Trojan.Encoder.38501

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\file recovery_id_103892593113.txt

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM postgresql*
'<SYSTEM32>\net.exe' stop "MSSQL" /y
'<SYSTEM32>\net.exe' stop "SQLWriter" /y
'<SYSTEM32>\net.exe' stop "SQLTELEMETRY" /y
'<SYSTEM32>\net.exe' stop "SQLBrowser" /y
'<SYSTEM32>\net.exe' stop "SQLSERVERAGENT" /y
'<SYSTEM32>\net.exe' stop "MSSQLSERVER" /y
'<SYSTEM32>\net.exe' stop "SQLAgent" /y
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher" /y
'<SYSTEM32>\taskkill.exe' /F /IM pg_ctl*
'<SYSTEM32>\taskkill.exe' /F /IM SQLAGENT*
'<SYSTEM32>\taskkill.exe' /F /IM sqlceip*
'<SYSTEM32>\taskkill.exe' /F /IM sqlservr*
'<SYSTEM32>\taskkill.exe' /F /IM sqlwriter*
'<SYSTEM32>\taskkill.exe' /F /IM sqlbrowser*
'<SYSTEM32>\taskkill.exe' /F /IM postgres*
'<SYSTEM32>\net.exe' stop "MSSQLServerOLAPService" /y

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\testcertificate.cer

Modifies file system

Creates the following files

<Current directory>\systime.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\session storage\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\file recovery_id_103892593113.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\file recovery_id_103892593113.txt
%HOMEPATH%\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\crash reports\file recovery_id_103892593113.txt
%APPDATA%\microsoft\windows\themes\file recovery_id_103892593113.txt
%APPDATA%\microsoft\windows\sendto\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\file recovery_id_103892593113.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\file recovery_id_103892593113.txt
%APPDATA%\telegram desktop\file recovery_id_103892593113.txt
%APPDATA%\thunderbird\crash reports\file recovery_id_103892593113.txt
%HOMEPATH%\searches\file recovery_id_103892593113.txt
%HOMEPATH%\favorites\windows live\file recovery_id_103892593113.txt
%HOMEPATH%\favorites\msn websites\file recovery_id_103892593113.txt
%HOMEPATH%\favorites\microsoft websites\file recovery_id_103892593113.txt
%HOMEPATH%\favorites\links for united states\file recovery_id_103892593113.txt
%HOMEPATH%\favorites\links\file recovery_id_103892593113.txt
%HOMEPATH%\desktop\file recovery_id_103892593113.txt
%APPDATA%\thunderbird\profiles\hmz1jddi.default\file recovery_id_103892593113.txt
%HOMEPATH%\contacts\file recovery_id_103892593113.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\file recovery_id_103892593113.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\file recovery_id_103892593113.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\file recovery_id_103892593113.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\file recovery_id_103892593113.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\file recovery_id_103892593113.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\file recovery_id_103892593113.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\file recovery_id_103892593113.txt
%APPDATA%\microsoft\windows\recent\automaticdestinations\file recovery_id_103892593113.txt
%APPDATA%\microsoft\windows\libraries\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\windows\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_cab_0fbabd8f\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\windows\explorer\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\media player\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\internet explorer\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\feeds cache\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\feeds cache\xwtafhng\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\feeds cache\bbs9hw0e\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\feeds cache\6fwa5ftw\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\feeds\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\new\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\windows mail\stationery\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\windows mail\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\windows media\12.0\file recovery_id_103892593113.txt
%APPDATA%\microsoft\windows\cookies\file recovery_id_103892593113.txt
%APPDATA%\microsoft\protect\file recovery_id_103892593113.txt
%APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\file recovery_id_103892593113.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\file recovery_id_103892593113.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\file recovery_id_103892593113.txt
%LOCALAPPDATA%low\sun\java\deployment\file recovery_id_103892593113.txt
%LOCALAPPDATA%low\oracle\java\au\file recovery_id_103892593113.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\file recovery_id_103892593113.txt
%LOCALAPPDATA%\file recovery_id_103892593113.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\file recovery_id_103892593113.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\entries\file recovery_id_103892593113.txt
%TEMP%\file recovery_id_103892593113.txt
%TEMP%\opera installer\file recovery_id_103892593113.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\file recovery_id_103892593113.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\offlinecache\file recovery_id_103892593113.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\file recovery_id_103892593113.txt
%APPDATA%\microsoft\windows\ietldcache\file recovery_id_103892593113.txt
%APPDATA%\microsoft\windows\recent\customdestinations\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\cache\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\application\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\file recovery_id_103892593113.txt
C:\users\public\videos\sample videos\file recovery_id_103892593113.txt
C:\users\public\recorded tv\sample media\file recovery_id_103892593113.txt
C:\users\public\pictures\sample pictures\file recovery_id_103892593113.txt
C:\users\public\music\sample music\file recovery_id_103892593113.txt
C:\users\public\libraries\file recovery_id_103892593113.txt
C:\users\default\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\databases\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension state\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\file recovery_id_103892593113.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\file recovery_id_103892593113.txt
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
%TEMP%\csc2a4a.tmp
%TEMP%\t2qaj0rd.out
%TEMP%\t2qaj0rd.cmdline
%TEMP%\t2qaj0rd.0.cs
<Current directory>\wallpaper.ps1
<Current directory>\103892593113.jpg
<Current directory>\zlib1.dll
<Current directory>\libpcre2-8-0.dll
<Current directory>\libintl-8.dll
<Current directory>\libiconv-2.dll
<Current directory>\libgobject-2.0-0.dll
<Current directory>\libgmodule-2.0-0.dll
<Current directory>\libglib-2.0-0.dll
<Current directory>\libgio-2.0-0.dll
<Current directory>\libffi-8.dll
%TEMP%\res2a4b.tmp
%TEMP%\t2qaj0rd.dll
C:\users\public\documents\file recovery_id_103892593113.txt
C:\users\public\desktop\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\file recovery_id_103892593113.txt
C:\kms\file recovery_id_103892593113.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\file recovery_id_103892593113.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\file recovery_id_103892593113.txt
D:\file recovery_id_103892593113.txt

Deletes the following files

%TEMP%\res2a4b.tmp
%TEMP%\csc2a4a.tmp
%TEMP%\t2qaj0rd.cmdline
%TEMP%\t2qaj0rd.dll
%TEMP%\t2qaj0rd.0.cs
%TEMP%\t2qaj0rd.pdb
%TEMP%\t2qaj0rd.out
<Current directory>\103892593113.jpg
<Current directory>\wallpaper.ps1

Moves the following files

from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.live
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\parent.lock to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\parent.lock.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.live
from %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json to %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.live
from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4.live
from %TEMP%\dd_vcredist_amd64_20230912172247.log to %TEMP%\dd_vcredist_amd64_20230912172247.log.live
from %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log.live
from %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log.live
from %TEMP%\dd_vcredist_x86_20230912171710.log to %TEMP%\dd_vcredist_x86_20230912171710.log.live
from %TEMP%\dd_vcredist_amd64_20230912172315.log to %TEMP%\dd_vcredist_amd64_20230912172315.log.live
from %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log.live
from %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log.live
from %TEMP%\dd_vcredist_amd64_20230912172134.log to %TEMP%\dd_vcredist_amd64_20230912172134.log.live
from %TEMP%\dd_vcredist_x86_20230912171759.log to %TEMP%\dd_vcredist_x86_20230912171759.log.live
from %TEMP%\dd_vcredist_x86_20230912171936.log to %TEMP%\dd_vcredist_x86_20230912171936.log.live
from %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log.live
from %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log.live
from %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log.live
from %TEMP%\dd_vcredist_x86_20230912172157.log to %TEMP%\dd_vcredist_x86_20230912172157.log.live
from %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log.live
from %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log.live
from %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log.live
from %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log.live
from %TEMP%\dd_vcredist_amd64_20230912172034.log to %TEMP%\dd_vcredist_amd64_20230912172034.log.live
from %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log.live
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.live
from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.live
from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.live
from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.live
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.live
from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.live
from %TEMP%\dd_vcredistui12db.txt to %TEMP%\dd_vcredistui12db.txt.live
from %TEMP%\adobearm.log to %TEMP%\adobearm.log.live
from %TEMP%\dd_vcredist_amd64_20230912171641.log to %TEMP%\dd_vcredist_amd64_20230912171641.log.live
from %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log.live
from %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log.live
from %TEMP%\dd_vcredist_amd64_20230912171735.log to %TEMP%\dd_vcredist_amd64_20230912171735.log.live
from %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log.live
from %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log.live
from %TEMP%\dd_vcredist_amd64_20230912171824.log to %TEMP%\dd_vcredist_amd64_20230912171824.log.live
from %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log.live
from %TEMP%\dd_vcredistmsi12db.txt to %TEMP%\dd_vcredistmsi12db.txt.live
from %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log.live
from %TEMP%\dd_vcredist_x86_20230912172224.log to %TEMP%\dd_vcredist_x86_20230912172224.log.live
from %TEMP%\dd_vcredist_x86_20230912172322.log to %TEMP%\dd_vcredist_x86_20230912172322.log.live
from %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log.live
from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\documents.library-ms.live
from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\music.library-ms.live
from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\pictures.library-ms.live
from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\videos.library-ms.live
from %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.live
from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.live
from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.live
from %APPDATA%\microsoft\windows\sendto\documents.mydocs to %APPDATA%\microsoft\windows\sendto\documents.mydocs.live
from %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail to %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.live
from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json.live
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2023-09-29_11_w-7ab47btxtewdh4a2yehg==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2023-09-29_11_w-7ab47btxtewdh4a2yehg==.jsonlz4.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json.live
from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred.live
from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.live
from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a.live
from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47.live
from %TEMP%\dd_vcredist_x86_20230912172350.log to %TEMP%\dd_vcredist_x86_20230912172350.log.live
from %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt to %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.live
from %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt to %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.live
from %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log.live
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.live
from %TEMP%\jusched.log to %TEMP%\jusched.log.live
from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.live
from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.live
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.live
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.live
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.live
from %TEMP%\opera_crashreporter.log to %TEMP%\opera_crashreporter.log.live
from %TEMP%\rgia609.tmp to %TEMP%\rgia609.tmp.live
from %TEMP%\rgia609.tmp-tmp to %TEMP%\rgia609.tmp-tmp.live
from %TEMP%\tmpaddon to %TEMP%\tmpaddon.live
from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.live
from %TEMP%\setupexe(202309121734336dc).log to %TEMP%\setupexe(202309121734336dc).log.live
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4.live
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.live

Modifies the following files

C:\kms\kms_vl_all_aio.cmd
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.msi
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
C:\kms\kms_vl_all_aio_debug.log
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.msi

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'<Current directory>\systime.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File "<Current directory>\wallpaper.ps1"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\t2qaj0rd.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2A4B.tmp" "%TEMP%\CSC2A4A.tmp"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c powershell -ExecutionPolicy Bypass -File "<Current directory>\wallpaper.ps1"
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQLSERVER" /y
'<SYSTEM32>\cmd.exe' /c net stop "MSSQLSERVER" /y
'<SYSTEM32>\net1.exe' stop "MSSQLSERVER" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLSERVERAGENT" /y
'<SYSTEM32>\cmd.exe' /c net stop "SQLSERVERAGENT" /y
'<SYSTEM32>\net1.exe' stop "SQLSERVERAGENT" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLBrowser" /y
'<SYSTEM32>\cmd.exe' /c net stop "SQLBrowser" /y
'<SYSTEM32>\net1.exe' stop "SQLBrowser" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQLFDLauncher" /y
'<SYSTEM32>\cmd.exe' /c net stop "MSSQLFDLauncher" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLTELEMETRY" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLWriter" /y
'<SYSTEM32>\cmd.exe' /c net stop "SQLWriter" /y
'<SYSTEM32>\net1.exe' stop "SQLWriter" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQL" /y
'<SYSTEM32>\cmd.exe' /c net stop "MSSQL" /y
'<SYSTEM32>\net1.exe' stop "MSSQL" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLAgent" /y
'<SYSTEM32>\cmd.exe' /c net stop "SQLAgent" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQLServerOLAPService" /y
'<SYSTEM32>\cmd.exe' /c net stop "SQLTELEMETRY" /y
'<SYSTEM32>\net1.exe' stop "SQLTELEMETRY" /y
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM postgres*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM postgres*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM pg_ctl*"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2A4B.tmp" "%TEMP%\CSC2A4A.tmp"
'<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {current} recoveryenabled no"
'<SYSTEM32>\cmd.exe' /c "bcdedit /set {current} recoveryenabled no"
'<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {default} recoveryenabled no"
'<SYSTEM32>\cmd.exe' /c "bcdedit /set {default} recoveryenabled no"
'<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
'<SYSTEM32>\cmd.exe' /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
'<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
'<SYSTEM32>\cmd.exe' /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\t2qaj0rd.cmdline"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM postgresql*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlbrowser*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlbrowser*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlwriter*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlwriter*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlservr*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlservr*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlceip*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlceip*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM SQLAGENT*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM SQLAGENT*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM pg_ctl*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM postgresql*"
'<SYSTEM32>\cmd.exe' /c net stop "MSSQLServerOLAPService" /y
'<SYSTEM32>\net1.exe' stop "MSSQLServerOLAPService" /y

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial