Trojan.Encoder.38876

Technical Information

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%HOMEPATH%\ntuser.ini.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\checkboxcomposite.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\checkmark_finished.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\checkmark_hovered.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\checkmark_in_progress.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\checkmark_selected.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\chevron.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\ondemandselectivesync.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\chevronup.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\done_graphic.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\erroricon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\finderextensionprompt.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\foldericon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\folder_image_desktop.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\folder_image_documents.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\folder_image_pictures.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\waterglass.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\cloud.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\cancelicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\acmdismissicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\warning-symbol_grey.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\stackedicecubes.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\icebucket.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\infoicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\kfm_folders_image.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\loading.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\loading_spinner.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\ondemandfiles.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\globeicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\ondemandfilesdehydrate.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\folder_image_documents.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\overflowicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\partiallyfreezing.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\paused.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\premiumicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\recyclebin.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\resignin.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\shield_icon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\folder_image_pictures.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\signin.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\overflowiconlarge.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\globeicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\icebucket.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\loading_spinner.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\kn\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ko\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\kok\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ku-arab\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ky\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\lb-lu\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\lt\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ja\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\lv\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\mk\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ml-in\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\mn\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\mr\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ms\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\mt-mt\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\nb-no\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\kk\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\km-kh\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ka\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\it\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\nl\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\ondemandfiles.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\ondemandfilesdehydrate.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\ondemandselectivesync.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\overflowicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\overflowiconlarge.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\partiallyfreezing.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\infoicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\loading.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\kfm_folders_image.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\paused.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\shield_icon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\signin.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\stackedicecubes.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\warning-symbol_grey.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\waterglass.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\is\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\premiumicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\recyclebin.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\resignin.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\mi-nz\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ne-np\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\finderextensionprompt.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\pt-pt\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\ru\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\sv\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\tr\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\zh-cn\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\zh-tw\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\foldericon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\af\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ar\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\as-in\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\az-latn-az\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\be\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\bg\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\bn-bd\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\ko\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\ja\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\am-et\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\pt-br\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\pl\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\it\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\hu\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\screenshotoptin.gif.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\foldericon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\folder_image_desktop.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\folder_image_documents.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\folder_image_pictures.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\bn-in\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\autoplayoptin.gif.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\saveapplicationeventlogs.wsf.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\nl\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\screenshotoptin.gif.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\onedrive.admx.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\de\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\es\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\adm\fr\onedrive.adml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\collectsynclogs.bat.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\resources.pri.enc
%LOCALAPPDATA%\microsoft\onedrive\resources.pri.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\thirdpartynotices.txt.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\folder_image_desktop.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\bs-latn-ba\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\da\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\id\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ig-ng\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\acmdismissicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\cancelicon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkboxcomposite.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_finished.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ca-es-valencia\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_hovered.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_selected.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\chevron.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\chevronup.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\cloud.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\done_graphic.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\erroricon.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\hi\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\he\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_in_progress.svg.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\hy\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\hu\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ha-latn-ng\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\gu\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\de\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\el\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\en\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\en-gb\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\en-us\msipc.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ca\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\es\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\eu\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\hr\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\fa\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\fil-ph\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\fr\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ga-ie\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\gd\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\gl\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\et\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\cy-gb\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\cs\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\fi\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\messages.json.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\nn-no\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\windows\winx\group2\2 - search.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group2\5 - task manager.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group2\desktop.ini.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\01 - command prompt.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\01a - windows powershell.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\02 - command prompt.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\02a - windows powershell.lnk.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\install_2022-09-29_021454_12c4-12c8.log.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\03 - computer management.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\04-1 - networkstatus.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\05 - device manager.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\06 - systemabout.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\07 - event viewer.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\08 - powerandsleep.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\09 - mobility center.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group2\1 - run.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group1\desktop.ini.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\04 - disk management.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group2\4 - control panel.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group2\3 - windows explorer.lnk.enc
%LOCALAPPDATA%\microsoft\windows\winx\group1\1 - desktop.lnk.enc
%LOCALAPPDATA%\microsoft\windows\webcache\v01res00002.jrs.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\update_2024-03-11_204239_1584-1588.log.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\update_2024-03-11_204706_138c-1390.log.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\update_2024-03-11_205133_1180-1184.log.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\usertelemetrycache.otc.session.enc
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\10 - appsandfeatures.lnk.enc
%LOCALAPPDATA%\microsoft\windows\1033\structuredqueryschema.bin.enc
%LOCALAPPDATA%\microsoft\windows\burn\burn\desktop.ini.enc
%LOCALAPPDATA%\microsoft\windows\winx\group3\desktop.ini.enc
%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog.etl.enc
%LOCALAPPDATA%\microsoft\windows\powershell\startupprofiledata-noninteractive.enc
%LOCALAPPDATA%\microsoft\windows\upps\upps.bin.enc
%LOCALAPPDATA%\microsoft\windows\webcache\v01.chk.enc
%LOCALAPPDATA%\microsoft\windows\webcache\v0100002.log.enc
%LOCALAPPDATA%\microsoft\windows\webcache\v01res00001.jrs.enc
%LOCALAPPDATA%\microsoft\windows\application shortcuts\desktop.ini.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\parenttelemetrycache.otc.session.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\install_2022-09-29_021812_1108-110c.log.enc
%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\update_2022-09-29_023914_124c-92c.log.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\02bf309dd4f8607189fe0dca000de3bb6fa904fc.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\1e3866b584d906dd8cb8840ab2070142e2dea38a.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\b6f59826b025251e088e4743f506708a83bd73b9.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\ba59279cc6cfd1073638f657233f1d59e22b0b47.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\bc9a334d14ae8d5cdcf1f5f5128ba1f4cdd083ac.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\be13857faf251cca8c4ae07311778b6623ef86dc.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\c982342375c355a44c213031eeac97222e1367e1.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\cb0f935802b4851449f3b8237b8266958ac78cd9.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\cda62003b1b987a64f1fac75d1484dbff94f08fb.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\8af5d98ea49bfc5f75dbbb8cbe9cadf11b63e0f4.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\d0ed2eaa2bb547ad2b2a4e6eaed8931f54b6c8ec.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\da76b79079afe902f6d84d2c355f3a31eb94a2cc.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\e2e2db2f02258a8f9fef833aa106b9511b475d18.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\e66f5aa5e3c285c270cf84bd11111c74d38f245c.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\e8d08dad0fb6e27145709a42880f6c81f3be873a.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\ff63a96cb0ee05c4e8600cafada617eba0bab35d.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\startupcache\scriptcache-child-current.bin.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\9e1d439e9fec377d1d300f0bb70c5b1b488629fc.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\9648808b6c63cd1aad97a7b68f84f35c95682143.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\af76a431b3d2562471daa5ecb5576270e8811aad.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\90e321ee94230dcdbdcd2ec0b77c695a4fc21f78.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\nso-za\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\1fdfad88d4d4bec841f94d60559e38c0eb12ca0e.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\2cb84dd9abb4e1485d83397c59b193094e1abfc7.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\38ff788a718c79ddc3d1e23eaa975517d9ba3bb0.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\39c846d83ede3d926098e607ba5323965237edbe.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\39d80535a21e286b3c662765c5f09aceb927e77d.enc
%LOCALAPPDATA%\microsoft\windows sidebar\settings.ini.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\3de122af51e9c396743da36d6f24fc9288ba6d86.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\0f1372ef54aefb9b255f264a2377a89bf40b3a74.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\a72798def4f924983d5a0db82d383c613b515ff2.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\606b8f565718b076f7f0a603dea9a9b455a0a2be.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\7943793ad6ef12ca229a1df7a721b44c210bbc82.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\82c47fa9f5f29d08908329a836215460fd85b37b.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\82ef551019af0cb668c1cd4347b68bbc2b8be2b4.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\89c9b59023c6004c5fca8e641b2bd533baa7f06e.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\89f2f7b5ac6c606ca6223b1c39fb4ed3a611b5c0.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\47271f11cc1a31e4d0ce799ced096600866c1c1f.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\install-peruser_2022-09-29_021831_1390-1394.log.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\6af906b1b92a0da930fd3260c31b06e4279233b0.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\6b77741463c7abec909766d11225a40d4ee23a68.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\install-peruser_2022-09-29_021515_5a8-e10.log.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\install-peruser-2022-09-29.0218.5008.1.odl.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\scrollindicator.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\extras\qmldir.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\layouts\plugins.qmltypes.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\layouts\qmldir.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\templates.2\plugins.qmltypes.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\templates.2\qmldir.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\window.2\plugins.qmltypes.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\window.2\qmldir.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\sk\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick.2\plugins.qmltypes.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\quc\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\quz-pe\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ro\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ru\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\rw\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\scrollbar.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\qmldir.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\progressbar.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\extras\plugins.qmltypes.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\popup.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\or-in\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\pa\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\pl\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\prs-af\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\pt-br\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\pt-pt\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\fabexmdl2.ttf.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\sd-arab-pk\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls\styles\qmldir.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\button.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick.2\qmldir.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\checkbox.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\dialogbuttonbox.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\label.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\menu.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\menuitem.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\plugins.qmltypes.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls\styles\flat\qmldir.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\si-lk\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\pa-arab-pk\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\dialog.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qml\qtquick\controls.2\scrollview.qml.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\sl\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\zh-cn\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\zu-za\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\logs\personal\syncengine-2024-03-11.2042.5508.1.odl.enc
%LOCALAPPDATA%\microsoft\onedrive\logs\personal\syncengine-2024-03-11.2047.5004.1.odl.enc
%LOCALAPPDATA%\microsoft\onedrive\logs\personal\syncengine-2024-03-11.2051.4480.1.aodl.enc
%LOCALAPPDATA%\microsoft\onedrive\logs\personal\telemetrycache.otc.session.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\xh-za\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\logs\personal\tracearchive.0107.0005-2.etl.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\yo-ng\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\zh-tw\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\logs\personal\tracearchive.0107.0005-4.etl.enc
%LOCALAPPDATA%\microsoft\onedrive\settings\personal\global.ini.enc
%LOCALAPPDATA%\microsoft\onedrive\settings\personal\loguploadersettings.ini.enc
%LOCALAPPDATA%\microsoft\onedrive\settings\personal\loguploadersettings_temp.ini.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\install-2022-09-29.0218.4360.1.odl.enc
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\install-peruser-2022-09-29.0215.1448.1.odl.enc
%LOCALAPPDATA%\microsoft\onedrive\logs\personal\tracearchive.0107.0005-3.etl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\12_all_video.wpl.enc
%LOCALAPPDATA%\microsoft\onedrive\logs\personal\tracecurrent.0107.0005.etl.enc
%LOCALAPPDATA%\microsoft\onedrive\settings\personal\assertinformation.ini.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\saveapplicationeventlogs.wsf.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\wo\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\sq\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\sr-cyrl-rs\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\sr-latn-rs\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\sv\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\sw\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ta\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\te\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\vi\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\tg\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\uz-latn-uz\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ti\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\tn-za\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\tr\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\tt\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ug\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\uk\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ur\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\th\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\sr-cyrl-ba\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\tk-tm\filesync.localizedresources.dll.mui.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\11_all_pictures.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\10_all_music.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\09_music_played_the_most.wpl.enc
%LOCALAPPDATA%\google\chrome\user data\default\network action predictor.enc
%LOCALAPPDATA%\google\chrome\user data\default\network action predictor-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\preferences.enc
%LOCALAPPDATA%\google\chrome\user data\default\quotamanager.enc
%LOCALAPPDATA%\google\chrome\user data\default\quotamanager-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\readme.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\tr.pak.enc
%LOCALAPPDATA%\google\chrome\user data\default\secure preferences.enc
%LOCALAPPDATA%\google\chrome\user data\default\shortcuts-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\top sites.enc
%LOCALAPPDATA%\google\chrome\user data\default\top sites-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\visited links.enc
%LOCALAPPDATA%\google\chrome\user data\default\web data.enc
%LOCALAPPDATA%\google\chrome\user data\default\web data-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\history provider cache.enc
%LOCALAPPDATA%\google\chrome\user data\default\history.enc
%LOCALAPPDATA%\google\chrome\user data\default\shortcuts.enc
%LOCALAPPDATA%\google\chrome\user data\default\login data-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\login data.enc
%LOCALAPPDATA%\google\chrome\user data\default\google profile.ico.enc
%LOCALAPPDATA%\google\chrome\user data\default\favicons-journal.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\zh-tw.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\pepperflash\manifest.json.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\visualelements\logo.png.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\visualelements\smalllogo.png.enc
%LOCALAPPDATA%\google\chrome\user data\first run.enc
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_0.enc
%LOCALAPPDATA%\google\chrome\user data\local state.enc
%LOCALAPPDATA%\google\chrome\user data\safe browsing cookies-journal.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\te.pak.enc
%LOCALAPPDATA%\google\chrome\user data\default\chromedwritefontcache.enc
%LOCALAPPDATA%\google\chrome\user data\default\cookies-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\current session.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension cookies.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension cookies-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\favicons.enc
%LOCALAPPDATA%\google\chrome\user data\safe browsing cookies.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\vi.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\uk.pak.enc
%LOCALAPPDATA%\google\chrome\user data\default\cookies.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\zh-cn.pak.enc
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_1.enc
%LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_3.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\manifest.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png.enc
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\000003.log.enc
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\current.enc
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\lock.enc
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\log.enc
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\manifest-000001.enc
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_2.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\000003.log.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\lock.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\manifest.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\log.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension state\000003.log.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension state\current.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension state\lock.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension state\log.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension state\manifest-000001.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\current.enc
%LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db.enc
%LOCALAPPDATA%\google\chrome\user data\default\cache\index.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\manifest-000001.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\th.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ta.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fa.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\nacl_irt_x86_32.nexe.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\nacl_irt_x86_64.nexe.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\natives_blob.bin.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\resources.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\secondarytile.png.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\snapshot_blob.bin.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\docs.crx.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\bg.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\drive.crx.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\gmail.crx.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\search.crx.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\youtube.crx.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\extensions\external_extensions.json.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\am.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_100_percent.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\47.0.2526.106.manifest.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\icudtl.dat.enc
%LOCALAPPDATA%\google\chrome\application\debug.log.enc
%LOCALAPPDATA%\google\chrome\application\chrome.visualelementsmanifest.xml.enc
%HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp.enc
%LOCALAPPDATA%\iconcache.db.enc
%LOCALAPPDATA%\comms\unistore\data\aggregatecache.uca.enc
%LOCALAPPDATA%\comms\unistoredb\store.jfm.enc
%LOCALAPPDATA%\comms\unistoredb\store.vol.enc
%LOCALAPPDATA%\comms\unistoredb\uss.jcp.enc
%LOCALAPPDATA%\comms\unistoredb\uss.jtx.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ar.pak.enc
%LOCALAPPDATA%\comms\unistoredb\ussres00001.jrs.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\external_extensions.json.enc
%LOCALAPPDATA%\comms\unistoredb\usstmp.jtx.enc
%LOCALAPPDATA%\connecteddevicesplatform\connected devices platform certificates.sst.enc
%LOCALAPPDATA%\connecteddevicesplatform\l.user.cdp.enc
%LOCALAPPDATA%\connecteddevicesplatform\l.user.cdpresource.enc
%LOCALAPPDATA%\connecteddevicesplatform\l.user\activitiescache.db.enc
%LOCALAPPDATA%\connecteddevicesplatform\l.user\activitiescache.db-shm.enc
%LOCALAPPDATA%\connecteddevicesplatform\l.user\activitiescache.db-wal.enc
%LOCALAPPDATA%\comms\unistoredb\ussres00002.jrs.enc
%HOMEPATH%\3d objects\desktop.ini.enc
%LOCALAPPDATA%\connecteddevicesplatform\cdpglobalsettings.cdp.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_200_percent.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\bn.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ko.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\lv.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ml.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\mr.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ms.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\nb.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\nl.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\kn.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ca.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\lt.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\pl.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ru.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sk.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sl.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sr.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sv.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sw.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\pt-br.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\pt-pt.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ro.pak.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\startupcache\scriptcache-child.bin.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\messages.json.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\id.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\da.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\de.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\el.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\en-gb.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\en-us.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\es-419.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\es.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\it.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ja.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\et.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fil.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fr.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\gu.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\he.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\hi.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\hr.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\hu.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\cs.pak.enc
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fi.pak.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cache2\entries\d6b0add0daea00708cbb4290b85cca0e0fa79061.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\manifest.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\session storage\log.enc
%LOCALAPPDATA%\google\chrome\user data\default\session storage\manifest-000001.enc
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\powershell.exe.log.enc
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.enc
%LOCALAPPDATA%\microsoft\internet explorer\ie4uinit-cleariconcache.log.enc
%LOCALAPPDATA%\microsoft\internet explorer\ie4uinit-userconfig.log.enc
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\f6a1.tmp.enc
%LOCALAPPDATA%\microsoft\internet explorer\domainsuggestions\en-us.1.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\02_music_added_in_the_last_month.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\03_music_rated_at_4_or_5_stars.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\04_music_played_in_the_last_month.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\05_pictures_taken_in_the_last_month.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\06_pictures_rated_4_or_5_stars.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\07_tv_recorded_in_the_last_week.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\08_video_rated_at_4_or_5_stars.wpl.enc
%LOCALAPPDATA%\google\chrome\user data\default\session storage\000003.log.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00034855\01_music_auto_rated_at_5_stars.wpl.enc
%LOCALAPPDATA%\google\chrome\user data\default\session storage\lock.enc
%LOCALAPPDATA%\google\chrome\user data\default\session storage\current.enc
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\f6b1.tmp.enc
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\6c05.tmp.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\6c04.tmp.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\history-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\manifest.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\manifest.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\messages.json.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\startupcache\scriptcache-current.bin.enc

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'gs##tic.com':80
'si#######oyer.altervista.org':80

TCP

HTTP GET requests

http://www.gs##tic.com/generate_204

Other

'si#######oyer.altervista.org':80

UDP

DNS ASK gs##tic.com
DNS ASK si#######oyer.altervista.org

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial