Trojan.Encoder.38413

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\split.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\contoso.cer

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM postgresql*
'<SYSTEM32>\net.exe' stop "MSSQL" /y
'<SYSTEM32>\net.exe' stop "SQLWriter" /y
'<SYSTEM32>\net.exe' stop "SQLTELEMETRY" /y
'<SYSTEM32>\net.exe' stop "SQLBrowser" /y
'<SYSTEM32>\net.exe' stop "SQLSERVERAGENT" /y
'<SYSTEM32>\net.exe' stop "MSSQLSERVER" /y
'<SYSTEM32>\net.exe' stop "SQLAgent" /y
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher" /y
'<SYSTEM32>\taskkill.exe' /F /IM pg_ctl*
'<SYSTEM32>\taskkill.exe' /F /IM SQLAGENT*
'<SYSTEM32>\taskkill.exe' /F /IM sqlceip*
'<SYSTEM32>\taskkill.exe' /F /IM sqlservr*
'<SYSTEM32>\taskkill.exe' /F /IM sqlwriter*
'<SYSTEM32>\taskkill.exe' /F /IM sqlbrowser*
'<SYSTEM32>\taskkill.exe' /F /IM postgres*
'<SYSTEM32>\net.exe' stop "MSSQLServerOLAPService" /y

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\parnas_01.jpeg
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\2.jpeg
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\trivial-merge.htm

Modifies file system

Creates the following files

<Current directory>\systime.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\feeds cache\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\feeds cache\q2xofo16\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\feeds cache\id3ykpjl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\feeds cache\5uzys9tz\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\feeds cache\1zlrvj28\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\feeds\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\session storage\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\file recovery_id_310870003511.txt
%APPDATA%\microsoft\windows\cookies\file recovery_id_310870003511.txt
%HOMEPATH%\favorites\windows live\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\media player\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\security_state\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\crashes\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore-backups\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\bookmarkbackups\file recovery_id_310870003511.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\file recovery_id_310870003511.txt
%HOMEPATH%\favorites\msn websites\file recovery_id_310870003511.txt
%HOMEPATH%\favorites\microsoft websites\file recovery_id_310870003511.txt
%HOMEPATH%\favorites\links for united states\file recovery_id_310870003511.txt
%HOMEPATH%\favorites\links\file recovery_id_310870003511.txt
%HOMEPATH%\desktop\file recovery_id_310870003511.txt
%HOMEPATH%\contacts\file recovery_id_310870003511.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\file recovery_id_310870003511.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\file recovery_id_310870003511.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\file recovery_id_310870003511.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\file recovery_id_310870003511.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\file recovery_id_310870003511.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\file recovery_id_310870003511.txt
%APPDATA%\thunderbird\profiles\49zr3fqa.default\file recovery_id_310870003511.txt
%APPDATA%\thunderbird\crash reports\file recovery_id_310870003511.txt
%APPDATA%\telegram desktop\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\file recovery_id_310870003511.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\startupcache\file recovery_id_310870003511.txt
%TEMP%\opera installer\file recovery_id_310870003511.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\startupcache\file recovery_id_310870003511.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\offlinecache\file recovery_id_310870003511.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\file recovery_id_310870003511.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\startupcache\file recovery_id_310870003511.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\offlinecache\file recovery_id_310870003511.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\file recovery_id_310870003511.txt
%TEMP%\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\windows media\12.0\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\windows mail\stationery\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\new\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_cab_0aad3c95\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_08339354\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\windows\explorer\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\windows mail\file recovery_id_310870003511.txt
%LOCALAPPDATA%\microsoft\internet explorer\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\file recovery_id_310870003511.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\bookmarkbackups\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\crash reports\file recovery_id_310870003511.txt
%APPDATA%\microsoft\windows\themes\file recovery_id_310870003511.txt
%APPDATA%\microsoft\windows\sendto\file recovery_id_310870003511.txt
%APPDATA%\microsoft\windows\recent\customdestinations\file recovery_id_310870003511.txt
%APPDATA%\microsoft\windows\recent\automaticdestinations\file recovery_id_310870003511.txt
%APPDATA%\microsoft\windows\libraries\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\file recovery_id_310870003511.txt
%APPDATA%\microsoft\windows\ietldcache\file recovery_id_310870003511.txt
%APPDATA%\microsoft\protect\file recovery_id_310870003511.txt
%APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\file recovery_id_310870003511.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\file recovery_id_310870003511.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\file recovery_id_310870003511.txt
%LOCALAPPDATA%low\sun\java\deployment\file recovery_id_310870003511.txt
%LOCALAPPDATA%low\oracle\java\au\file recovery_id_310870003511.txt
%LOCALAPPDATA%\file recovery_id_310870003511.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\entries\file recovery_id_310870003511.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension state\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\databases\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\cache\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\application\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\file recovery_id_310870003511.txt
C:\users\public\videos\sample videos\file recovery_id_310870003511.txt
C:\users\public\recorded tv\sample media\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\file recovery_id_310870003511.txt
C:\users\public\pictures\sample pictures\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\file recovery_id_310870003511.txt
C:\users\public\music\sample music\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\users\public\desktop\file recovery_id_310870003511.txt
C:\users\public\documents\file recovery_id_310870003511.txt
%TEMP%\nrwblp15.dll
%TEMP%\res98b7.tmp
%TEMP%\csc98a6.tmp
%TEMP%\nrwblp15.out
%TEMP%\nrwblp15.cmdline
C:\kms\file recovery_id_310870003511.txt
%TEMP%\nrwblp15.0.cs
<Current directory>\310870003511.png
<Current directory>\libpcre2-8-0.dll
<Current directory>\libintl-8.dll
<Current directory>\libiconv-2.dll
<Current directory>\libgobject-2.0-0.dll
<Current directory>\libglib-2.0-0.dll
<Current directory>\libffi-8.dll
<Current directory>\wallpaper.ps1
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\users\default\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\file recovery_id_310870003511.txt
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\users\public\libraries\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\file recovery_id_310870003511.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\file recovery_id_310870003511.txt
D:\file recovery_id_310870003511.txt

Deletes the following files

%TEMP%\res98b7.tmp
%TEMP%\csc98a6.tmp
%TEMP%\nrwblp15.dll
%TEMP%\nrwblp15.out
%TEMP%\nrwblp15.cmdline
%TEMP%\nrwblp15.0.cs
%TEMP%\nrwblp15.pdb
<Current directory>\310870003511.png
<Current directory>\wallpaper.ps1

Moves the following files

from %TEMP%\adobearm.log to %TEMP%\10850755145137017814.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\6877534721650538925.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\14657847985665277155.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\11589454527416332904.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extensions.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\15201336967918417974.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\15395499251036253445.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\manifest.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\9697735841457705884.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\15374109408059052581.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\8285543725940686535.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\handlers.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\18006544069550327414.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\6350741712945415401.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pluginreg.dat to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\14320804346328139417.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\10313453475231597164.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\prefs.js to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\17419842993081150861.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0bfb99e9-0e75-47d0-b739-94e23d793342 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\945839180161272759.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\1f6a84f6-29b5-43da-aa85-b8cf32dd80d0 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\3942341353276227050.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\a847dc89-db3d-4896-9bef-b610ec76e43d to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\7316013501303071426.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\d9d62ad7-4327-4aa9-97e7-aeb5486c45ee to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\9618166523986466843.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\ee43e28f-610b-4229-a7d7-171f6ed032bd to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\970936930693206370.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\3011218612476348872.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\securitypreloadstate.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\5801211509536951188.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\security_state\data.safe.bin to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\security_state\4414165088370226459.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\1076219191958257994.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\3367764644938244336.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\13796650541422002506.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160262.1f6a84f6-29b5-43da-aa85-b8cf32dd80d0.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\2457752092008823433.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160264.0186ea91-e835-4919-9366-c7e15b92110b.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\5596382016298749550.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160236.a847dc89-db3d-4896-9bef-b610ec76e43d.health.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\10225975104822335580.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160174.0bfb99e9-0e75-47d0-b739-94e23d793342.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\13102724781709669880.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160111.ee43e28f-610b-4229-a7d7-171f6ed032bd.health.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\2861195648040220455.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\2815273854440453803.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\7355677594278386193.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\7953201093692862615.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\6503547256045548758.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\11338241122427073432.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\18216880876099390221.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\7533104466238802479.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\2116335930059708283.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\7224776222777174221.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\4115120234255739810.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\7748163437198556675.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\5167491919087488392.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0186ea91-e835-4919-9366-c7e15b92110b to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\15070112352864631364.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\10936633532730369648.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\webappsstore.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\18216274176423236552.live
from %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json to %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\11130826835239568022.live
from %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js to %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\9234912914663123256.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\13824494668001682825.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\12928314236235094692.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\15981293613643669119.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\bookmarkbackups\bookmarks-2023-10-16_11_wowu13vthwkcthdlkwm-la==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\bookmarkbackups\4211596415062022499.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\12281044690990933697.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\containers.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\1160827568215733230.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\crashes\7959482961729279914.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160101.d9d62ad7-4327-4aa9-97e7-aeb5486c45ee.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\12208878985614263033.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\17823978680169456524.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\9720461588950533552.live
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\10753011239096229765.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\7091406646439341489.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\9880175283320716637.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\16955021972765676621.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\11173391576777825288.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\5507411679821752986.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\12676773920881337680.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\11989130075840991516.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\key4.db to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\696533103912860501.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\mailviews.dat to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\8303010731306524947.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\5971871815722871225.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\parent.lock to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\17162224529133201109.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\7116385492000562397.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\17543088653074144669.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\14577912006325399037.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\3259241500047516128.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\4357923477614114570.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\11164235580500945980.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\4290143203910405943.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\17309089137912412368.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\2536635666623030700.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\10507581133610063031.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\16329408984973404526.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\2565405027411231300.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\14320413940049567019.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\10458386321750907763.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\14279239524795769681.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\14084987671618959090.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\5893811071882674512.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\5209413501590731155.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\1486250896988627166.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\16370752098492489139.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\18019002859033649623.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\9053284592118542847.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\9297660042241867012.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\8234533235431956985.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3882063055160711182.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\9884747702561452155.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\4222233306982152258.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\times.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\8755843999562392644.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\trrblacklist.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\4716119222179489726.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\user.js to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\7650501606090130770.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\xulstore.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\13222917953808554079.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\2140890701161271897.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore-backups\8033186748593801571.live
from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\1548417937191875321.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\2904698971288887314.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\312244032326763912.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\8655893539085061900.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\7743326872129935947.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\7873969890418585965.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cert9.db to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\7052662502731040595.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\15685450512950005531.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\4054257995835609665.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\9571747011517533335.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\9830611775060122111.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\4815904989160528648.live
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.s... to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\1999076330656767045.live
from %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json to %APPDATA%\thunderbird\profiles\49zr3fqa.default\9569655951174068487.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\3575160338701471154.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\14044612908776972399.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\8743944661295760341.live
from %TEMP%\dd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log to %TEMP%\9859922782645814738.live
from %TEMP%\dd_vcredist_x86_20220928165916.log to %TEMP%\13499810567656958189.live
from %TEMP%\dd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log to %TEMP%\5162239651658764987.live
from %TEMP%\dd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log to %TEMP%\8768774748794267311.live
from %TEMP%\dd_vcredist_x86_20220928170143.log to %TEMP%\1510265683312745463.live
from %TEMP%\dd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log to %TEMP%\13247704223662630620.live
from %TEMP%\dd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log to %TEMP%\4300067506252500539.live
from %TEMP%\dd_vcredist_x86_20220928170221.log to %TEMP%\7735282065245567859.live
from %TEMP%\dd_vcredist_x86_20220928170335.log to %TEMP%\4665002845909103232.live
from %TEMP%\dd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log to %TEMP%\17442713582675843364.live
from %TEMP%\dd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log to %TEMP%\14162011269760148485.live
from %TEMP%\dd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log to %TEMP%\7886735316582686097.live
from %TEMP%\dd_vcredist_x86_20220928170410.log to %TEMP%\5629756671925719320.live
from %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt to %TEMP%\11698326624668923278.live
from %TEMP%\javadeployreg.log to %TEMP%\7654676268889758250.live
from %TEMP%\jawshtml.html to %TEMP%\3716450728134573881.live
from %TEMP%\jusched.log to %TEMP%\10537653436119244116.live
from %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt to %TEMP%\7805968603882806615.live
from %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt to %TEMP%\1191242883429501599.live
from %TEMP%\microsoft .net framework 4 setup_20230531_155457219.html to %TEMP%\12515303630351883441.live
from %TEMP%\microsoft .net framework 4.8 setup_20220928_170905091.html to %TEMP%\9553644125898624401.live
from %TEMP%\microsoft .net framework 4.8 setup_20230531_160116688.html to %TEMP%\180846191964980530.live
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt to %TEMP%\7530631764804781567.live
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616.html to %TEMP%\7774251301147871093.live
from %TEMP%\dd_vcredist_x86_20220928165710.log to %TEMP%\14752475624701389392.live
from %TEMP%\dd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log to %TEMP%\11024484409888057034.live
from %TEMP%\dd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log to %TEMP%\759697818760388775.live
from %TEMP%\dd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log to %TEMP%\8884435372603531494.live
from %TEMP%\dd_vcredist_x86_20220928165536.log to %TEMP%\16700075462756701180.live
from %TEMP%\aspnetsetup_00000.log to %TEMP%\1597127927980182015.live
from %TEMP%\aspnetsetup_00001.log to %TEMP%\16999707112470487876.live
from %TEMP%\chrome_installer.log to %TEMP%\2215929510526314368.live
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\9178959745201841926.live
from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\8749203014677224676.live
from %TEMP%\dd_setuputility.txt to %TEMP%\6300370315169527277.live
from %TEMP%\dd_vcredistmsi7a3c.txt to %TEMP%\8407891758597155532.live
from %TEMP%\dd_vcredistui7a3c.txt to %TEMP%\3809936809470132109.live
from %TEMP%\dd_vcredist_amd64_20220928165349.log to %TEMP%\16590223743781443615.live
from %TEMP%\dd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log to %TEMP%\13820458777495996262.live
from %TEMP%\dd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log to %TEMP%\178180806726846174.live
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt to %TEMP%\2858258196482403596.live
from %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt to %TEMP%\1951091556022324901.live
from %TEMP%\dd_vcredist_amd64_20220928165628.log to %TEMP%\9566378016206907596.live
from %TEMP%\dd_vcredist_amd64_20220928165746.log to %TEMP%\15656292243350888985.live
from %TEMP%\dd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log to %TEMP%\1422531740455393868.live
from %TEMP%\dd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log to %TEMP%\16513825374869120900.live
from %TEMP%\dd_vcredist_amd64_20220928165956.log to %TEMP%\3052263156758810525.live
from %TEMP%\dd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log to %TEMP%\2300719085351616973.live
from %TEMP%\dd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log to %TEMP%\3975924250730494680.live
from %TEMP%\dd_vcredist_amd64_20220928170114.log to %TEMP%\1027833038721145601.live
from %TEMP%\dd_vcredist_amd64_20220928170250.log to %TEMP%\112229919433903087.live
from %TEMP%\dd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log to %TEMP%\1780524790278311182.live
from %TEMP%\dd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log to %TEMP%\7485658477312321951.live
from %TEMP%\dd_vcredist_amd64_20220928170328.log to %TEMP%\6673696483033603708.live
from %TEMP%\adobesfx.log to %TEMP%\11801979761170009969.live
from %TEMP%\dd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log to %TEMP%\13538238577277611791.live
from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\3809162321095931848.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\762695639998104062.live
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913.html to %TEMP%\16222596668879325736.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\content-prefs.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\2144012704490180349.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\2028248787878834920.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\8104198207538585945.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759331.f9af9616-8535-4ace-8050-4454f33ad475.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\15235883871104184568.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759476.fbcd22a2-e53a-4131-9ef1-1935f505d9ca.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\18106396563758831311.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759547.bef7f9cf-b0b1-42d8-a037-8d586d4d1e42.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\16036909261192234077.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759551.dc5a4164-f290-4a08-a5ec-0fe7810acbc6.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\5710009386812126453.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\5999645294200836988.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\14136987217345112090.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\1425264353248633098.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\13750063742753558661.live
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616.html to %TEMP%\17263834571225248812.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\favicons.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\16170036862722442714.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\8608744386245464330.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\9045866982002688435.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\parent.lock to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\11503496441640180442.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\permissions.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\120326628632137019.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\6281789438199524160.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\17148169311906602677.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\9184289923643738770.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\bef7f9cf-b0b1-42d8-a037-8d586d4d1e42 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\16614888813248565673.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\dc5a4164-f290-4a08-a5ec-0fe7810acbc6 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\4941383550604917160.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\f9af9616-8535-4ace-8050-4454f33ad475 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\16274951377485246944.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\fbcd22a2-e53a-4131-9ef1-1935f505d9ca to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\9153409503292204802.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\9722303813703340463.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\14613035812838279262.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\4642198905242095955.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\bookmarkbackups\bookmarks-2022-09-28_11_3a7quggif+d7xxwa176j2q==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\bookmarkbackups\5538269798467468477.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\4378372520400054782.live
from %TEMP%\rgi5839.tmp to %TEMP%\5663774206549452889.live
from %TEMP%\rgi5839.tmp-tmp to %TEMP%\15250392370229268900.live
from %TEMP%\setupexe(20220928171621f0c).log to %TEMP%\3940689469751450537.live
from %TEMP%\tmpaddon to %TEMP%\1447291071013223689.live
from %TEMP%\user.bmp to %TEMP%\10678860490569425302.live
from %TEMP%\wallpaper.bmp to %TEMP%\8824258602840104860.live
from %TEMP%\wmsetup.log to %TEMP%\8232701598760086905.live
from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\f58155b4b1d5a524ca0261c3ee99fb50_d4602615-9d50-4880-be41-678935e93eaa to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\14019810993037391381.live
from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\15075805804063134830.live
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\71e6321a-7203-4cd6-882b-58bcea299d05 to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\17099047815384798139.live
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\daf690d2-903a-45fe-8988-2682ff529577 to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\7522447900195775736.live
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt to %TEMP%\30618218350572074.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\4971416829204739252.live
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\15778294027353974805.live
from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\1016671194136167350.live
from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\10493199346236984944.live
from %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\7614853568822058076.live
from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\13491669068968297754.live
from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\7606523543160332623.live
from %APPDATA%\microsoft\windows\sendto\documents.mydocs to %APPDATA%\microsoft\windows\sendto\15912794261452148671.live
from %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail to %APPDATA%\microsoft\windows\sendto\8033137403345057830.live
from %APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg to %APPDATA%\microsoft\windows\themes\17519955145500933980.live
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\7685671552345120088.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\2681161408460356781.live
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\4422373098960234056.live
from %TEMP%\opera_crashreporter.log to %TEMP%\14288479535079014522.live
from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\13849414242867767371.live
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\3707758402666528676.live

Modifies the following files

C:\kms\kms_vl_all_aio.cmd
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.msi
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
C:\kms\kms_vl_all_aio_debug.log
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.msi

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'<Current directory>\systime.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File "<Current directory>\wallpaper.ps1"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nrwblp15.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES98B7.tmp" "%TEMP%\CSC98A6.tmp"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c powershell -ExecutionPolicy Bypass -File "<Current directory>\wallpaper.ps1"
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQLSERVER" /y
'<SYSTEM32>\cmd.exe' /c net stop "MSSQLSERVER" /y
'<SYSTEM32>\net1.exe' stop "MSSQLSERVER" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLSERVERAGENT" /y
'<SYSTEM32>\cmd.exe' /c net stop "SQLSERVERAGENT" /y
'<SYSTEM32>\net1.exe' stop "SQLSERVERAGENT" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLBrowser" /y
'<SYSTEM32>\cmd.exe' /c net stop "SQLBrowser" /y
'<SYSTEM32>\net1.exe' stop "SQLBrowser" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQLFDLauncher" /y
'<SYSTEM32>\cmd.exe' /c net stop "MSSQLFDLauncher" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLTELEMETRY" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLWriter" /y
'<SYSTEM32>\cmd.exe' /c net stop "SQLWriter" /y
'<SYSTEM32>\net1.exe' stop "SQLWriter" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQL" /y
'<SYSTEM32>\cmd.exe' /c net stop "MSSQL" /y
'<SYSTEM32>\net1.exe' stop "MSSQL" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "SQLAgent" /y
'<SYSTEM32>\cmd.exe' /c net stop "SQLAgent" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent" /y
'<SYSTEM32>\cmd.exe' /c cmd /c net stop "MSSQLServerOLAPService" /y
'<SYSTEM32>\cmd.exe' /c net stop "SQLTELEMETRY" /y
'<SYSTEM32>\net1.exe' stop "SQLTELEMETRY" /y
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM postgres*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM postgres*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM pg_ctl*"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES98B7.tmp" "%TEMP%\CSC98A6.tmp"
'<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {current} recoveryenabled no"
'<SYSTEM32>\cmd.exe' /c "bcdedit /set {current} recoveryenabled no"
'<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {default} recoveryenabled no"
'<SYSTEM32>\cmd.exe' /c "bcdedit /set {default} recoveryenabled no"
'<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
'<SYSTEM32>\cmd.exe' /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
'<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c cmd /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
'<SYSTEM32>\cmd.exe' /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nrwblp15.cmdline"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM postgresql*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlbrowser*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlbrowser*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlwriter*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlwriter*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlservr*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlservr*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM sqlceip*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM sqlceip*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM SQLAGENT*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM SQLAGENT*"
'<SYSTEM32>\cmd.exe' /c cmd /c "taskkill /F /IM pg_ctl*"
'<SYSTEM32>\cmd.exe' /c "taskkill /F /IM postgresql*"
'<SYSTEM32>\cmd.exe' /c net stop "MSSQLServerOLAPService" /y
'<SYSTEM32>\net1.exe' stop "MSSQLServerOLAPService" /y

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial