Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'BrowserUpdateCheck' = '%LOCALAPPDATA%\<File name>.exe'
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\toolbar.bmp
Modifies file system
Creates the following files
- %LOCALAPPDATA%\<File name>.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\pfm\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\how_to_back_files.html
- %ProgramFiles(x86)%\steam\logs\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\versions\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\root\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\how_to_back_files.html
- %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\how_to_back_files.html
- %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\how_to_back_files.html
- %ProgramFiles(x86)%\microsoft office\office14\1033\how_to_back_files.html
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\how_to_back_files.html
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\how_to_back_files.html
- %ProgramFiles(x86)%\msbuild\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\how_to_back_files.html
- %ProgramFiles(x86)%\steam\public\how_to_back_files.html
- %ProgramFiles(x86)%\steam\how_to_back_files.html
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\how_to_back_files.html
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how_to_back_files.html
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\how_to_back_files.html
- %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\how_to_back_files.html
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\how_to_back_files.html
- %APPDATA%\thunderbird\crash reports\how_to_back_files.html
- %APPDATA%\telegram desktop\how_to_back_files.html
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\how_to_back_files.html
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\how_to_back_files.html
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\how_to_back_files.html
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\how_to_back_files.html
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\how_to_back_files.html
- %HOMEPATH%\favorites\links for united states\how_to_back_files.html
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\how_to_back_files.html
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\how_to_back_files.html
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\how_to_back_files.html
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\how_to_back_files.html
- %APPDATA%\mozilla\firefox\crash reports\how_to_back_files.html
- %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\how_to_back_files.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\how_to_back_files.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\how_to_back_files.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\how_to_back_files.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\how_to_back_files.html
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\how_to_back_files.html
- %APPDATA%\thunderbird\profiles\hmz1jddi.default\how_to_back_files.html
- %HOMEPATH%\contacts\how_to_back_files.html
- %HOMEPATH%\desktop\how_to_back_files.html
- %HOMEPATH%\favorites\links\how_to_back_files.html
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\how_to_back_files.html
- %HOMEPATH%\favorites\microsoft websites\how_to_back_files.html
- %HOMEPATH%\favorites\msn websites\how_to_back_files.html
- %HOMEPATH%\favorites\windows live\how_to_back_files.html
- %HOMEPATH%\links\how_to_back_files.html
- %HOMEPATH%\searches\how_to_back_files.html
- D:\how_to_back_files.html
- C:\users\public\7efa39a4b91cf6dc3bf9a480e97381ede96575bbdccd16de4170b3ba2e7c3aa2
- %LOCALAPPDATA%low\sun\java\deployment\how_to_back_files.html
- %LOCALAPPDATA%low\oracle\java\au\how_to_back_files.html
- %LOCALAPPDATA%\how_to_back_files.html
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\how_to_back_files.html
- C:\users\public\recorded tv\sample media\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\how_to_back_files.html
- C:\users\public\videos\sample videos\how_to_back_files.html
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\entries\how_to_back_files.html
- %TEMP%\how_to_back_files.html
- %TEMP%\opera installer\how_to_back_files.html
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\how_to_back_files.html
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\offlinecache\how_to_back_files.html
- %LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\how_to_back_files.html
- C:\users\public\pictures\sample pictures\how_to_back_files.html
- C:\users\public\music\sample music\how_to_back_files.html
- C:\users\public\libraries\how_to_back_files.html
- C:\users\public\desktop\how_to_back_files.html
- C:\users\default\how_to_back_files.html
- %ALLUSERSPROFILE%\sun\java\java update\how_to_back_files.html
- %ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\how_to_back_files.html
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\how_to_back_files.html
Moves the following files
- from %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json to %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.itlock4
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl.itlock4
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1250.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1250.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1251.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1251.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1252.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1252.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1253.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1253.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1254.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1254.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1257.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1257.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1258.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1258.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\centeuro.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\centeuro.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\corpchar.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\corpchar.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\croatian.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\croatian.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\cyrillic.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\cyrillic.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-boldit.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-boldit.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\greek.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\greek.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\roman.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\roman.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\romanian.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\romanian.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\symbol.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\symbol.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\turkish.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\turkish.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\ukraine.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\ukraine.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\symbol.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\symbol.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\zdingbat.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\zdingbat.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-oblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-oblique.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd.otf.itlock4
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl.itlock4
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\iceland.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\iceland.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-bold.otf.itlock4
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as90.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as90.xsl.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_german.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_german.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_greek.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_greek.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_hungarian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_hungarian.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_italian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_italian.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_japanese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_japanese.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_korean.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_korean.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_koreana.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_koreana.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_latam.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_latam.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_norwegian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_norwegian.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_polish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_polish.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_portuguese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_portuguese.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_romanian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_romanian.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_russian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_russian.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_schinese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_schinese.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_spanish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_spanish.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_swedish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_swedish.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_tchinese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_tchinese.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_thai.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_thai.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_turkish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_turkish.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_ukrainian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_ukrainian.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_vietnamese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_vietnamese.txt.itlock4
- from %ProgramFiles(x86)%\steam\logs\bootstrap_log.txt to %ProgramFiles(x86)%\steam\logs\bootstrap_log.txt.itlock4
- from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.itlock4
- from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.itlock4
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll.itlock4
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll.itlock4
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as80.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as80.xsl.itlock4
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\informix.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\informix.xsl.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_finnish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_finnish.txt.itlock4
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-it.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-it.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\selector.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\selector.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-regular.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-regular.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\myriadpro-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\myriadpro-bold.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\myriadpro-it.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\myriadpro-it.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\myriadpro-regular.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\myriadpro-regular.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\sy______.pfb to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\sy______.pfb.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\zx______.pfb to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\zx______.pfb.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\zy______.pfb to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\zy______.pfb.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\pfm\sy______.pfm to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\pfm\sy______.pfm.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\pfm\zx______.pfm to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\pfm\zx______.pfm.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\pfm\zy______.pfm to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\pfm\zy______.pfm.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_english.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_english.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\init.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\init.js.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_french.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_french.txt.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\variant.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\variant.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\config.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\config.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\desktop.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\desktop.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\rna-main.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\rna-main.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\versions\framework-dev.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\versions\framework-dev.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\ui-strings.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\plugins.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\plugins.js.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\myriadpro-boldit.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\myriadpro-boldit.otf.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\version.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\version.js.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_dutch.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_dutch.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_danish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_danish.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_czech.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_czech.txt.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4.itlock4
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.itlock4
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\ui-strings.js.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4.itlock4
- from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.itlock4
- from %TEMP%\dd_vcredist_x86_20230912171936.log to %TEMP%\dd_vcredist_x86_20230912171936.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912172157.log to %TEMP%\dd_vcredist_x86_20230912172157.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912172224.log to %TEMP%\dd_vcredist_x86_20230912172224.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912172322.log to %TEMP%\dd_vcredist_x86_20230912172322.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912172350.log to %TEMP%\dd_vcredist_x86_20230912172350.log.itlock4
- from %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt to %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json.itlock4
- from %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt to %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.itlock4
- from %TEMP%\jusched.log to %TEMP%\jusched.log.itlock4
- from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.itlock4
- from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.itlock4
- from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.itlock4
- from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.itlock4
- from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.itlock4
- from %TEMP%\rgia609.tmp to %TEMP%\rgia609.tmp.itlock4
- from %TEMP%\rgia609.tmp-tmp to %TEMP%\rgia609.tmp-tmp.itlock4
- from %TEMP%\setupexe(202309121734336dc).log to %TEMP%\setupexe(202309121734336dc).log.itlock4
- from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.itlock4
- from %ProgramFiles(x86)%\steam\steam.cfg to %ProgramFiles(x86)%\steam\steam.cfg.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_brazilian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_brazilian.txt.itlock4
- from %ProgramFiles(x86)%\steam\public\steambootstrapper_bulgarian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_bulgarian.txt.itlock4
- from %TEMP%\dd_vcredist_x86_20230912171759.log to %TEMP%\dd_vcredist_x86_20230912171759.log.itlock4
- from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log.itlock4
- from %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log.itlock4
- from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.itlock4
- from %TEMP%\adobearm.log to %TEMP%\adobearm.log.itlock4
- from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.itlock4
- from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.itlock4
- from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.itlock4
- from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.itlock4
- from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.itlock4
- from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.itlock4
- from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.itlock4
- from %TEMP%\dd_vcredistmsi12db.txt to %TEMP%\dd_vcredistmsi12db.txt.itlock4
- from %TEMP%\dd_vcredistui12db.txt to %TEMP%\dd_vcredistui12db.txt.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912171641.log to %TEMP%\dd_vcredist_amd64_20230912171641.log.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log.itlock4
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2024-04-01_11_w-7ab47btxtewdh4a2yehg==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2024-04-01_11_w-7ab47btxtewdh4a2yehg==.jsonlz4.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912171735.log to %TEMP%\dd_vcredist_amd64_20230912171735.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912171824.log to %TEMP%\dd_vcredist_amd64_20230912171824.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912172034.log to %TEMP%\dd_vcredist_amd64_20230912172034.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912172134.log to %TEMP%\dd_vcredist_amd64_20230912172134.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912172247.log to %TEMP%\dd_vcredist_amd64_20230912172247.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912172315.log to %TEMP%\dd_vcredist_amd64_20230912172315.log.itlock4
- from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json.itlock4
- from %TEMP%\dd_vcredist_x86_20230912171710.log to %TEMP%\dd_vcredist_x86_20230912171710.log.itlock4
- from %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log.itlock4
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js.itlock4
Modifies the following files
- D:\install.log
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\favorites\links\web slice gallery.url
- %HOMEPATH%\favorites\links for united states\usa.gov.url
- %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url
- %HOMEPATH%\favorites\microsoft websites\microsoft store.url
- %HOMEPATH%\favorites\microsoft websites\microsoft at work.url
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url
- %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url
- %HOMEPATH%\favorites\msn websites\msnbc news.url
- %HOMEPATH%\favorites\msn websites\msn.url
- %HOMEPATH%\favorites\msn websites\msn sports.url
- %HOMEPATH%\favorites\msn websites\msn money.url
- %HOMEPATH%\favorites\msn websites\msn entertainment.url
- %HOMEPATH%\favorites\msn websites\msn autos.url
- %HOMEPATH%\favorites\windows live\windows live spaces.url
- %HOMEPATH%\favorites\windows live\windows live mail.url
- %HOMEPATH%\favorites\windows live\windows live gallery.url
- %HOMEPATH%\favorites\windows live\get windows live.url
- %HOMEPATH%\links\recentplaces.lnk
- %HOMEPATH%\links\downloads.lnk
- %HOMEPATH%\links\desktop.lnk
- %HOMEPATH%\searches\indexed locations.search-ms
- %HOMEPATH%\searches\everywhere.search-ms
- <Drive name for removable media>:\correct.avi
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\google chrome.lnk
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
