Trojan.Encoder.41001

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\word\startup\#recovery#.txt

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Creates the following files on removable media

<Drive name for removable media>:\dotnetfx45_full_setup.exe
<Drive name for removable media>:\calc.exe
<Drive name for removable media>:\tcm851ax32.exe
<Drive name for removable media>:\utorrent.exe
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\notepad.exe
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\#recovery#.txt

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\region-north-karelia.jpeg
%HOMEPATH%\desktop\parnas_01.jpeg
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\210252809.jpeg
%HOMEPATH%\desktop\2.jpg
%HOMEPATH%\desktop\168.jpg
%HOMEPATH%\desktop\1189.jpeg
%HOMEPATH%\desktop\000814251_video_01.avi
%APPDATA%\thunderbird\profiles.ini
%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\tree_view.html

Modifies file system

Creates the following files

%APPDATA%\_uninstalling_.png
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b8ef\#recovery#.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\#recovery#.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\#recovery#.txt
%LOCALAPPDATA%\microsoft\media player\#recovery#.txt
%LOCALAPPDATA%\microsoft\office\groove\system\#recovery#.txt
%LOCALAPPDATA%\microsoft\office\groove\user\#recovery#.txt
%LOCALAPPDATA%\microsoft\office\groove\#recovery#.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\#recovery#.txt
%LOCALAPPDATA%\microsoft\internet explorer\#recovery#.txt
%LOCALAPPDATA%\microsoft\office\#recovery#.txt
%LOCALAPPDATA%\microsoft\windows mail\stationery\#recovery#.txt
%LOCALAPPDATA%\microsoft\windows mail\#recovery#.txt
%LOCALAPPDATA%\microsoft\windows media\12.0\#recovery#.txt
%LOCALAPPDATA%\microsoft\windows media\#recovery#.txt
%LOCALAPPDATA%\microsoft\windows sidebar\gadgets\#recovery#.txt
%LOCALAPPDATA%\microsoft\windows sidebar\#recovery#.txt
%LOCALAPPDATA%\microsoft\#recovery#.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\new\#recovery#.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\doomed\#recovery#.txt
%LOCALAPPDATA%\microsoft help\#recovery#.txt
%LOCALAPPDATA%\microsoft\feeds cache\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\pnacl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\swiftshader\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\widevinecdm\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\#recovery#.txt
%LOCALAPPDATA%\google\chrome\#recovery#.txt
%LOCALAPPDATA%\google\#recovery#.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\evwhitelist\#recovery#.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\#recovery#.txt
%LOCALAPPDATA%\microsoft\credentials\#recovery#.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\#recovery#.txt
%LOCALAPPDATA%\microsoft\feeds\#recovery#.txt
%LOCALAPPDATA%\microsoft\feeds cache\09emkjp8\#recovery#.txt
%LOCALAPPDATA%\microsoft\feeds cache\17h8i54k\#recovery#.txt
%LOCALAPPDATA%\microsoft\feeds cache\9lygctr1\#recovery#.txt
%LOCALAPPDATA%\microsoft\feeds cache\aowdc71i\#recovery#.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\#recovery#.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\#recovery#.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\entries\#recovery#.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\#recovery#.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\safebrowsing\#recovery#.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\startupcache\#recovery#.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\#recovery#.txt
%LOCALAPPDATA%\thunderbird\profiles\#recovery#.txt
%LOCALAPPDATA%\thunderbird\#recovery#.txt
%LOCALAPPDATA%\#recovery#.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\entries\#recovery#.txt
%LOCALAPPDATA%low\microsoft\internet explorer\services\#recovery#.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\safebrowsing\google4\#recovery#.txt
%LOCALAPPDATA%low\microsoft\#recovery#.txt
%LOCALAPPDATA%low\mozilla\temp-{28060726-42ae-4e49-b300-93149d394ff5}\#recovery#.txt
%LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\#recovery#.txt
%LOCALAPPDATA%low\mozilla\#recovery#.txt
%LOCALAPPDATA%low\oracle\java\au\#recovery#.txt
%LOCALAPPDATA%low\oracle\java\#recovery#.txt
%LOCALAPPDATA%low\oracle\#recovery#.txt
%LOCALAPPDATA%low\microsoft\internet explorer\#recovery#.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\doomed\#recovery#.txt
%LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\#recovery#.txt
%LOCALAPPDATA%\thunderbird\profiles\dm02c46v.default\#recovery#.txt
%TEMP%\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\offlinecache\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\safebrowsing\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\thumbnails\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\q0evdndb.default\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\#recovery#.txt
%LOCALAPPDATA%\mozilla\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\safebrowsing\google4\#recovery#.txt
%LOCALAPPDATA%\programs\common\#recovery#.txt
%TEMP%\hsperfdata_user\#recovery#.txt
%TEMP%\low\#recovery#.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\#recovery#.txt
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\#recovery#.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\#recovery#.txt
%TEMP%\opera installer\#recovery#.txt
%TEMP%\wpdnse\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\#recovery#.txt
%LOCALAPPDATA%\programs\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\pepperflash\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\session storage\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\#recovery#.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__macosx\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\gpucache\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__macosx\_locales\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\#recovery#.txt
%APPDATA%\mozilla\firefox\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\security_state\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\#recovery#.txt
%APPDATA%\microsoft\systemcertificates\my\ctls\#recovery#.txt
%APPDATA%\microsoft\systemcertificates\#recovery#.txt
%APPDATA%\microsoft\templates\#recovery#.txt
%APPDATA%\microsoft\uproof\#recovery#.txt
%APPDATA%\microsoft\word\#recovery#.txt
%APPDATA%\microsoft\#recovery#.txt
%APPDATA%\mozilla\extensions\#recovery#.txt
%APPDATA%\mozilla\firefox\crash reports\events\#recovery#.txt
%APPDATA%\mozilla\firefox\crash reports\#recovery#.txt
%APPDATA%\microsoft\systemcertificates\my\#recovery#.txt
%APPDATA%\mozilla\firefox\pending pings\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\events\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\minidumps\#recovery#.txt
%APPDATA%\mozilla\systemextensionsdev\#recovery#.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\#recovery#.txt
%APPDATA%\microsoft\systemcertificates\my\crls\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\#recovery#.txt
%APPDATA%\microsoft\systemcertificates\my\certificates\#recovery#.txt
%HOMEPATH%\contacts\#recovery#.txt
%HOMEPATH%\documents\#recovery#.txt
%HOMEPATH%\downloads\#recovery#.txt
%HOMEPATH%\favorites\links\#recovery#.txt
%HOMEPATH%\favorites\links for united states\#recovery#.txt
%HOMEPATH%\favorites\microsoft websites\#recovery#.txt
%HOMEPATH%\favorites\msn websites\#recovery#.txt
%HOMEPATH%\appdata\#recovery#.txt
%HOMEPATH%\favorites\windows live\#recovery#.txt
%HOMEPATH%\desktop\#recovery#.txt
%HOMEPATH%\links\#recovery#.txt
%HOMEPATH%\pictures\#recovery#.txt
%HOMEPATH%\saved games\#recovery#.txt
%HOMEPATH%\searches\#recovery#.txt
%HOMEPATH%\videos\#recovery#.txt
%HOMEPATH%\#recovery#.txt
C:\users\#recovery#.txt
%HOMEPATH%\favorites\#recovery#.txt
%APPDATA%\#recovery#.txt
%HOMEPATH%\music\#recovery#.txt
%APPDATA%\thunderbird\#recovery#.txt
%APPDATA%\thunderbird\profiles\#recovery#.txt
%APPDATA%\thunderbird\crash reports\#recovery#.txt
%APPDATA%\thunderbird\profiles\dm02c46v.default\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\events\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\minidumps\#recovery#.txt
%APPDATA%\thunderbird\pending pings\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\#recovery#.txt
%APPDATA%\telegram desktop\#recovery#.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\default\#recovery#.txt
%APPDATA%\mozilla\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\#recovery#.txt
%APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\#recovery#.txt
%APPDATA%\microsoft\protect\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\#recovery#.txt
%LOCALAPPDATA%low\sun\#recovery#.txt
%APPDATA%\identities\{1bba5dcd-58f3-46ae-861d-68cf42722c36}\#recovery#.txt
%APPDATA%\identities\#recovery#.txt
%APPDATA%\media center programs\#recovery#.txt
%APPDATA%\microsoft\addins\#recovery#.txt
%APPDATA%\microsoft\credentials\#recovery#.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\#recovery#.txt
%LOCALAPPDATA%low\sun\java\#recovery#.txt
%APPDATA%\microsoft\crypto\rsa\#recovery#.txt
%LOCALAPPDATA%low\#recovery#.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\#recovery#.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\#recovery#.txt
%APPDATA%\microsoft\internet explorer\quick launch\#recovery#.txt
%APPDATA%\microsoft\internet explorer\#recovery#.txt
%APPDATA%\microsoft\office\recent\#recovery#.txt
%APPDATA%\microsoft\office\#recovery#.txt
%APPDATA%\microsoft\proof\#recovery#.txt
%APPDATA%\microsoft\crypto\#recovery#.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\#recovery#.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\security\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\#recovery#.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\#recovery#.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\#recovery#.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\#recovery#.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\#recovery#.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\#recovery#.txt
%ALLUSERSPROFILE%\oracle\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\#recovery#.txt
%ALLUSERSPROFILE%\mozilla\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\#recovery#.txt
%ALLUSERSPROFILE%\oracle\java\#recovery#.txt
%ALLUSERSPROFILE%\mozilla\updates\#recovery#.txt
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\support\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\wpd\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\#recovery#.txt
%ALLUSERSPROFILE%\microsoft help\#recovery#.txt
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\#recovery#.txt
%ALLUSERSPROFILE%\package cache\#recovery#.txt
%ALLUSERSPROFILE%\sun\java\#recovery#.txt
%ALLUSERSPROFILE%\sun\#recovery#.txt
%ALLUSERSPROFILE%\#recovery#.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\#recovery#.txt
C:\recovery\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\#recovery#.txt
%ALLUSERSPROFILE%\sun\java\java update\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\#recovery#.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\#recovery#.txt
C:\#recovery#.txt
C:\users\default\appdata\local\microsoft\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\#recovery#.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\#recovery#.txt
%ALLUSERSPROFILE%\adobe\setup\#recovery#.txt
%ALLUSERSPROFILE%\adobe\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\#recovery#.txt
C:\msocache\#recovery#.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\perflogs\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\assistance\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\crypto\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\#recovery#.txt
C:\msocache\all users\#recovery#.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\#recovery#.txt
<Current directory>\#recovery#.txt
D:\#recovery#.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\kms\#recovery#.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\#recovery#.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\#recovery#.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\#recovery#.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\#recovery#.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\rac\temp\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\rac\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\search\data\temp\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\search\data\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\search\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\rac\outbound\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\vault\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\#recovery#.txt
C:\perflogs\admin\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\device stage\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\devicesync\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\drm\server\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\drm\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\ehome\logs\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\ehome\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\media player\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\msdn\8.0\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\msdn\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\network\connections\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\network\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\mf\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\office\#recovery#.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\#recovery#.txt
%APPDATA%\thunderbird\crash reports\events\#recovery#.txt
C:\users\default\appdata\local\temp\#recovery#.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\#recovery#.txt
C:\users\default\appdata\local\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\da\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ru\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sk\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sv\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\th\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pt_br\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\tr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ro\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\vi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\zh_tw\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\uk\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ar\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\zh_cn\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pt_pt\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\no\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\de\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\el\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\en\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\es\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fil\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\cs\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\he\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hu\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\id\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\it\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ja\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ko\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\lt\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\lv\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\nl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ca\#recovery#.txt
C:\users\default\appdata\roaming\media center programs\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\bg\#recovery#.txt
%ALLUSERSPROFILE%\oracle\java\javapath\#recovery#.txt
C:\users\public\recorded tv\#recovery#.txt
C:\users\public\videos\sample videos\#recovery#.txt
C:\users\public\videos\#recovery#.txt
C:\users\public\#recovery#.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\#recovery#.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\#recovery#.txt
C:\users\public\pictures\sample pictures\#recovery#.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\#recovery#.txt
C:\users\public\recorded tv\sample media\#recovery#.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\#recovery#.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\#recovery#.txt
%LOCALAPPDATA%\google\chrome\application\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\caps\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\cache\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\databases\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\#recovery#.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension state\#recovery#.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\#recovery#.txt
C:\users\public\pictures\#recovery#.txt
C:\users\public\music\#recovery#.txt
C:\users\public\music\sample music\#recovery#.txt
C:\users\default\appdata\roaming\microsoft\#recovery#.txt
C:\users\default\appdata\roaming\#recovery#.txt
C:\users\default\appdata\#recovery#.txt
C:\users\default\desktop\#recovery#.txt
C:\users\default\documents\#recovery#.txt
C:\users\default\downloads\#recovery#.txt
C:\users\default\favorites\#recovery#.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\#recovery#.txt
C:\users\default\links\#recovery#.txt
C:\users\default\pictures\#recovery#.txt
C:\users\default\saved games\#recovery#.txt
C:\users\default\videos\#recovery#.txt
C:\users\default\#recovery#.txt
C:\users\public\desktop\#recovery#.txt
C:\users\public\documents\#recovery#.txt
C:\users\public\downloads\#recovery#.txt
C:\users\public\favorites\#recovery#.txt
C:\users\default\music\#recovery#.txt
C:\users\public\libraries\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\__macosx\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\#recovery#.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\#recovery#.txt
%TEMP%\74e1.tmp.jpg

Moves the following files

from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json to %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json.blackzluk
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.blackzluk
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.blackzluk
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.blackzluk
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.blackzluk
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.blackzluk
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.blackzluk
from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.blackzluk
from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\parent.lock to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\parent.lock.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json.blackzluk
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json.blackzluk
from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.blackzluk
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.blackzluk
from %APPDATA%\microsoft\uproof\custom.dic to %APPDATA%\microsoft\uproof\custom.dic.blackzluk
from %APPDATA%\Microsoft\Templates\~$Normal.dotm to %APPDATA%\microsoft\templates\~$normal.dotm.blackzluk
from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm.blackzluk
from %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred.blackzluk
from %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c to %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c.blackzluk
from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.blackzluk
from %APPDATA%\microsoft\office\recent\templates.lnk to %APPDATA%\microsoft\office\recent\templates.lnk.blackzluk
from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.blackzluk
from %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2024-09-04_11_de2a2eo29nunltkagq5ija==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2024-09-04_11_de2a2eo29nunltkagq5ija==.jsonlz4.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\.metadata-v2.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4.blackzluk
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2.blackzluk
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.blackzluk

Modifies the following files

C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.msi
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.msi
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.cab

Modifies multiple files.

Deletes itself.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

UDP

'localhost':51872
'localhost':53765

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no
'<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off
'<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\cmd.exe' /c timeout 1 && del "<Full path to file>" >> NUL
'%WINDIR%\syswow64\timeout.exe' 1
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures' (with hidden window)
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c timeout 1 && del "<Full path to file>" >> NUL' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial