Trojan.Encoder.44518

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\[nspire_msg].txt
<Drive name for removable media>:\10thingscondoms.pdf
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\168.jpeg
<Drive name for removable media>:\168.jpg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\2013_finalsummaryforweb.xlsx
<Drive name for removable media>:\20140114.rdf
<Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf
<Drive name for removable media>:\210252809.jpg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\babyboymaintoscenesbackground.wmv
<Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4
<Drive name for removable media>:\etc6_m_1.mov
<Drive name for removable media>:\irgeek.pem
<Drive name for removable media>:\investmentbankca_ca8.pem
<Drive name for removable media>:\myhrvoldhanssenbiharfamine.rtf
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\scan.mov
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
<Drive name for removable media>:\waterlandhealthkano.rtf
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\about.html
<Drive name for removable media>:\accountsreceivable.ppt
<Drive name for removable media>:\al.xlsx
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\api-hashmap.html
<Drive name for removable media>:\applicant.xlsx
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\arrow-down.png
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\calculatorworksheet.zip
<Drive name for removable media>:\cbz.png
<Drive name for removable media>:\ck_ugo.pem
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\contenttypes.rdf
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\contractualdeadlines.xls
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dualectls.pdf
<Drive name for removable media>:\elvisimp.rdf
<Drive name for removable media>:\ff_ot_user_guide.pdf
<Drive name for removable media>:\fiche_inscription_2015.xls
<Drive name for removable media>:\file_p_00000000_1371597592.docx
<Drive name for removable media>:\foaf.rdf
<Drive name for removable media>:\fungalnameauthors.rtf
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\guide_reorganization_mapping.xls
<Drive name for removable media>:\highly_cited_2001.xlsx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\howto-index.html
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\iisstart.html
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\krsweden.rtf
<Drive name for removable media>:\ksearch_esa_talk.ppt
<Drive name for removable media>:\mappingconcepthubberlin.ppt
<Drive name for removable media>:\metac.ppt
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\national_autism_preparation_programs.xlsx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\parnas_01.jpg
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\price.zip
<Drive name for removable media>:\price030215.xls
<Drive name for removable media>:\productos.zip
<Drive name for removable media>:\proposaltemplates.ppt
<Drive name for removable media>:\pubnet_855.rtf
<Drive name for removable media>:\region-north-karelia.jpg
<Drive name for removable media>:\removedtitles_records.zip
<Drive name for removable media>:\server.pem
<Drive name for removable media>:\skos.rdf
<Drive name for removable media>:\subjectclassification.xls
<Drive name for removable media>:\subjectclassification.zip
<Drive name for removable media>:\suspendedcompanies.xlsx
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\trivial-merge.htm
<Drive name for removable media>:\trivial-merge.html
<Drive name for removable media>:\trtf_matrix2012_oct.xlsx
<Drive name for removable media>:\video_1.mp4
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt

Modifies file system

Creates the following files

C:\[nspire_msg].txt
D:\[nspire_msg].txt
C:\msocache\[nspire_msg].txt
C:\msocache\all users\[nspire_msg].txt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\[nspire_msg].txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\[nspire_msg].txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\[nspire_msg].txt
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\[nspire_msg].txt
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\[nspire_msg].txt
C:\perflogs\[nspire_msg].txt
%ALLUSERSPROFILE%\[nspire_msg].txt
%ALLUSERSPROFILE%\adobe\[nspire_msg].txt
%ALLUSERSPROFILE%\adobe\setup\[nspire_msg].txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\appv\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\appv\setup\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\crypto\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\crypto\pcpksp\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\crypto\pcpksp\windowsaik\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\crypto\systemkeys\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\drm\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\drm\server\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\device stage\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\device stage\device\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\device stage\task\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\devicesync\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\customtraceprofiles\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedscenarios\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\autologger\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\scenarioshutdownlogger\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\etllogs\shutdownlogger\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\eventtranscript\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\feedbackhub\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\localtracestore\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\sideload\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\siufloc\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\softlanding\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\softlandingstage\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\temp\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\temp\diagtracktraceslot_alternativetrace\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\temp\diagtracktraceslot_aot\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\temp\diagtracktraceslot_diag\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\temp\diagtracktraceslot_minitrace\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosis\timetraveldebuggingstorage\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\channels\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\devicestatedata\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\identitycrl\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\identitycrl\int\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\identitycrl\production\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\mf\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\mapdata\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\netframework\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\netframework\breadcrumbstore\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\network\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\network\connections\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\network\downloader\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\office\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\office\heartbeat\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\provisioning\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\provisioning\assetcache\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\provisioning\assetcache\cellularux\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\search\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\search\data\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\search\data\temp\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\settings\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\settings\accounts\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\smsrouter\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\spectrum\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\speech_onecore\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\storage health\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\uev\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\uev\scripts\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\uev\templates\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\user account pictures\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\vault\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\wdf\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\wpd\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\winmsipc\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\winmsipc\server\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender advanced threat protection\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender advanced threat protection\temp\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\clean store\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\backup\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\default\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\nisbackup\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\updates\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\features\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\localcopy\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\network inspection system\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\network inspection system\support\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\platform\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\quarantine\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\backupstore\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\cachemanager\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\00\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\01\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\02\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\03\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\04\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\06\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\07\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\08\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\09\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\10\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\11\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\12\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\13\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\14\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\15\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\16\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\17\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\18\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\19\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\20\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\21\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\reportlatency\latency\22\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\results\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\results\resource\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\service\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\store\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows security health\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\windows security health\logs\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft\wwansvc\[nspire_msg].txt
%ALLUSERSPROFILE%\microsoft help\[nspire_msg].txt
%ALLUSERSPROFILE%\mozilla\[nspire_msg].txt
%ALLUSERSPROFILE%\mozilla\updates\[nspire_msg].txt
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\[nspire_msg].txt
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\[nspire_msg].txt
%ALLUSERSPROFILE%\oracle\[nspire_msg].txt
%ALLUSERSPROFILE%\oracle\java\[nspire_msg].txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\[nspire_msg].txt
%ALLUSERSPROFILE%\oracle\java\javapath\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\[nspire_msg].txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.549981c3f5f10_8wekyb3d8bbwe\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.549981c3f5f10_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.549981c3f5f10_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.getstarted_8wekyb3d8bbwe\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.getstarted_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.getstarted_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.microsoft3dviewer_8wekyb3d8bbwe\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.microsoft3dviewer_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.microsoft3dviewer_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.mixedreality.portal_8wekyb3d8bbwe\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.mixedreality.portal_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.mixedreality.portal_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.office.onenote_8wekyb3d8bbwe\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.office.onenote_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.office.onenote_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.skypeapp_kzf8qxf38zg5c\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.skypeapp_kzf8qxf38zg5c\s-1-5-21-4226853953-3309226944-3078887307-1000\[nspire_msg].txt
%ALLUSERSPROFILE%\packages\microsoft.skypeapp_kzf8qxf38zg5c\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\[nspire_msg].txt
%ALLUSERSPROFILE%\softwaredistribution\[nspire_msg].txt
%ALLUSERSPROFILE%\usoshared\[nspire_msg].txt
%ALLUSERSPROFILE%\usoshared\logs\[nspire_msg].txt
%ALLUSERSPROFILE%\usoshared\logs\user\[nspire_msg].txt
%ALLUSERSPROFILE%\windowsholographicdevices\[nspire_msg].txt
%ALLUSERSPROFILE%\windowsholographicdevices\spatialstore\[nspire_msg].txt
%ALLUSERSPROFILE%\regid.1991-06.com.microsoft\[nspire_msg].txt
%ALLUSERSPROFILE%\ssh\[nspire_msg].txt
C:\recovery\[nspire_msg].txt
C:\recovery\windowsre\[nspire_msg].txt
C:\users\[nspire_msg].txt
C:\users\default\[nspire_msg].txt
C:\users\default\appdata\[nspire_msg].txt
C:\users\default\appdata\local\[nspire_msg].txt
C:\users\default\appdata\local\microsoft\[nspire_msg].txt
C:\users\default\appdata\local\microsoft\inputpersonalization\[nspire_msg].txt
C:\users\default\appdata\local\microsoft\inputpersonalization\traineddatastore\[nspire_msg].txt
C:\users\default\appdata\local\microsoft\windows sidebar\[nspire_msg].txt
C:\users\default\appdata\local\microsoft\windows sidebar\gadgets\[nspire_msg].txt
C:\users\default\appdata\local\temp\[nspire_msg].txt
C:\users\default\appdata\roaming\[nspire_msg].txt
C:\users\default\appdata\roaming\microsoft\[nspire_msg].txt
C:\users\default\appdata\roaming\microsoft\internet explorer\[nspire_msg].txt
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\[nspire_msg].txt
C:\users\default\desktop\[nspire_msg].txt
C:\users\default\documents\[nspire_msg].txt
C:\users\default\downloads\[nspire_msg].txt
C:\users\default\favorites\[nspire_msg].txt
C:\users\default\links\[nspire_msg].txt
C:\users\default\music\[nspire_msg].txt
C:\users\default\pictures\[nspire_msg].txt
C:\users\default\saved games\[nspire_msg].txt
C:\users\default\videos\[nspire_msg].txt
C:\users\public\[nspire_msg].txt
C:\users\public\accountpictures\[nspire_msg].txt
C:\users\public\desktop\[nspire_msg].txt
C:\users\public\documents\[nspire_msg].txt
C:\users\public\downloads\[nspire_msg].txt
C:\users\public\libraries\[nspire_msg].txt
C:\users\public\music\[nspire_msg].txt
C:\users\public\pictures\[nspire_msg].txt
C:\users\public\videos\[nspire_msg].txt
%HOMEPATH%\[nspire_msg].txt
%HOMEPATH%\.oracle_jre_usage\[nspire_msg].txt
%HOMEPATH%\3d objects\[nspire_msg].txt
%HOMEPATH%\appdata\[nspire_msg].txt
%LOCALAPPDATA%\[nspire_msg].txt
%LOCALAPPDATA%\comms\[nspire_msg].txt
%LOCALAPPDATA%\comms\unistore\[nspire_msg].txt
%LOCALAPPDATA%\comms\unistore\data\[nspire_msg].txt
%LOCALAPPDATA%\comms\unistore\data\temp\[nspire_msg].txt
%LOCALAPPDATA%\comms\unistoredb\[nspire_msg].txt
%LOCALAPPDATA%\connecteddevicesplatform\[nspire_msg].txt
%LOCALAPPDATA%\connecteddevicesplatform\l.user\[nspire_msg].txt
%LOCALAPPDATA%\google\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\application\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\extensions\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\pepperflash\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\visualelements\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\caps\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\cache\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extension state\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\__macosx\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\[nspire_msg].txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\[nspire_msg].txt

Moves the following system files

from C:\recovery\windowsre\reagent.xml to C:\recovery\windowsre\reagent.nspire
from C:\recovery\windowsre\winre.wim to C:\recovery\windowsre\winre.nspire
from C:\recovery\windowsre\boot.sdi to C:\recovery\windowsre\boot.nspire

Modifies the following files

<Drive name for removable media>:\10thingscondoms.pdf
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\168.jpeg
<Drive name for removable media>:\168.jpg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\2013_finalsummaryforweb.xlsx
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\owow64ww.cab
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excellr.cab
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\pptlr.cab
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publr.cab
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlklr.cab
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordlr.cab
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.cab
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.cab
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.cab
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\inflr.cab
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.cab
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onotelr.cab
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovelr.cab
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.cab
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.cab
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\offsetlr.cab
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officelr.cab
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\shellui.mst
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\pss10r.chm
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.chm
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\owow64lr.cab

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial