Trojan.Encoder.38847

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\decrypt-files.html

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\foo.db
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows sidebar\gadgets\decrypt-files.html
%LOCALAPPDATA%\microsoft help\decrypt-files.html
%LOCALAPPDATA%\mozilla\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\doomed\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\offlinecache\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\safebrowsing\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\safebrowsing\google4\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\startupcache\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\thumbnails\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\bcjnbgva.default\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows sidebar\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows media\12.0\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows mail\backup\new\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows mail\backup\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows mail\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_cab_0aad3c95\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_08339354\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\wer\reportarchive\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\wer\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\virtualized\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows media\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\wer\erc\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows mail\stationery\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\safebrowsing\google4\decrypt-files.html
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\decrypt-files.html
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\decrypt-files.html
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\doomed\decrypt-files.html
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\safebrowsing\decrypt-files.html
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\safebrowsing\google4\decrypt-files.html
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\startupcache\decrypt-files.html
%LOCALAPPDATA%low\microsoft\decrypt-files.html
%LOCALAPPDATA%\thunderbird\profiles\decrypt-files.html
%LOCALAPPDATA%low\microsoft\internet explorer\decrypt-files.html
%LOCALAPPDATA%low\microsoft\internet explorer\services\decrypt-files.html
%LOCALAPPDATA%low\mozilla\decrypt-files.html
%LOCALAPPDATA%low\mozilla\temp-{10ec5a16-76a1-4966-833c-89c100352a7c}\decrypt-files.html
%LOCALAPPDATA%low\mozilla\temp-{6caf41d3-d3bc-4111-be0f-6767486b42d5}\decrypt-files.html
%LOCALAPPDATA%low\mozilla\temp-{74a94761-d090-449f-b0e6-cb7d26a06c26}\decrypt-files.html
%LOCALAPPDATA%\thunderbird\profiles\49zr3fqa.default\decrypt-files.html
%LOCALAPPDATA%\thunderbird\decrypt-files.html
%LOCALAPPDATA%low\mozilla\temp-{c524df81-3d66-47d3-a687-5ed5a39c6588}\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\startupcache\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\thumbnails\decrypt-files.html
%LOCALAPPDATA%\programs\decrypt-files.html
%LOCALAPPDATA%\programs\common\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\doomed\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\safebrowsing\decrypt-files.html
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\offlinecache\decrypt-files.html
%TEMP%\decrypt-files.html
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\decrypt-files.html
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\decrypt-files.html
%TEMP%\opera installer\decrypt-files.html
%TEMP%\wpdnse\decrypt-files.html
%TEMP%\hsperfdata_user\decrypt-files.html
%TEMP%\low\decrypt-files.html
%TEMP%\microsoft .net framework 4 setup_4.0.30319\decrypt-files.html
%LOCALAPPDATA%low\decrypt-files.html
%LOCALAPPDATA%low\mozilla\temp-{9cda0b19-0440-4e70-9631-93e7041926aa}\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__macosx\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__macosx\_locales\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\session storage\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\evwhitelist\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\pepperflash\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\pnacl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\swiftshader\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\widevinecdm\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\decrypt-files.html
%LOCALAPPDATA%\history\decrypt-files.html
%LOCALAPPDATA%\microsoft\feeds cache\5uzys9tz\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\decrypt-files.html
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\decrypt-files.html
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\decrypt-files.html
%LOCALAPPDATA%\microsoft\office\decrypt-files.html
%LOCALAPPDATA%\microsoft\office\groove\decrypt-files.html
%LOCALAPPDATA%\microsoft\office\groove\system\decrypt-files.html
%LOCALAPPDATA%\microsoft\office\groove\user\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\burn\decrypt-files.html
%LOCALAPPDATA%\microsoft\credentials\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\burn\burn\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\caches\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\explorer\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\gameexplorer\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\history\low\decrypt-files.html
%LOCALAPPDATA%\microsoft\media player\sync playlists\decrypt-files.html
%LOCALAPPDATA%\microsoft\media player\decrypt-files.html
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\decrypt-files.html
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\decrypt-files.html
%LOCALAPPDATA%\microsoft\internet explorer\recovery\decrypt-files.html
%LOCALAPPDATA%\microsoft\internet explorer\decrypt-files.html
%LOCALAPPDATA%\microsoft\feeds cache\q2xofo16\decrypt-files.html
%LOCALAPPDATA%\microsoft\feeds cache\id3ykpjl\decrypt-files.html
%LOCALAPPDATA%\microsoft\windows\ringtones\decrypt-files.html
%LOCALAPPDATA%\microsoft\feeds cache\1zlrvj28\decrypt-files.html
%LOCALAPPDATA%\microsoft\feeds cache\decrypt-files.html
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\decrypt-files.html
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\decrypt-files.html
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\decrypt-files.html
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\decrypt-files.html
%LOCALAPPDATA%\microsoft\feeds\decrypt-files.html
%LOCALAPPDATA%\microsoft\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\de\decrypt-files.html
%LOCALAPPDATA%low\oracle\decrypt-files.html
%APPDATA%\microsoft\windows\ietldcache\low\decrypt-files.html
%APPDATA%\microsoft\systemcertificates\my\crls\decrypt-files.html
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\decrypt-files.html
%APPDATA%\microsoft\protect\decrypt-files.html
%APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\decrypt-files.html
%APPDATA%\microsoft\systemcertificates\decrypt-files.html
%APPDATA%\microsoft\systemcertificates\my\decrypt-files.html
%APPDATA%\microsoft\systemcertificates\my\certificates\decrypt-files.html
%APPDATA%\microsoft\systemcertificates\my\ctls\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\decrypt-files.html
%APPDATA%\microsoft\windows\decrypt-files.html
%APPDATA%\microsoft\windows\cookies\decrypt-files.html
%APPDATA%\microsoft\windows\cookies\low\decrypt-files.html
%APPDATA%\microsoft\windows\iecompatcache\decrypt-files.html
%APPDATA%\microsoft\windows\iecompatcache\low\decrypt-files.html
%APPDATA%\microsoft\windows\ietldcache\decrypt-files.html
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decrypt-files.html
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\decrypt-files.html
%APPDATA%\microsoft\internet explorer\quick launch\decrypt-files.html
%APPDATA%\microsoft\internet explorer\decrypt-files.html
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\decrypt-files.html
%APPDATA%\microsoft\crypto\rsa\decrypt-files.html
%APPDATA%\microsoft\crypto\decrypt-files.html
%APPDATA%\microsoft\credentials\decrypt-files.html
%APPDATA%\microsoft\windows\network shortcuts\decrypt-files.html
%APPDATA%\media center programs\decrypt-files.html
%APPDATA%\identities\{d59a8b31-5854-4768-ba01-cd66beadf546}\decrypt-files.html
%APPDATA%\identities\decrypt-files.html
%APPDATA%\decrypt-files.html
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\security\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\decrypt-files.html
%APPDATA%\microsoft\windows\libraries\decrypt-files.html
%APPDATA%\microsoft\decrypt-files.html
%APPDATA%\microsoft\windows\privacie\decrypt-files.html
%APPDATA%\microsoft\windows\recent\automaticdestinations\decrypt-files.html
%APPDATA%\microsoft\windows\themes\decrypt-files.html
%APPDATA%\mozilla\decrypt-files.html
%APPDATA%\mozilla\extensions\decrypt-files.html
%APPDATA%\mozilla\firefox\decrypt-files.html
%APPDATA%\mozilla\firefox\crash reports\decrypt-files.html
%APPDATA%\mozilla\firefox\crash reports\events\decrypt-files.html
%APPDATA%\mozilla\firefox\profiles\decrypt-files.html
%APPDATA%\microsoft\windows\start menu\programs\winrar\decrypt-files.html
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\decrypt-files.html
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\bookmarkbackups\decrypt-files.html
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\decrypt-files.html
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\events\decrypt-files.html
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\decrypt-files.html
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\decrypt-files.html
%APPDATA%\microsoft\windows\templates\decrypt-files.html
%APPDATA%\microsoft\windows\privacie\low\decrypt-files.html
%LOCALAPPDATA%low\oracle\java\decrypt-files.html
%APPDATA%\microsoft\windows\recent\customdestinations\decrypt-files.html
%APPDATA%\microsoft\windows\sendto\decrypt-files.html
%APPDATA%\microsoft\windows\start menu\decrypt-files.html
%APPDATA%\microsoft\windows\printer shortcuts\decrypt-files.html
%APPDATA%\microsoft\windows\start menu\programs\decrypt-files.html
%APPDATA%\microsoft\windows\recent\decrypt-files.html
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\decrypt-files.html
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\decrypt-files.html
%APPDATA%\microsoft\windows\start menu\programs\google chrome\decrypt-files.html
%APPDATA%\microsoft\windows\start menu\programs\maintenance\decrypt-files.html
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\decrypt-files.html
%APPDATA%\microsoft\windows\start menu\programs\accessories\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\decrypt-files.html
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\decrypt-files.html
%APPDATA%\microsoft\windows\start menu\programs\administrative tools\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\decrypt-files.html
%LOCALAPPDATA%low\oracle\java\au\decrypt-files.html
%LOCALAPPDATA%low\sun\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\decrypt-files.html
%LOCALAPPDATA%low\sun\java\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\decrypt-files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\decrypt-files.html
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\__macosx\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extension state\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\databases\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\decrypt-files.html
%LOCALAPPDATA%\google\chrome\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\decrypt-files.html
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\decrypt-files.html
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\decrypt-files.html
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\decrypt-files.html
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\decrypt-files.html
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\decrypt-files.html
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\caps\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\decrypt-files.html
%LOCALAPPDATA%\google\chrome\application\decrypt-files.html
%LOCALAPPDATA%\google\decrypt-files.html
C:\users\default\documents\decrypt-files.html
C:\users\default\appdata\local\decrypt-files.html
C:\users\default\appdata\local\history\decrypt-files.html
C:\users\default\appdata\local\microsoft\decrypt-files.html
C:\users\default\appdata\local\microsoft\windows\decrypt-files.html
C:\users\default\appdata\local\microsoft\windows\gameexplorer\decrypt-files.html
C:\users\default\appdata\local\microsoft\windows\<INETFILES>\decrypt-files.html
C:\users\default\appdata\roaming\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\recent\decrypt-files.html
C:\users\default\appdata\roaming\media center programs\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\internet explorer\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\cookies\decrypt-files.html
C:\users\default\appdata\decrypt-files.html
C:\users\default\decrypt-files.html
C:\decrypt-files.html
D:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\decrypt-files.html
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\decrypt-files.html
C:\recovery\decrypt-files.html
C:\perflogs\admin\decrypt-files.html
C:\perflogs\decrypt-files.html
<Current directory>\decrypt-files.html
C:\users\default\appdata\local\temp\decrypt-files.html
C:\msocache\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\decrypt-files.html
D:\decrypt-files.html
C:\kms\decrypt-files.html
C:\documents and settings\decrypt-files.html
C:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\decrypt-files.html
C:\$recycle.bin\decrypt-files.html
D:\$recycle.bin\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\sendto\decrypt-files.html
C:\users\public\documents\my music\decrypt-files.html
C:\users\public\documents\my videos\decrypt-files.html
C:\users\public\downloads\decrypt-files.html
C:\users\public\favorites\decrypt-files.html
C:\users\public\libraries\decrypt-files.html
C:\users\public\documents\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\decrypt-files.html
C:\users\public\documents\my pictures\decrypt-files.html
C:\users\public\music\sample music\decrypt-files.html
C:\users\public\videos\sample videos\decrypt-files.html
%HOMEPATH%\decrypt-files.html
%HOMEPATH%\appdata\decrypt-files.html
%LOCALAPPDATA%\decrypt-files.html
C:\users\public\pictures\sample pictures\decrypt-files.html
C:\users\public\recorded tv\decrypt-files.html
C:\users\public\recorded tv\sample media\decrypt-files.html
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\decrypt-files.html
C:\users\default\saved games\decrypt-files.html
C:\users\default\links\decrypt-files.html
C:\users\default\favorites\decrypt-files.html
C:\users\default\downloads\decrypt-files.html
C:\users\default\documents\my videos\decrypt-files.html
C:\users\default\documents\my pictures\decrypt-files.html
C:\users\default\documents\my music\decrypt-files.html
C:\users\public\desktop\decrypt-files.html
C:\users\default\desktop\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\templates\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\decrypt-files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\decrypt-files.html
C:\users\public\decrypt-files.html
%APPDATA%\mozilla\firefox\pending pings\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\th\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\zh_cn\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\vi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\uk\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\tr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\zh_tw\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sv\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\id\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ko\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\lt\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\lv\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hu\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\nl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ja\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pt_br\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ro\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ru\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sk\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\no\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sl\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pt_pt\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\it\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hr\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fil\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\es\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\en\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\el\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\da\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hi\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ca\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\bg\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ar\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\he\decrypt-files.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\cs\decrypt-files.html
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\minidumps\decrypt-files.html

Moves the following files

from %TEMP%\adobearm.log to %TEMP%\adobearm.log.q38d
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\broadcast-listeners.json.7rvv
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\compatibility.ini.7rvv
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\containers.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\containers.json.3lr9xh
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\crashes\store.json.mozlz4.loovzgo
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160101.d9d62ad7-4327-4aa9-97e7-aeb5486c45ee.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160101.d9d62ad7-4327-4aa9-97e7-aeb5486c45ee.new-profile.jsonlz4.5wmurcz
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160111.ee43e28f-610b-4229-a7d7-171f6ed032bd.health.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160111.ee43e28f-610b-4229-a7d7-171f6ed032bd.health.jsonlz4.5wmurcz
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160174.0bfb99e9-0e75-47d0-b739-94e23d793342.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160174.0bfb99e9-0e75-47d0-b739-94e23d793342.event.jsonlz4.iqecbum
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160236.a847dc89-db3d-4896-9bef-b610ec76e43d.health.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160236.a847dc89-db3d-4896-9bef-b610ec76e43d.health.jsonlz4.iqecbum
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160262.1f6a84f6-29b5-43da-aa85-b8cf32dd80d0.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160262.1f6a84f6-29b5-43da-aa85-b8cf32dd80d0.main.jsonlz4.82oz
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160264.0186ea91-e835-4919-9366-c7e15b92110b.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160264.0186ea91-e835-4919-9366-c7e15b92110b.first-shutdown.jsonlz4.qa62a
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\session-state.json.qa62a
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\state.json.jfdut3
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extension-preferences.json.jfdut3
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extensions.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extensions.json.jfdut3
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt.4yzvnp
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\manifest.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\manifest.json.4yzvnp
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.0yh0
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib.lbovaf
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig.olgcpdv
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\handlers.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\handlers.json.xkwt44n
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt.xkwt44n
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\prefs.js to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\prefs.js.3fbbz6s
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0186ea91-e835-4919-9366-c7e15b92110b to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0186ea91-e835-4919-9366-c7e15b92110b.3fbbz6s
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0bfb99e9-0e75-47d0-b739-94e23d793342 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0bfb99e9-0e75-47d0-b739-94e23d793342.pyqdfuk
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\1f6a84f6-29b5-43da-aa85-b8cf32dd80d0 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\1f6a84f6-29b5-43da-aa85-b8cf32dd80d0.smbx
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\a847dc89-db3d-4896-9bef-b610ec76e43d to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\a847dc89-db3d-4896-9bef-b610ec76e43d.glange
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\d9d62ad7-4327-4aa9-97e7-aeb5486c45ee to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\d9d62ad7-4327-4aa9-97e7-aeb5486c45ee.4qpcvmu
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\bookmarkbackups\bookmarks-2023-10-09_11_wowu13vthwkcthdlkwm-la==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\bookmarkbackups\bookmarks-2023-10-09_11_wowu13vthwkcthdlkwm-la==.jsonlz4.7rvv
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\ee43e28f-610b-4229-a7d7-171f6ed032bd to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\ee43e28f-610b-4229-a7d7-171f6ed032bd.4qpcvmu
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4.5apgqwm
from %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js to %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js.2xbuk
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\handlers.json.cmrsnk
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\permissions.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\permissions.sqlite.yrtvo
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt.yrtvo
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite.armw
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js.4hmnw
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\bef7f9cf-b0b1-42d8-a037-8d586d4d1e42 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\bef7f9cf-b0b1-42d8-a037-8d586d4d1e42.vmkm
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\dc5a4164-f290-4a08-a5ec-0fe7810acbc6 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\dc5a4164-f290-4a08-a5ec-0fe7810acbc6.03nt
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\f9af9616-8535-4ace-8050-4454f33ad475 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\f9af9616-8535-4ace-8050-4454f33ad475.03nt
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\fbcd22a2-e53a-4131-9ef1-1935f505d9ca to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\fbcd22a2-e53a-4131-9ef1-1935f505d9ca.wssl2
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\search.json.mozlz4.wssl2
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessioncheckpoints.json.ttt1a4
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore-backups\recovery.jsonlz4.ttt1a4
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore.jsonlz4.873xbcv
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\shield-preference-experiments.json.873xbcv
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\.metadata-v2.0hge
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\.metadata-v2.y3xkfb
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.naga
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.qdw1
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.r7f89
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.yhqyjlq
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.vlkxa4y
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage.sqlite.oobf
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\times.json.oobf
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js.mwqe
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\webappsstore.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\webappsstore.sqlite.h3y2n
from %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json to %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json.h3y2n
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json.tztcw7
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\search.json.mozlz4.prjqjqi
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\security_state\data.safe.bin to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\security_state\data.safe.bin.dvro0
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessioncheckpoints.json.dvro0
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4.u8vho
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json.7beiiu
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json.7beiiu
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json.7beiiu
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite.mz1da9
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json.mz1da9
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json.l4ld
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite.mfaw
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite.oqan2
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite.mg7h4q
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite.gq7e
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite.rx0a
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json.y2ef8
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite.hbdm
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite.n6jxio
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js.n6jxio
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf.gvcdee7
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.gvcdee7
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b.gvcdee7
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4.qheevgo
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json.qheevgo
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2.flpkj6g
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.rohy
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite.hw7c
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json.hw7c
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite.hw7c
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4.49pqg
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4.u8vho
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4.gdhfuon
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite.gdhfuon
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\compatibility.ini.d330b3
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\recovery.jsonlz4.mcxbl
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\upgrade.jsonlz4-20200708170202.2tryit
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\shield-preference-experiments.json.2tryit
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt.2tryit
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\.metadata-v2.5n1pmxq
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.s... to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.s...
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\.metadata-v2.7kdk
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.hrugxb
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.lvmcprh
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.lvmcprh
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2918063365piupsah.sqlite.cud4
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.8t4oc
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\formhistory.sqlite.zuktu
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\times.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\times.json.j13wnk
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.tnhvtq
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\xulstore.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\xulstore.json.uk954jt
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.uk954jt
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.7hwb
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.wyjtadc
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.k98z44w
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.xkx2
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.xkx2
from %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json to %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json.8jwuw
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite.0pxgxq
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json.mq1uz6g
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4.e3icfuj
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite.rjbzjqs
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\previous.jsonlz4.mcxbl
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\user.js to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\user.js.uk954jt
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.3j4h
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\favicons.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\favicons.sqlite.mjeb9
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\bookmarkbackups\bookmarks-2022-09-28_11_3a7quggif+d7xxwa176j2q==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\bookmarkbackups\bookmarks-2022-09-28_11_3a7quggif+d7xxwa176j2q==.jsonlz4.mite
from %TEMP%\dd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log.6govltg
from %TEMP%\dd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log.mprod
from %TEMP%\dd_vcredist_x86_20220928165916.log to %TEMP%\dd_vcredist_x86_20220928165916.log.ocu6n6f
from %TEMP%\dd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log.nqozgr2
from %TEMP%\dd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log.ixkyim0
from %TEMP%\dd_vcredist_x86_20220928170143.log to %TEMP%\dd_vcredist_x86_20220928170143.log.zv9xwiy
from %TEMP%\dd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log.epwfr
from %TEMP%\dd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log.xagltwu
from %TEMP%\dd_vcredist_x86_20220928170221.log to %TEMP%\dd_vcredist_x86_20220928170221.log.aqza
from %TEMP%\dd_vcredist_x86_20220928170335.log to %TEMP%\dd_vcredist_x86_20220928170335.log.brqmb
from %TEMP%\dd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log.zbz8sb
from %TEMP%\dd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log.oyb1gxm
from %TEMP%\dd_vcredist_x86_20220928170410.log to %TEMP%\dd_vcredist_x86_20220928170410.log.city
from %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt to %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt.b2bf1
from %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt to %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt.b2bf1
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.b2bf1
from %TEMP%\jusched.log to %TEMP%\jusched.log.gk3umu
from %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt.dcd0
from %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt.p2xim
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt.fg9aj
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt.jiklp5
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt.cj2i
from %TEMP%\rgi5839.tmp to %TEMP%\rgi5839.tmp.y1ilce
from %TEMP%\rgi5839.tmp-tmp to %TEMP%\rgi5839.tmp-tmp.y1ilce
from %TEMP%\setupexe(20220928171621f0c).log to %TEMP%\setupexe(20220928171621f0c).log.6jdkxik
from %TEMP%\tmpaddon to %TEMP%\tmpaddon.7tronwd
from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.s176u
from %TEMP%\dd_vcredist_x86_20220928165710.log to %TEMP%\dd_vcredist_x86_20220928165710.log.lswi9b
from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\f58155b4b1d5a524ca0261c3ee99fb50_d4602615-9d50-4880-be41-678935e93eaa to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\f58155b4b1d5a524ca0261c3ee99fb50_d4602615-9d50-4880-be41-678935e93eaa.yeoqe
from %TEMP%\dd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log.3ccg0
from %TEMP%\dd_vcredist_x86_20220928165536.log to %TEMP%\dd_vcredist_x86_20220928165536.log.1wow
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.q38d
from %TEMP%\armui.ini to %TEMP%\armui.ini.zg8yr
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.pteneu
from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.pteneu
from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.pteneu
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.c8zfclu
from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.c8zfclu
from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.c8zfclu
from %TEMP%\dd_vcredistmsi7a3c.txt to %TEMP%\dd_vcredistmsi7a3c.txt.njuc
from %TEMP%\dd_vcredistui7a3c.txt to %TEMP%\dd_vcredistui7a3c.txt.njuc
from %TEMP%\dd_vcredist_amd64_20220928165349.log to %TEMP%\dd_vcredist_amd64_20220928165349.log.whzq
from %TEMP%\dd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log.2um44
from %TEMP%\dd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log.rpuod
from %TEMP%\dd_vcredist_amd64_20220928165628.log to %TEMP%\dd_vcredist_amd64_20220928165628.log.4msisx
from %TEMP%\dd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log.4msisx
from %TEMP%\dd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log.a3lvyw6
from %TEMP%\dd_vcredist_amd64_20220928165746.log to %TEMP%\dd_vcredist_amd64_20220928165746.log.vc0wmdq
from %TEMP%\dd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log.vc0wmdq
from %TEMP%\dd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log.mglp
from %TEMP%\dd_vcredist_amd64_20220928165956.log to %TEMP%\dd_vcredist_amd64_20220928165956.log.htnwd
from %TEMP%\dd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log.t7vuhh
from %TEMP%\dd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log.t7vuhh
from %TEMP%\dd_vcredist_amd64_20220928170114.log to %TEMP%\dd_vcredist_amd64_20220928170114.log.5k3ngax
from %TEMP%\dd_vcredist_amd64_20220928170250.log to %TEMP%\dd_vcredist_amd64_20220928170250.log.shpgocm
from %TEMP%\dd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log.fp2k
from %TEMP%\dd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log.1wow
from %TEMP%\dd_vcredist_amd64_20220928170328.log to %TEMP%\dd_vcredist_amd64_20220928170328.log.1wow
from %TEMP%\dd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log.j3gmh
from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.ifhjp
from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.ifhjp
from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.v0hpkds
from %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk to %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.xnz4sc
from %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.viww5wm
from %APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk to %APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk.paljfo5
from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.y4y5e
from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.l3dpv
from %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.oflwct
from %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.xdykgh
from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.xdykgh
from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.xdykgh
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.s52ikyo
from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.s52ikyo
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json.p9xkwz
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extension-preferences.json.ln65gl
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addonstartup.json.lz4.934qse
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\broadcast-listeners.json.wp76
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\compatibility.ini.rn0s
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\containers.json.sjct
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\content-prefs.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\content-prefs.sqlite.6b2klh
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite.jdqmwn
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\store.json.mozlz4.02jakjx
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759331.f9af9616-8535-4ace-8050-4454f33ad475.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759331.f9af9616-8535-4ace-8050-4454f33ad475.new-profile.jsonlz4.qjwqh
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759476.fbcd22a2-e53a-4131-9ef1-1935f505d9ca.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759476.fbcd22a2-e53a-4131-9ef1-1935f505d9ca.event.jsonlz4.wfk3z
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759547.bef7f9cf-b0b1-42d8-a037-8d586d4d1e42.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759547.bef7f9cf-b0b1-42d8-a037-8d586d4d1e42.main.jsonlz4.buxx
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759551.dc5a4164-f290-4a08-a5ec-0fe7810acbc6.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759551.dc5a4164-f290-4a08-a5ec-0fe7810acbc6.first-shutdown.jsonlz4.hl3n3
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\session-state.json.2apgd
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\state.json.xxwa
from %APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk.ky7cz
from %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk to %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.xnz4sc
from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk.tuhu
from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk.ofenagq
from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk.ofenagq
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk.j4amh
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk.zfvrtk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk.mjrlnrx
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk.kk1fl
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk.bxieek
from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.bxieek
from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.zadxidr
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\71e6321a-7203-4cd6-882b-58bcea299d05 to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\71e6321a-7203-4cd6-882b-58bcea299d05.zadxidr
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\ec2e5fbc-5cd2-48b5-bd25-b5b2c4d33d98 to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\ec2e5fbc-5cd2-48b5-bd25-b5b2c4d33d98.zadxidr
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\preferred.qrza2bg
from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\documents.library-ms.urhfyf
from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\music.library-ms.urhfyf
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions.json.cytq
from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\videos.library-ms.tiprj
from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\pictures.library-ms.sjh0
from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.tu43ng
from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.syaoom
from %APPDATA%\microsoft\windows\sendto\fax recipient.lnk to %APPDATA%\microsoft\windows\sendto\fax recipient.lnk.syaoom
from %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail to %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.icjqixy
from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk.gn4hwys
from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk.jijbh
from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk.rabdp
from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.rabdp
from %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.zweyo2
from %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk.y4px3o
from %APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk.y4px3o
from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk.d3v0sz
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk.wsae
from %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.cmyzlk
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.y2ef8

Modifies the following files

C:\users\public\desktop\acrobat reader dc.lnk
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
C:\users\default\ntuser.dat.log1
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\help.lnk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\windows explorer.lnk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\run.lnk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\notepad.lnk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\command prompt.lnk
C:\users\public\desktop\firefox.lnk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk
C:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail
C:\users\default\appdata\roaming\microsoft\windows\sendto\fax recipient.lnk
C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink
C:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\winre.wim
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi
D:\install.log
C:\kms\kms_vl_all_aio_debug.log
C:\kms\kms_vl_all_aio.cmd
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk
C:\users\public\desktop\mozilla thunderbird.lnk

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\wbem\wmic.exe' shadowcopy delete' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial