.126.4.46
ultimatelifesource.com
87.254.25.84
wyreforest.net
81.19.215.5
concontactodirecto.com
51.75.16.76
daveystownhouse.com
85.214.155.19
jayfurnitureco.com
108.167.161.213
davedavisphotos.com
35.209.103.2
p-ride.live
104.28.13.75
kookooo.com
92.53.96.250
littlesaints.academy
151.101.66.159
thenalpa.com
104.131.161.191
kvetymichalovce.sk
37.9.175.9
harleystreetspineclinic.com
104.24.121.17
bd2fly.com
52.28.116.69
protoplay.ca
70.32.23.18
so-sage.fr
217.182.126.186
wineandgo.hu
77.111.95.167
dentourage.com
144.217.72.25
johnstonmingmanning.com
104.31.77.205
kryddersnapsen.dk
94.231.103.165
drnelsonpediatrics.com
50.116.53.94
mercadodelrio.com
50.116.72.208
teutoradio.de
217.160.0.51
stagefxinc.client.bypronto.com
54.72.3.133
www.bescomedical.de
46.30.58.168
sololibrerie.it
178.62.210.148
leadforensics.com
35.189.90.49
circuit-diagramz.com
193.34.145.202
asf-ris-prod-neurope.northeurope.cloudapp.azure.com
168.63.67.155
leadforensics.wpengine.com
35.189.90.49
crt.sectigo.com
91.199.212.52
www.mjk.digital
83.138.86.102
www.pinkxgayvideoawards.com
192.99.7.155
sylvia17.da0898.com
104.233.202.79
nbparking-lb1-e8979d80a94bc16b.elb.us-east-1.amazonaws.com
3.234.181.234

URLs

Name Detection
https://www.pinkxgayvideoawards.com/wp-content/themes/static/img/ipad.jpg
https://amorbellezaysalud.com/wp-content/uploads/2019/07/resize-e1563161528135-1.jpg
http://crl.identrust
Click to see the 97 hidden entries
http://pki.registradores.org/normativa/index.htm0
https://amorbellezaysalud.com/wakame-que-es-cuales-son-los-beneficios-y-como-consumir/
http://policy.camerfirma.com0
https://www.zuerich-umzug.ch/umzuge/firmenumzuge/
https://bonermagazine.com/
https://amorbellezaysalud.com/wp-includes/css/dashicons.min.css?ver=5.4.2
https://wineandgo.hu/comments/feed
https://optigas.com/wp-content/themes/Avada/assets/css/style.min.css?ver=6.2.3
https://amorbellezaysalud.com/arroz-integral-cuales-son-sus-beneficios-y-como-preparar/
https://amorbellezaysalud.com/wp-content/uploads/2020/02/Capturar-5-1-300x162.png
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
https://optigas.com/wp-json/
https://amorbellezaysalud.com/wp-content/uploads/2020/05/cropped-xcxcxc-180x180.jpg
https://www.pinkxgayvideoawards.com/fr/accueil/
http://cps.letsencrypt.org0
https://donauguides.com/xmlrpc.php?rsd
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
https://wwww.certigna.fr/autorites/0m
https://amorbellezaysalud.com/consejos-para-perder-peso-en-casa-con-ejercicios-y-jugos/
https://www.zuerich-umzug.ch/wp-content/plugins/fusion-builder/assets/css/media/max-640.min.css?ver=
https://amorbellezaysalud.com/wp-content/uploads/2018/04/estrias-1.jpg
https://amorbellezaysalud.com/wp-content/uploads/2020/05/naom_5cf652fa7e913.jpg
https://www.pinkxgayvideoawards.com/wp-content/themes/static/css/jcarousel.responsive.css
https://optigas.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
https://amorbellezaysalud.com/wp-content/plugins/post-views-counter/css/frontend.css?ver=1.3.2
https://www.pinkxgayvideoawards.com/wp-content/uploads/2018/08/thumb/logo-depot-png-rapide-1__235x90
http://www.globaltrust.info0
https://amorbellezaysalud.com/wp-content/uploads/2020/07/alcool-200x150.jpg
http://gmpg.org/xfn/11
https://donauguides.com/bratislava/
https://wineandgo.hu/feed
https://mobirise.com
https://wineandgo.hu/#website
https://amorbellezaysalud.com/wp-content/uploads/2018/04/estrias-1-300x188.jpg
https://www.zuerich-umzug.ch/wp-content/uploads/2018/08/umzugsfirma-zuerich-umzuege.jpg
https://amorbellezaysalud.com
https://teutoradio.de/wp-includes/wlwmanifest.xml
https://hekecrm.com:443/static/assets/pn.pngmage/mikj.jpg
http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
https://optigas.com/wp-conte
https://rvside.com/rv-content/themes/focusblog/css/ie8.css
https://www.jacquesgarcianoto.com
https://strobomag.com/
https://powershell.su/data/assets/rphtfynk.gif
https://optigas.com/#website
https://www.zuerich-umzug.ch/unverbindliche-reinigungsofferte-anfordern/
https://certs.starfieldtech.com/repository/0
https://www.zuerich-umzug.ch/wp-content/plugins/fusion-builder/assets/css/media/min-4c-max-5c.css?ve
https://donauguides.com/wp-includes/wlwmanifest.xml
https://www.zuerich-umzug.ch/wp-content/themes/Avada/includes/lib/assets/min/js/library/ie11CustomPr
https://amorbellezaysalud.com/6-beneficios-de-la-meditacion-para-la-salud/
https://teutoradio.de/radio-stellenboerse
https://teutoradio.de/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
http://www.acabogacia.org0
https://terraflair.de/data/tmp/shjn.png
https://teutoradio.de/tiersuche
https://optigas.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
https://monsieuragency.com
https://donauguides.com/wp-content/plugins/wp-hide-post/public/js/wp-hide-post-public.js?ver=2.0.10
https://rvside.com/rv-content/themes/focusblog/cs
https://arearugcleaningnyc.com/
https://www.pinkxgayvideoawards.com/wp-content/themes/static/js/jquery.jcarousel.min.js
https://www.jacquesgarcianoto.com/contact/
http://cdp.rapidssl.com/RapidSSLRSACA2018.crl0L
https://www.zuerich-umzug.ch/gX
https://protoplay.ca/wp-json/
http://ocsp.suscerte.gob.ve0
https://donauguides.com/wp-content/plugins/logo-carousel-pro/assets/css/jquery.bxslider.min.css?ver=
https://teutoradio.de/wp-content/themes/dynamic-news-lite/js/html5shiv.min.js?ver=3.7.3
https://www.zuerich-umzug.ch/wp-content/uploads/2018/12/cropped-Umzugsfirma-Bassersdorf-3-270x270.jp
http://crl.dhimyotis.com/certignarootca.crl0
http://www.chambersign.org1
https://www.zuerich-umzug.ch/#webpage
https://amorbellezaysalud.com/wp-content/themes/royale-news/style.css?ver=5.4.2
https://www.pinkxgayvideoawards.com/wp-content/uploads/2017/08/thumb/onerOk__235x90.png
https://rename.kz:443/static/game/kdhbgpchcg.gifpgjacquesgarcianoto.comjacquesgarcianoto.com
https://donauguides.com/wp-content/plugins/logo-carousel-pro/assets/css/tooltipster.css?ver=3.2.11
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
http://crl.ssc.lt/root-c/cacrl.crl0
https://amorbellezaysalud.com/wp-content/uploads/2020/07/camote-boniato-200x150.jpg
https://wineandgo.hu/wp-content/plugins/wpml-cms-nav/res/css/cms-navigation-base.css?ver=1.5.2
https://donauguides.com/linz/
http://ca.disig.sk/ca/crl/ca_disig.crl0
https://www.zuerich-umzug.ch/wp-content/themes/Avada/assets/css/media/max-sh-640.min.css?ver=6.1.2
https://wineandgo.hu/wp-content/plugins/wpml-cms-nav/res/css/cms-navigation.css?ver=1.5.2
https://www.zuerich-umzug.ch/em32
https://bescomedical.de/uploads/game/qkagiwsqpzvq.png
http://www.suscerte.gob.ve/dpc0
http://www.disig.sk/ca/crl/ca_disig.crl0
https://pazarspor.org.tr/1995-1996-sezonu/
https://powershell.su/
https://www.zuerich-umzug.ch/reinigung/umzugsreinigung/
https://themebeez.com
https://optigas.com/comments/feed/
https://www.pinkxgayvideoawards.com/wp-content/themes/static/img/fb.png
https://www.pinkxgayvideoawards.com/wp-content/uploads/2019/07/thumb/gymlouvre__235x90.png
https://www.zuerich-umzug.ch/wp-content/uploads/2018/08/umzugsfirma-zuerich-logo.png

Dropped files

Name File Type Hashes Detection
C:\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.xlsx
data
#
C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx
data
#
C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx
data
#
Click to see the 97 hidden entries
C:\Config.Msi\m8we29-readme.txt
data
#
C:\Program Files (x86)\Microsoft SQL Server\110\Shared\m8we29-readme.txt
data
#
C:\Program Files (x86)\Microsoft SQL Server\110\m8we29-readme.txt
data
#
C:\Program Files (x86)\Microsoft SQL Server\m8we29-readme.txt
data
#
C:\Program Files (x86)\m8we29-readme.txt
data
#
C:\Program Files\m8we29-readme.txt
data
#
C:\Recovery\m8we29-readme.txt
data
#
C:\Users\Default\Desktop\m8we29-readme.txt
data
#
C:\Users\Default\Documents\m8we29-readme.txt
data
#
C:\Users\Default\Downloads\m8we29-readme.txt
data
#
C:\Users\Default\Favorites\m8we29-readme.txt
data
#
C:\Users\Default\Links\m8we29-readme.txt
data
#
C:\Users\Default\Music\m8we29-readme.txt
data
#
C:\Users\Default\NTUSER.DAT.LOG1
data
#
C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf
data
#
C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms
data
#
C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms
data
#
C:\Users\Default\Pictures\m8we29-readme.txt
data
#
C:\Users\Default\Saved Games\m8we29-readme.txt
data
#
C:\Users\Default\Videos\m8we29-readme.txt
data
#
C:\Users\Default\m8we29-readme.txt
data
#
C:\Users\Public\AccountPictures\m8we29-readme.txt
data
#
C:\Users\Public\Desktop\m8we29-readme.txt
data
#
C:\Users\Public\Documents\m8we29-readme.txt
data
#
C:\Users\Public\Downloads\m8we29-readme.txt
data
#
C:\Users\Public\Libraries\RecordedTV.library-ms
data
#
C:\Users\Public\Libraries\m8we29-readme.txt
data
#
C:\Users\Public\Music\m8we29-readme.txt
data
#
C:\Users\Public\Pictures\m8we29-readme.txt
data
#
C:\Users\Public\Videos\m8we29-readme.txt
data
#
C:\Users\Public\m8we29-readme.txt
data
#
C:\Users\user\3D Objects\m8we29-readme.txt
data
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30D802E0E248FEE17AAF4A62594CC75A
data
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 58139 bytes, 1 file
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30D802E0E248FEE17AAF4A62594CC75A
data
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\1719x761n0f9y.bmp
PC bitmap, Windows 3.x format, 1280 x 1024 x 32
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g2oakovj.xse.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xie1r3gt.ryl.ps1
very short file (no magic)
#
C:\Users\user\Contacts\m8we29-readme.txt
data
#
C:\Users\user\Desktop\BJZFPPWAPT.jpg
data
#
C:\Users\user\Desktop\BJZFPPWAPT.xlsx
data
#
C:\Users\user\Desktop\DUUDTUBZFW.mp3
data
#
C:\Users\user\Desktop\DUUDTUBZFW.pdf
data
#
C:\Users\user\Desktop\EFOYFBOLXA.docx
data
#
C:\Users\user\Desktop\EFOYFBOLXA.xlsx
data
#
C:\Users\user\Desktop\EFOYFBOLXA\DUUDTUBZFW.pdf
data
#
C:\Users\user\Desktop\EFOYFBOLXA\EWZCVGNOWT.png
data
#
C:\Users\user\Desktop\EFOYFBOLXA\KLIZUSIQEN.mp3
data
#
C:\Users\user\Desktop\EFOYFBOLXA\ZGGKNSUKOP.jpg
data
#
C:\Users\user\Desktop\EFOYFBOLXA\m8we29-readme.txt
data
#
C:\Users\user\Desktop\EOWRVPQCCS\m8we29-readme.txt
data
#
C:\Users\user\Desktop\EWZCVGNOWT.png
data
#
C:\Users\user\Desktop\GRXZDKKVDB.pdf
data
#
C:\Users\user\Desktop\JDDHMPCDUJ\m8we29-readme.txt
data
#
C:\Users\user\Desktop\KLIZUSIQEN.mp3
PGP\011Secret Sub-key -
#
C:\Users\user\Desktop\NVWZAPQSQL.docx
data
#
C:\Users\user\Desktop\NVWZAPQSQL\BJZFPPWAPT.jpg
data
#
C:\Users\user\Desktop\NVWZAPQSQL\DUUDTUBZFW.mp3
data
#
C:\Users\user\Desktop\NVWZAPQSQL\EFOYFBOLXA.xlsx
data
#
C:\Users\user\Desktop\NVWZAPQSQL\GRXZDKKVDB.pdf
data
#
C:\Users\user\Desktop\NVWZAPQSQL\PALRGUCVEH.png
data
#
C:\Users\user\Desktop\NVWZAPQSQL\m8we29-readme.txt
data
#
C:\Users\user\Desktop\NYMMPCEIMA\m8we29-readme.txt
data
#
C:\Users\user\Desktop\PALRGUCVEH.png
data
#
C:\Users\user\Desktop\ZGGKNSUKOP.jpg
data
#
C:\Users\user\Desktop\ZGGKNSUKOP\m8we29-readme.txt
data
#
C:\Users\user\Desktop\m8we29-readme.txt
data
#
C:\Users\user\Documents\20200731\PowerShell_transcript.849224.9ReujPfp.20200731021736.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200731\m8we29-readme.txt
data
#
C:\Users\user\Documents\BJZFPPWAPT.jpg
data
#
C:\Users\user\Documents\BJZFPPWAPT.xlsx
data
#
C:\Users\user\Documents\DUUDTUBZFW.mp3
data
#
C:\Users\user\Documents\DUUDTUBZFW.pdf
data
#
C:\Users\user\Documents\EFOYFBOLXA.docx
data
#
C:\Users\user\Documents\EFOYFBOLXA.xlsx
data
#
C:\Users\user\Documents\EFOYFBOLXA\BJZFPPWAPT.xlsx
data
#
C:\Users\user\Documents\EFOYFBOLXA\DUUDTUBZFW.pdf
data
#
C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx
data
#
C:\Users\user\Documents\EFOYFBOLXA\EWZCVGNOWT.png
data
#
C:\Users\user\Documents\EFOYFBOLXA\KLIZUSIQEN.mp3
data
#
C:\Users\user\Documents\EFOYFBOLXA\ZGGKNSUKOP.jpg
data
#
C:\Users\user\Documents\EFOYFBOLXA\m8we29-readme.txt
data
#
C:\Users\user\Documents\EOWRVPQCCS\m8we29-readme.txt
data
#
C:\Users\user\Documents\EWZCVGNOWT.png
data
#
C:\Users\user\Documents\GRXZDKKVDB.pdf
data
#
C:\Users\user\Documents\JDDHMPCDUJ\m8we29-readme.txt
data
#
C:\Users\user\Documents\KLIZUSIQEN.mp3
data
#
C:\Users\user\Documents\NVWZAPQSQL.docx
data
#
C:\Users\user\Documents\NVWZAPQSQL\BJZFPPWAPT.jpg
data
#
C:\Users\user\Documents\NVWZAPQSQL\DUUDTUBZFW.mp3
data
#
C:\Users\user\Documents\NVWZAPQSQL\EFOYFBOLXA.xlsx
data
#
C:\Users\user\Documents\NVWZAPQSQL\GRXZDKKVDB.pdf
data
#
C:\Users\user\Documents\NVWZAPQSQL\NVWZAPQSQL.docx
data
#
C:\Users\user\Documents\NVWZAPQSQL\PALRGUCVEH.png
data
#
C:\Users\user\Documents\NVWZAPQSQL\m8we29-readme.txt
data
#