Creates the following files
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\grabber\508softwareandos.doc
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\browsers\history\history_opera.txt
- %TEMP%\ls178bf1bf000306e4f1ff0d5e.tmp
- %TEMP%\bd178bf1bf000306e4f1ff0d5e.tmp
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\screenshot.jpeg
- %TEMP%\tempdatabase2021-04-03t03_17_06.5452000-07_0099
- %TEMP%\tempdatabase2021-04-03t03_17_05.8744000-07_0099
- %TEMP%\tempdatabase2021-04-03t03_17_05.4220000-07_0099
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\browsers\cookies\cookies_mozilla.txt
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\computer.txt
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\processes.txt
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\grabber\uep_form_786_bulletin_1726i602.doc
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\grabber\ovp25012015.doc
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\grabber\fi51.doc
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\grabber\cveuropeo.doc
- %TEMP%\tempdatabase2021-04-03t03_17_04.9228000-07_0099
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\dotnetzip-aqgpjfkw.tmp
Deletes the following files
- %TEMP%\bd178bf1bf000306e4f1ff0d5e.tmp
- %TEMP%\ls178bf1bf000306e4f1ff0d5e.tmp
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\browsers\cookies\cookies_mozilla.txt
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\browsers\history\history_opera.txt
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\computer.txt
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\grabber\508softwareandos.doc
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\grabber\cveuropeo.doc
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\grabber\fi51.doc
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\grabber\ovp25012015.doc
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\grabber\uep_form_786_bulletin_1726i602.doc
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\processes.txt
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\88178bf1bf000306e4f1ff0d5etfblbbytbbfzjwhyjxhwyt\screenshot.jpeg
- %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\log_178bf1bf000306e4f1ff0d5e.zip
Moves the following files
- from %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\dotnetzip-aqgpjfkw.tmp to %TEMP%\tfblbbytbbfzjwhyjxhwyt178bf1bf000306e4f1ff0d5e88\log_178bf1bf000306e4f1ff0d5e.zip
Substitutes the following files
- %TEMP%\bd178bf1bf000306e4f1ff0d5e.tmp
- %TEMP%\ls178bf1bf000306e4f1ff0d5e.tmp