Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini
Modifies file system
Moves the following files
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\2tjfzmpgz9mew8tdencrypted
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\w8tz3svgxtmew8tdencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\0t_g2d7f2m-ewnnfxa==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\3c_iy9ra2dnexdjphnnbxspezw==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\times.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\3sphz9mewnnfxa==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\2d7f2mvnz4tz28bd3s8=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\mzkdmpubmj2yntjzz83hxmxd3t7p3ofp2ytz28bd3s8=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\hmfp3svoy97lh9yyencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\2c_z2cpfxoncz8nb2sxdxn7zhmdzxcq=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\2c_l2mnchmdzxcsex8xqxtceencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\z8uzym6zz8-hm5mtmieenzpmh8vimcmhmz3myjqfmp-ak8meencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\nz6azjyfy8mhnmmtmieekpyah8uemzmhn8mey8nim87mnpisencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\n8zik5mfzpkhncnonoeems_ph8vpz8ihzmzonzqznc6dyzkzencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\2tjpznmewnk=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\2sblyc_zhnnbxspezw==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\2shj2zubhn7s3g==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\2s_yx8pz2cpfxnme2dvgw97pencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\parent.lock to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\2svyz8tehmbfyce=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xdrpxnrn2otz28bd3s8=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\mailviews.dat to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\x8vdxvzdz93zhm7l3g==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\key4.db to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\wc_tnotoya==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\wspz3sxy04tz28bd3s8=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\zcbfymvgh8fp2dnlzc_zh87ihnnbxspezw==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\zmxyx8ld2d7f2noe2dvgw97pencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\zmvcw8nfxnme2dvgw97pencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\z9lez8tzw8xe2yta2cxeencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\z9lez8tzw8xeh9ryz8zp2m_eyc_zhmdzxcq=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\z8tdzcflw8ae2dvgw97pencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\zspyz8nexdjt_tjpz4ta2cxeencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\2d7l3s-ewnnfxa==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\2c_z2cpfxifz3svez4ta2cxeencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\m52ymz6ynzusnjmcnysfzmitmz_okoedyc6eh56az8-hy8_pyifmzm6dmpmdzp3jkpmezmpy2d6h2clf3s7f3csewnnfxmbqng==encryp...
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\m52ymz6ynzusnjmcnotpy5nizpnpz4ebmzoyh56dk8yhy8izyyeznczimp-an5qtyz6ex8vdxita2cxextceencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\m52ymz6ynzusnjqynysdnprmnj_lyyecyzoyh56snjqhy56zmyefyz7lycibzsyemjkexm_dh9ryxczdxs-ewnnfxmbqng==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\2d7f2m-ewnnfxithxddg0j4=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\ycxfwcpp2ytz28bd3s8=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\ycxh2svew8jdxspe04tdxmm=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cert9.db to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\yc_y3poezsg=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\ymbd2d6e2dvgw97pencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addons.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\y87oxctzhmdzxcq=encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\y87oxct53svy3t_ahmdzxcsextceencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\y8jfxcge2dvgw97pencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\-cpez_npyd_yw97t-c_y3mpjz_ney97phn7s3g==encrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\-c_j39jd3tp62m_gxcvo-d7l3s-e3tleencrypted
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\68bez9jey97p-c_y3mpjz9me3tleencrypted
- from %APPDATA%\thunderbird\profiles\b376zl1q.default\times.json to %APPDATA%\thunderbird\profiles\b376zl1q.default\3sphz9mewnnfxa==encrypted
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\48tz3svgxv7dx8-ympibmp6anjiympyymw==encrypted
- from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\38tdxnmampqez9lpencrypted
- from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\38tdxnmampqezsveencrypted
- from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\_9roy97p2itp0s8=encrypted
- from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\_s_gz83yy8eez9lpencrypted
- from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\39roy97p9dryz8zzhmdzxcq=encrypted
- from %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip to %APPDATA%\opera software\opera stable\themes_backup\xsveztnjy9rp9drcxd7fhndd2g==encrypted
- from %APPDATA%\opera software\opera stable\ssdfp1252.6.1555693585 to %APPDATA%\opera software\opera stable\2dnoznqbmj-yhjyem5-fn5ytmz-snw==encrypted
- from %APPDATA%\opera software\opera stable\ssdfp1252.0.1802400714 to %APPDATA%\opera software\opera stable\2dnoznqbmj-yhjqem5kamj6amp2bng==encrypted
- from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\xdrp2mv1y9_exd_azsvez4tgxc0=encrypted
- from %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml to %APPDATA%\opera software\opera stable\dictionaries\zspj3spfxmvyw8_zhnlhxg==encrypted
- from %APPDATA%\opera software\opera stable\default_partner_content.json to %APPDATA%\opera software\opera stable\zs_my9_g3vxay9jexm_y9cnfxn7pxn6ewnnfxa==encrypted
- from %APPDATA%\opera software\opera stable\web data-journal to %APPDATA%\opera software\opera stable\_c_iiu7l3suhwmxf2mtlxg==encrypted
- from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\_c_iiu7l3ss=encrypted
- from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\_mpzw97pzormw8tb2q==encrypted
- from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\_tjlxnnaxdje-c_j39jd3tm=encrypted
- from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\-tjpzm_yz8tjz9k=encrypted
- from %APPDATA%\opera software\opera stable\network persistent state to %APPDATA%\opera software\opera stable\5m_e3cxywyr6z9jzw9nez8teivney97pencrypted
- from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\5sxnw8sk7svey4faxd_yxmvgencrypted
- from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\5sxnw8sk7sveyw==encrypted
- from %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\yclyxcfp9dney9je2svnz_wahmbfycvg2d7f2mvnz4faxd_yxmvgencrypted
- from %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\yclyxcfp9dney9je2svnz_wahmbfycvg2d7f2mvnzw==encrypted
- from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\5sxjy8ak-d7l3s8=encrypted
- from %APPDATA%\opera software\opera stable\jump list icons\b440.tmp to %APPDATA%\opera software\opera stable\jump list icons\6j6emotex9o=encrypted
- from %APPDATA%\opera software\opera stable\jump list icons\b43f.tmp to %APPDATA%\opera software\opera stable\jump list icons\6j6z7itex9o=encrypted
- from %APPDATA%\opera software\opera stable\jump list icons\b43e.tmp to %APPDATA%\opera software\opera stable\jump list icons\6j6z74tex9o=encrypted
- from %APPDATA%\opera software\opera stable\jump list icons\b42e.tmp to %APPDATA%\opera software\opera stable\jump list icons\6j6y74tex9o=encrypted
- from %APPDATA%\opera software\opera stable\jump list icons\b42d.tmp to %APPDATA%\opera software\opera stable\jump list icons\6j6y7otex9o=encrypted
- from %APPDATA%\opera software\opera stable\jump list icons\b42c.tmp to %APPDATA%\opera software\opera stable\jump list icons\6j6y6ytex9o=encrypted
- from %APPDATA%\opera software\opera stable\jump list icons\b42b.tmp to %APPDATA%\opera software\opera stable\jump list icons\6j6y6itex9o=encrypted
- from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\4spz3sxy04faxd_yxmvgencrypted
- from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\4spz3sxy0w==encrypted
- from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\7mvcw8nfxnmhwmxf2mtlxg==encrypted
- from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\7mvcw8nfxnk=encrypted
- from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\5-vk4-zv-f6hmpqampqbencrypted
- from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\5uxtencrypted
- from %APPDATA%\opera software\opera stable\extension state\lock to %APPDATA%\opera software\opera stable\extension state\5uxp4q==encrypted
- from %APPDATA%\opera software\opera stable\extension state\current to %APPDATA%\opera software\opera stable\extension state\6f_4-o_k_g==encrypted
- from %APPDATA%\opera software\opera stable\extension state\000003.log to %APPDATA%\opera software\opera stable\extension state\mpqampqzhmbfzq==encrypted
- from %APPDATA%\opera software\opera stable\current session to %APPDATA%\opera software\opera stable\6d_y2m_e3or5z9nzw8xeencrypted
- from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\6mxfwcfl2mhzencrypted
- from %APPDATA%\opera software\opera stable\91bb.tmp to %APPDATA%\opera software\opera stable\k5vo6itex9o=encrypted
- from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\2tjfzmpgz9mew8tdencrypted
- from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\w8tz3svgxtmew8tdencrypted
- from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\39np2ita2q==encrypted
- from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\times.json to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\3sphz9mewnnfxa==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\0t_g2d7f2m-ewnnfxa==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\39np2ita2q==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\3sphz9mewnnfxa==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\mzkdmpubmj2yntjzz83hxmxd3t7p3ofp2ytz28bd3s8=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\mz-cm5iskpkek9nowsbdz4tz28bd3s8=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\mjobkpqcmzmcn9rd39rzy8ke2dvgw97pencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\mjkymzmbkp2dnctexd_yxcfgy8bexc7y04ehxmvfzotz28bd3s8=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\m5yfnzubnp-tn-vhycvez8py3n7d-d7thnnbxspezw==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\m56fm5mbkpkckstexd_yxcfgy8bexc7y04ehz9rj2itz28bd3s8=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\hmfp3svoy97lh9yyencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\mzyenziymjoym93gz8viye_f0sbeh8_pxm3...
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\hmfp3svoy97lh9yyencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\2cldz8boh9ryz8zp2m_eyc-hz9laz9jdx8_e3tmewnnfxa==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\39rn2mvoz4ta2cxextceh5iamjuakpizm5izkp-cencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\2m_jxdzp2noewnnfxmbqng==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\2m_jxdzp2noeymvbxtceencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\2tjp3mpf39mewnnfxmbqng==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\2c_z2cpfxoncz8nb2sxdxn7zhmdzxcq=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\2c_l2mnchmdzxcsex8xqxtceencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\f25f5a62-89ef-4fa6-bcd1-17fb20e245e0 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\zjifzj_lnjihkpppzieezmuch8jjzpuhm53myjiaz5ien8-aencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\df151785-6317-4a9b-a34f-33db9e13ed66 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\zsybn5udkp-hnjmbnyeey5pih8uznsyhmznoyjppm5npzpycencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\bf64c134-4580-4cec-a821-b1c0a18188bf to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\ymycnsmbmz6hnp-smoeeyc_jh8usmjuhyjvjmsubkpusksjmencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\607ca866-e4d6-4cd9-8292-f41050b95703 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\njqdycusnjyhz57onieeyc6th5kyk5ihzj6bmp-ayjofnzqzencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\2tjpznmewnk=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\2shj2zubhn7s3g==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\wsvezsbp2nmewnnfxa==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\zmxyx8ld2d7f2noe2dvgw97pencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\z9lez8tzw8xe2yta2cxeencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\z9lez8tzw8xeh9ryz8zp2m_eyc_zhmdzxcq=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\2d7l3s-ewnnfxa==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\2c_z2cpfxifz3svez4ta2cxeencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\data.safe.bin to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\zsvey4tzy8zphmjdxa==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186304.df151785-6317-4a9b-a34f-33db9e13ed66.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\m52ymz6ynzusnjmanotozjufm52sn4ecmzudh57lk8ihy5meziezmc7ik8-bmc_onjyezmpy2d6h2clf3s7f3csewnnfxmbqng==en...
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186300.bf64c134-4580-4cec-a821-b1c0a18188bf.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\m52ymz6ynzusnjmamotizjyeyzuznoeen5kah57jz8mhy5kym4fim8may5usm5ksymyex8vdxita2cxextceencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186237.f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\m52ymz6ynzusnjiznytmmj_mn8ucmiesk8_mh57my5yhymnom4ebnczimjrpmj6fz5qez9zpxn6ewnnfxmbqng==encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186024.607ca866-e4d6-4cd9-8292-f41050b95703.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\m52ymz6ynzusnjqynoscmp3jy5kcnifpns6ch57jzpohkpitmifmnpuan5rik5-dmpmexm_dh9ryxczdxs-ewnnfxmbqng==encryp...
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\2d7f2m-ewnnfxithxddg0j4=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\ycxe3svdxm_y2yta2cxeencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\ycxh2svew8jdxspe04tdxmm=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\ynjfy87jy9neh8bd2d7pxm_y2yta2cxeencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\bookmarks-2025-10-27_11_kx2i12ignwmokjfhtrtlyq==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\ymxfwcfl2mhzh5iamj-hm5qhmj31m5v14dkyw5uy4-3k_cffwcdmwv7y3sbt-5exhmdzxctg0j4=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\y87oxctzhmdzxcq=encrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\y87oxct53svy3t_ahmdzxcsextceencrypted
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\-cpez_npyd_yw97t-c_y3mpjz_ney97phn7s3g==encrypted
- from %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856 to %APPDATA%\mozilla\firefox\crash reports\48tz3svgxv7dx8-ympibmpkymzuymzkfna==encrypted
- from %APPDATA%\Microsoft\Word\~WRA0003.wbk to %APPDATA%\microsoft\word\1p3465qampme3cjbencrypted
- from %APPDATA%\microsoft\windows\themes\transcodedwallpaper to %APPDATA%\microsoft\windows\themes\_tjlxnnjxc7pzv3lxsbay9rp2a==encrypted
- from %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg to %APPDATA%\microsoft\windows\themes\cachedfiles\6cvjws_o48flzc_1m5ufmpwsnj71-ux5mita2s0=encrypted
- from %APPDATA%\microsoft\windows\start menu\desktop.ini to %APPDATA%\microsoft\windows\start menu\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\windows powershell\windows powershell.lnk to %APPDATA%\microsoft\windows\start menu\programs\windows powershell\_cpezsxd2yr6xd3p2pncz8bghmbewq==encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\windows powershell\windows powershell (x86).lnk to %APPDATA%\microsoft\windows\start menu\programs\windows powershell\_cpezsxd2yr6xd3p2pncz8bgiolskpydhmbewq==encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\_cpe-ov4hmbewq==encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\_cpe-ov4islpxtqexstbencrypted
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\_cll3ord2yrez92kw8sk3slpisbl3s_z3orcz9jzw8xehmbewq==encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\6cxe2cxgz4r46_ikx8ve38vghmbewq==encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\_8tdxnney8bgiv7pxs_n2mvhhmbewq==encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\_s_gz83yy8eexstbencrypted
- from %APPDATA%\microsoft\windows\start menu\programs\system tools\computer.lnk to %APPDATA%\microsoft\windows\start menu\programs\system tools\ycxh2t_ez9iexstbencrypted
- from %APPDATA%\microsoft\windows\start menu\programs\system tools\run.lnk to %APPDATA%\microsoft\windows\start menu\programs\system tools\-n_ehmbewq==encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\system tools\file explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\system tools\7mpgz4rv0trgxdjp2itgxme=encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\system tools\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\system tools\7s_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\system tools\control panel.lnk to %APPDATA%\microsoft\windows\start menu\programs\system tools\6cxe3tjfxor6y8tpxotgxme=encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\system tools\command prompt.lnk to %APPDATA%\microsoft\windows\start menu\programs\system tools\6cxhx8vezor62mxh2t6exstbencrypted
- from %APPDATA%\microsoft\windows\start menu\programs\system tools\administrative tools.lnk to %APPDATA%\microsoft\windows\start menu\programs\system tools\687hw8td2d7yy97d3m-k_sxfxtmexstbencrypted
- from %APPDATA%\microsoft\windows\start menu\programs\onedrive.lnk to %APPDATA%\microsoft\windows\start menu\programs\5ctp7tjd3m-exstbencrypted
- from %APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\maintenance\7s_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk to %APPDATA%\microsoft\windows\start menu\programs\google chrome\7cxfzcbpiunc2mxhz4tgxme=encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\administrative tools\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\administrative tools\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\accessories\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\internet explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\48tez9jez96k79laxsxyz9iexstbencrypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessibility\desktop.ini to %APPDATA%\microsoft\windows\start menu\programs\accessibility\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessibility\on-screen keyboard.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessibility\5csh-cnyz8_eiuhp08jfy9johmbewq==encrypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessibility\narrator.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessibility\5mvy2mvexdiexstbencrypted
- from %APPDATA%\microsoft\windows\start menu\programs\accessibility\magnify.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessibility\58vnxmpm04tgxme=encrypted
- from %APPDATA%\microsoft\windows\sendto\desktop.ini to %APPDATA%\microsoft\windows\sendto\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail to %APPDATA%\microsoft\windows\sendto\58vdxor4z8nd2sppxn6e5-v64-flw8y=encrypted
- from %APPDATA%\microsoft\windows\sendto\fax recipient.lnk to %APPDATA%\microsoft\windows\sendto\7mvsivjpycpaw8_e3otgxme=encrypted
- from %APPDATA%\microsoft\windows\sendto\documents.mydocs to %APPDATA%\microsoft\windows\sendto\7sxj38fpxn7zhmftzsxj2q==encrypted
- from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\7s_zwd7f2oqcydjpy97pitncxdjeyd_eg4tuz9nb5spewq==encrypted
- from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\6cxh2tjp2dnpzoqc0mpa2s_og4rsxcboz9ie8oz5z8to_sx-y9jnz94=encrypted
- from %APPDATA%\microsoft\windows\sendto\bluetooth file transfer.lnk to %APPDATA%\microsoft\windows\sendto\6mbfz97fxd7ciuzdxs-k_tjlxnnmz9ie5uthencrypted
- from %APPDATA%\microsoft\windows\recent\desktop.ini to %APPDATA%\microsoft\windows\recent\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\f8f05350c84c9d76.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\zjlmmp-zn5rjkp7jk86dnitl397fx8vew8nuz9new8tl3spfxnmhx9k=encrypted
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\zjqbyj7ok5_jzj-fzpmyy4tl397fx8vew8nuz9new8tl3spfxnmhx9k=encrypted
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\6824f4a902c78fbd.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\njkynsyey5oammmdkszizotl397fx8vew8nuz9new8tl3spfxnmhx9k=encrypted
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\n8ydyj_mm8-am8ismz2cnytl397fx8vew8nuz9new8tl3spfxnmhx9k=encrypted
- from %APPDATA%\microsoft\windows\libraries\desktop.ini to %APPDATA%\microsoft\windows\libraries\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\_mpoz8xzhmbdynjl2nohx9k=encrypted
- from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\-spj3t_yz9mexspi2mvy04fh2q==encrypted
- from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\59_zw8mexspi2mvy04fh2q==encrypted
- from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\7sxj38fpxn7zhmbdynjl2nohx9k=encrypted
- from %APPDATA%\microsoft\windows\libraries\cameraroll.library-ms to %APPDATA%\microsoft\windows\libraries\6cvhz9jl-mxgxotgw8jyy9jth8fzencrypted
- from %APPDATA%\microsoft\windows\accountpictures\desktop.ini to %APPDATA%\microsoft\windows\accountpictures\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\uproof\custom.dic to %APPDATA%\microsoft\uproof\6f_5_uxnho7j6q==encrypted
- from %APPDATA%\Microsoft\Templates\~$Normal.dotm to %APPDATA%\microsoft\templates\1i7kxdjhy8aezsxexw==encrypted
- from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\5mxyx8vghm7f3sc=encrypted
- from %APPDATA%\microsoft\systemcertificates\my\appcontainerusercertread to %APPDATA%\microsoft\systemcertificates\my\69ra6cxe3svdxm_y_9np2onp2n74z8voencrypted
- from %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\-tjpzm_y2m_oencrypted
- from %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\4cb78560-74fe-4659-9bb4-b824fb26b8d7 to %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\nsninzkfnjqhnz7mz4eenj-th5piyj6hyjkynszimjziks6dencrypted
- from %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a to %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\mzljycydnp-hmm_oz4eemzqbh5kynpkhn8ubk8-bzjutmpvlencrypted
- from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\6fjv7ulj-f4=encrypted
- from %APPDATA%\microsoft\office\recent\index.dat to %APPDATA%\microsoft\office\recent\w8toz9kezsveencrypted
- from %APPDATA%\microsoft\office\recent\templates.lnk to %APPDATA%\microsoft\office\recent\_s_h2sbl3s_zhobk4q==encrypted
- from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\5_nlm5qzmytlycy=encrypted
- from %APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\rasphone.pbk to %APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\2mvz2slfxm-e2sjbencrypted
- from %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\_cpezsxdivndw97jws_yhmbewq==encrypted
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\zs_zwd7f2otdxmm=encrypted
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\microsoft edge.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\58pj2mxzxczeiu_ozc-exstbencrypted
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\file explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\7mpgz4rv0trgxdjp2itgxme=encrypted
- from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\-clf3dmk7s_zwd7f2otgxme=encrypted
- from %APPDATA%\microsoft\internet explorer\quick launch\microsoft edge.lnk to %APPDATA%\microsoft\internet explorer\quick launch\58pj2mxzxczeiu_ozc-exstbencrypted
- from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\7cxfzcbpiunc2mxhz4tgxme=encrypted
- from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\zj-sm5-fyj7im86fy5-ynsnlmpicm8mzz8-tk8zin5r1ksnmncifmzqhnjuzz4eemzpih8usyz-hycnmyzrpnz6fnpqaencrypted
- from %APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400 to %APPDATA%\microsoft\crypto\keys\zs-dycysy52tmpvommvom5npn8mcncmyk8-fzpucnjj1ksnmncifmzqhnjuzz4eemzpih8usyz-hycnmyzrpnz6fnpqaencrypted
- from %APPDATA%\microsoft\bibliography\style\turabian.xsl to %APPDATA%\microsoft\bibliography\style\_v_46-jj6-se8vnmencrypted
- from %APPDATA%\microsoft\bibliography\style\sist02.xsl to %APPDATA%\microsoft\bibliography\style\-ep5_pqyhpl55g==encrypted
- from %APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl to %APPDATA%\microsoft\bibliography\style\5-br-c_cz8tewu_ow97dxctlzmzdyc_lxmbdxm-e0tngencrypted
- from %APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl to %APPDATA%\microsoft\bibliography\style\4_nlnjoa5mfp2mpjy8ae8vnmencrypted
- from %APPDATA%\microsoft\bibliography\style\iso690.xsl to %APPDATA%\microsoft\bibliography\style\4_nlnjoahpl55g==encrypted
- from %APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl to %APPDATA%\microsoft\bibliography\style\4-_v75iampzlzmzdyc_lxmbdxm-e0tngencrypted
- from %APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl to %APPDATA%\microsoft\bibliography\style\4svy3mvyzuvezcbdy5iampllzmzdyc_lxmbdxm-e0tngencrypted
- from %APPDATA%\microsoft\bibliography\style\gosttitle.xsl to %APPDATA%\microsoft\bibliography\style\7cxz3v7d3sbphpl55g==encrypted
- from %APPDATA%\microsoft\bibliography\style\gostname.xsl to %APPDATA%\microsoft\bibliography\style\7cxz3utlx8-e8vnmencrypted
- from %APPDATA%\microsoft\bibliography\style\gb.xsl to %APPDATA%\microsoft\bibliography\style\7eie8vnmencrypted
- from %APPDATA%\microsoft\bibliography\style\chicago.xsl to %APPDATA%\microsoft\bibliography\style\6elj6evt5yty-ey=encrypted
- from %APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl to %APPDATA%\microsoft\bibliography\style\6_rr-cps3slvzspew8xe5czmw8np5ctgw8tphnlzxg==encrypted
- from %TEMP%\wallpaper.bmp to %TEMP%\3cvgxtrl2s_yhmjh2g==encrypted
- from %TEMP%\content\5764-5936-powershell.exe-12-26-23-654.dump to %TEMP%\content\n52cnoefk5mch_rf3c_y-clpxsaez9lph5uyh5ich5izh5yfnoto38faencrypted
- from %TEMP%\content\5764-5936-powershell.exe-12-26-22-581.dump to %TEMP%\content\n52cnoefk5mch_rf3c_y-clpxsaez9lph5uyh5ich5iyh5-sm4to38faencrypted
- from %TEMP%\content\5764-5936-powershell.exe-12-26-22-348.dump to %TEMP%\content\n52cnoefk5mch_rf3c_y-clpxsaez9lph5uyh5ich5iyh5mekoto38faencrypted
- from %TEMP%\content\5764-5936-powershell.exe-12-26-22-163.dump to %TEMP%\content\n52cnoefk5mch_rf3c_y-clpxsaez9lph5uyh5ich5iyh5ucmyto38faencrypted
- from %TEMP%\content\5764-5936-powershell.exe-12-26-21-777.dump to %TEMP%\content\n52cnoefk5mch_rf3c_y-clpxsaez9lph5uyh5ich5ibh52dnyto38faencrypted
- from %TEMP%\content\5692-3048-powershell.exe-12-38-18-583.dump to %TEMP%\content\n5ytmiezmp6sh_rf3c_y-clpxsaez9lph5uyh5msh5ush5-smyto38faencrypted
- from %TEMP%\content\5692-3048-powershell.exe-12-38-17-390.dump to %TEMP%\content\n5ytmiezmp6sh_rf3c_y-clpxsaez9lph5uyh5msh5udh5mtmoto38faencrypted
- from %TEMP%\content\5692-3048-powershell.exe-12-38-17-205.dump to %TEMP%\content\n5ytmiezmp6sh_rf3c_y-clpxsaez9lph5uyh5msh5udh5ian4to38faencrypted
- from %TEMP%\content\5692-3048-powershell.exe-12-38-17-035.dump to %TEMP%\content\n5ytmiezmp6sh_rf3c_y-clpxsaez9lph5uyh5msh5udh5qzn4to38faencrypted
- from %TEMP%\content\5692-3048-powershell.exe-12-38-16-415.dump to %TEMP%\content\n5ytmiezmp6sh_rf3c_y-clpxsaez9lph5uyh5msh5uch56bn4to38faencrypted
- from %TEMP%\content\5308-3476-powershell.exe-12-38-27-873.dump to %TEMP%\content\n5makoeznp2ch_rf3c_y-clpxsaez9lph5uyh5msh5idh5kdmyto38faencrypted
- from %TEMP%\content\5308-3476-powershell.exe-12-38-26-932.dump to %TEMP%\content\n5makoeznp2ch_rf3c_y-clpxsaez9lph5uyh5msh5ich5ozmito38faencrypted
- from %TEMP%\content\5308-3476-powershell.exe-12-38-26-751.dump to %TEMP%\content\n5makoeznp2ch_rf3c_y-clpxsaez9lph5uyh5msh5ich52fm4to38faencrypted
- from %TEMP%\content\5308-3476-powershell.exe-12-38-26-666.dump to %TEMP%\content\n5makoeznp2ch_rf3c_y-clpxsaez9lph5uyh5msh5ich5ycnito38faencrypted
- from %TEMP%\content\5308-3476-powershell.exe-12-38-26-372.dump to %TEMP%\content\n5makoeznp2ch_rf3c_y-clpxsaez9lph5uyh5msh5ich5mdmito38faencrypted
- from %TEMP%\content\4572-1920-powershell.exe-12-26-27-670.dump to %TEMP%\content\np-dmiebk5iah9rf3c_y2clpxsaez9lph5uyh5ich5idh5ydmoto38faencrypted
- from %TEMP%\content\4572-1920-powershell.exe-12-26-27-332.dump to %TEMP%\content\np-dmiebk5iah9rf3c_y2clpxsaez9lph5uyh5ich5idh5mzmito38faencrypted
- from %TEMP%\content\4572-1920-powershell.exe-12-26-26-660.dump to %TEMP%\content\np-dmiebk5iah9rf3c_y2clpxsaez9lph5uyh5ich5ich5ycmoto38faencrypted
- from %TEMP%\content\4572-1920-powershell.exe-12-26-26-444.dump to %TEMP%\content\np-dmiebk5iah9rf3c_y2clpxsaez9lph5uyh5ich5ich56enoto38faencrypted
- from %TEMP%\content\4572-1920-powershell.exe-12-26-26-265.dump to %TEMP%\content\np-dmiebk5iah9rf3c_y2clpxsaez9lph5uyh5ich5ich5icn4to38faencrypted
- from %TEMP%\content\4572-1920-powershell.exe-12-26-26-180.dump to %TEMP%\content\np-dmiebk5iah9rf3c_y2clpxsaez9lph5uyh5ich5ich5usmoto38faencrypted
- from %TEMP%\content\4572-1920-powershell.exe-12-26-25-911.dump to %TEMP%\content\np-dmiebk5iah9rf3c_y2clpxsaez9lph5uyh5ich5ifh5obm4to38faencrypted
- from %TEMP%\content\3732-828-powershell.exe-12-19-33-562.dump to %TEMP%\content\mz2zmiesmjkh2sxdz9jzws_gxotp0s-hm5ihm5ohmzmhn5yyhm7fx9o=encrypted
- from %TEMP%\content\3732-828-powershell.exe-12-19-33-421.dump to %TEMP%\content\mz2zmiesmjkh2sxdz9jzws_gxotp0s-hm5ihm5ohmzmhnpibhm7fx9o=encrypted
- from %TEMP%\content\1748-3352-cscript.exe-12-20-33-453.dump to %TEMP%\content\m52ekoezmz-yh8nzydjd2t6ez9lph5uyh5iah5mzh56fmyto38faencrypted
- from %TEMP%\content\1748-3352-cscript.exe-12-20-31-843.dump to %TEMP%\content\m52ekoezmz-yh8nzydjd2t6ez9lph5uyh5iah5mbh5kemyto38faencrypted
- from %TEMP%\content\1748-3352-cscript.exe-12-20-31-828.dump to %TEMP%\content\m52ekoezmz-yh8nzydjd2t6ez9lph5uyh5iah5mbh5kykoto38faencrypted
- from %TEMP%\content\1748-3352-cscript.exe-12-20-31-812.dump to %TEMP%\content\m52ekoezmz-yh8nzydjd2t6ez9lph5uyh5iah5mbh5kbmito38faencrypted
- from %TEMP%\content\1560-2756-powershell.exe-12-19-30-562.dump to %TEMP%\content\m5-cmoeynz-ch_rf3c_y-clpxsaez9lph5uyh5uth5mah5-cmito38faencrypted
- from %TEMP%\content\1560-2756-powershell.exe-12-19-29-875.dump to %TEMP%\content\m5-cmoeynz-ch_rf3c_y-clpxsaez9lph5uyh5uth5ith5kdn4to38faencrypted
- from %TEMP%\content\1560-2756-powershell.exe-12-19-29-687.dump to %TEMP%\content\m5-cmoeynz-ch_rf3c_y-clpxsaez9lph5uyh5uth5ith5ysnyto38faencrypted
- from %TEMP%\content\1560-2756-powershell.exe-12-19-29-578.dump to %TEMP%\content\m5-cmoeynz-ch_rf3c_y-clpxsaez9lph5uyh5uth5ith5-dkoto38faencrypted
- from %TEMP%\content\1560-2756-powershell.exe-12-19-29-312.dump to %TEMP%\content\m5-cmoeynz-ch_rf3c_y-clpxsaez9lph5uyh5uth5ith5mbmito38faencrypted
- from %TEMP%\content\1512-2620-powershell.exe-12-19-09-156.dump to %TEMP%\content\m5-bmieynjiah_rf3c_y-clpxsaez9lph5uyh5uth5qth5ufnito38faencrypted
- from %TEMP%\content\1512-2620-powershell.exe-12-19-08-562.dump to %TEMP%\content\m5-bmieynjiah_rf3c_y-clpxsaez9lph5uyh5uth5qsh5-cmito38faencrypted
- from %TEMP%\content\1512-2620-powershell.exe-12-19-08-406.dump to %TEMP%\content\m5-bmieynjiah_rf3c_y-clpxsaez9lph5uyh5uth5qsh56anito38faencrypted
- from %TEMP%\content\1512-2620-powershell.exe-12-19-08-312.dump to %TEMP%\content\m5-bmieynjiah_rf3c_y-clpxsaez9lph5uyh5uth5qsh5mbmito38faencrypted
- from %TEMP%\content\1512-2620-powershell.exe-12-19-08-078.dump to %TEMP%\content\m5-bmieynjiah_rf3c_y-clpxsaez9lph5uyh5uth5qsh5qdkoto38faencrypted
- from %TEMP%\.ses to %TEMP%\hnnp2q==encrypted
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_idx.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_16.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_32.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_48.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_96.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_256.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_768.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_1280.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_1920.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_2560.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_sr.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_wide.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_exif.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db
- %LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_custom_stream.db
