Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\decrypt-files.txt
- %APPDATA%\microsoft\word\startup\decrypt-files.txt
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\dump001.tmp
- D:\decrypt-files.txt
- C:\decrypt-files.txt
- D:\$recycle.bin\decrypt-files.txt
- D:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- C:\$recycle.bin\decrypt-files.txt
- C:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- C:\documents and settings\decrypt-files.txt
- C:\kms\decrypt-files.txt
- C:\msocache\decrypt-files.txt
- C:\perflogs\decrypt-files.txt
- %ProgramFiles%\decrypt-files.txt
- %ProgramFiles(x86)%\decrypt-files.txt
- %ProgramFiles(x86)%\microsoft sql server\decrypt-files.txt
- %ProgramFiles(x86)%\microsoft sql server\110\decrypt-files.txt
- %ProgramFiles(x86)%\microsoft sql server\110\shared\decrypt-files.txt
- C:\recovery\decrypt-files.txt
- C:\recovery\windowsre\decrypt-files.txt
- <Current directory>\decrypt-files.txt
- C:\users\default\decrypt-files.txt
- C:\users\default\appdata\decrypt-files.txt
- C:\users\default\appdata\roaming\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\cloudstore\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\recent\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessibility\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\system tools\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\templates\decrypt-files.txt
- C:\users\default\cookies\decrypt-files.txt
- C:\users\default\desktop\decrypt-files.txt
- C:\users\default\documents\decrypt-files.txt
- C:\users\default\documents\my music\decrypt-files.txt
- C:\users\default\documents\my pictures\decrypt-files.txt
- C:\users\default\documents\my videos\decrypt-files.txt
- C:\users\default\downloads\decrypt-files.txt
- C:\users\default\favorites\decrypt-files.txt
- C:\users\default\links\decrypt-files.txt
- C:\users\default\saved games\decrypt-files.txt
- C:\users\public\decrypt-files.txt
- C:\users\public\accountpictures\decrypt-files.txt
- C:\users\public\desktop\decrypt-files.txt
- C:\users\public\documents\decrypt-files.txt
- C:\users\public\documents\my music\decrypt-files.txt
- C:\users\public\documents\my pictures\decrypt-files.txt
- C:\users\public\documents\my videos\decrypt-files.txt
- C:\users\public\downloads\decrypt-files.txt
- C:\users\public\libraries\decrypt-files.txt
- %HOMEPATH%\decrypt-files.txt
- %HOMEPATH%\.oracle_jre_usage\decrypt-files.txt
- %HOMEPATH%\3d objects\decrypt-files.txt
- %HOMEPATH%\appdata\decrypt-files.txt
- %APPDATA%\decrypt-files.txt
- %APPDATA%\adobe\decrypt-files.txt
- %APPDATA%\adobe\flash player\decrypt-files.txt
- %APPDATA%\adobe\flash player\nativecache\decrypt-files.txt
- %APPDATA%\microsoft\decrypt-files.txt
- %APPDATA%\microsoft\addins\decrypt-files.txt
- %APPDATA%\microsoft\bibliography\decrypt-files.txt
- %APPDATA%\microsoft\bibliography\style\decrypt-files.txt
- %APPDATA%\microsoft\credentials\decrypt-files.txt
- %APPDATA%\microsoft\crypto\decrypt-files.txt
- %APPDATA%\microsoft\crypto\keys\decrypt-files.txt
- %APPDATA%\microsoft\crypto\rsa\decrypt-files.txt
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\userdata\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\userdata\low\decrypt-files.txt
- %APPDATA%\microsoft\mmc\decrypt-files.txt
- %APPDATA%\microsoft\network\decrypt-files.txt
- %APPDATA%\microsoft\network\connections\decrypt-files.txt
- %APPDATA%\microsoft\network\connections\pbk\decrypt-files.txt
- %APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\decrypt-files.txt
- %APPDATA%\microsoft\office\decrypt-files.txt
- %APPDATA%\microsoft\office\recent\decrypt-files.txt
- %APPDATA%\microsoft\proof\decrypt-files.txt
- %APPDATA%\microsoft\protect\decrypt-files.txt
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- %APPDATA%\microsoft\spelling\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\certificates\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\crls\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\ctls\decrypt-files.txt
- %APPDATA%\microsoft\templates\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\managed\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\user\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\user\document themes\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\user\document themes\1033\decrypt-files.txt
- %APPDATA%\microsoft\uproof\decrypt-files.txt
- %APPDATA%\microsoft\vault\decrypt-files.txt
- %APPDATA%\microsoft\windows\decrypt-files.txt
- %APPDATA%\microsoft\windows\accountpictures\decrypt-files.txt
- %APPDATA%\microsoft\windows\cloudstore\decrypt-files.txt
- %APPDATA%\microsoft\windows\libraries\decrypt-files.txt
- %APPDATA%\microsoft\windows\network shortcuts\decrypt-files.txt
- %APPDATA%\microsoft\windows\printer shortcuts\decrypt-files.txt
- %APPDATA%\microsoft\windows\recent\decrypt-files.txt
- %APPDATA%\microsoft\windows\recent\automaticdestinations\decrypt-files.txt
- %APPDATA%\microsoft\windows\recent\customdestinations\decrypt-files.txt
- %APPDATA%\microsoft\windows\sendto\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\accessibility\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\accessories\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\administrative tools\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\google chrome\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\system tools\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\windows powershell\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\winrar\decrypt-files.txt
- %APPDATA%\microsoft\windows\templates\decrypt-files.txt
- %APPDATA%\microsoft\windows\themes\decrypt-files.txt
- %APPDATA%\microsoft\windows\themes\cachedfiles\decrypt-files.txt
- %APPDATA%\microsoft\word\decrypt-files.txt
- %APPDATA%\mozilla\decrypt-files.txt
- %APPDATA%\mozilla\extensions\decrypt-files.txt
- %APPDATA%\mozilla\firefox\decrypt-files.txt
- %APPDATA%\mozilla\firefox\crash reports\decrypt-files.txt
- %APPDATA%\mozilla\firefox\crash reports\events\decrypt-files.txt
- %APPDATA%\mozilla\firefox\pending pings\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\events\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\deletion_request\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\events\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\pending_pings\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\tmp\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\minidumps\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\security_state\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\temporary\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\decrypt-files.txt
- %APPDATA%\mozilla\systemextensionsdev\decrypt-files.txt
- %APPDATA%\opera software\decrypt-files.txt
- %APPDATA%\opera software\opera stable\decrypt-files.txt
- %APPDATA%\opera software\opera stable\dictionaries\decrypt-files.txt
- %APPDATA%\opera software\opera stable\extension state\decrypt-files.txt
- %APPDATA%\opera software\opera stable\jump list icons\decrypt-files.txt
- %APPDATA%\opera software\opera stable\local storage\decrypt-files.txt
- %APPDATA%\opera software\opera stable\themes_backup\decrypt-files.txt
- %APPDATA%\opera software\opera stable\widevinecdm\decrypt-files.txt
- %APPDATA%\sun\decrypt-files.txt
- %APPDATA%\sun\java\decrypt-files.txt
- %APPDATA%\sun\java\deployment\decrypt-files.txt
- %APPDATA%\telegram desktop\decrypt-files.txt
- %APPDATA%\thunderbird\decrypt-files.txt
- %APPDATA%\thunderbird\crash reports\decrypt-files.txt
- %APPDATA%\thunderbird\crash reports\events\decrypt-files.txt
- %APPDATA%\thunderbird\pending pings\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\b376zl1q.default\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\events\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\minidumps\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\default\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\temporary\decrypt-files.txt
- %HOMEPATH%\contacts\decrypt-files.txt
- %HOMEPATH%\cookies\decrypt-files.txt
- %HOMEPATH%\desktop\decrypt-files.txt
- %HOMEPATH%\documents\decrypt-files.txt
- %HOMEPATH%\documents\my music\decrypt-files.txt
- %HOMEPATH%\documents\my pictures\decrypt-files.txt
- %HOMEPATH%\documents\my videos\decrypt-files.txt
- %HOMEPATH%\downloads\decrypt-files.txt
- %HOMEPATH%\favorites\decrypt-files.txt
- %HOMEPATH%\favorites\links\decrypt-files.txt
- %HOMEPATH%\links\decrypt-files.txt
- %HOMEPATH%\pictures\camera roll\decrypt-files.txt
- %HOMEPATH%\saved games\decrypt-files.txt
- %HOMEPATH%\searches\decrypt-files.txt
- %TEMP%\111.bmp
- %APPDATA%\microsoft\speech\files\userlexicons\sp_28883273ae004733b3ed8fb7eff7bc6a.dat
Moves the following system files
- from C:\recovery\windowsre\boot.sdi to C:\recovery\windowsre\boot.sdi.fvr5
- from C:\recovery\windowsre\reagent.xml to C:\recovery\windowsre\reagent.xml.fvr5
- from C:\recovery\windowsre\winre.wim to C:\recovery\windowsre\winre.wim.huzcamo
Moves the following files
- from %APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl to %APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl.kkci
- from %APPDATA%\microsoft\bibliography\style\chicago.xsl to %APPDATA%\microsoft\bibliography\style\chicago.xsl.4xe1
- from %APPDATA%\microsoft\bibliography\style\gb.xsl to %APPDATA%\microsoft\bibliography\style\gb.xsl.4xe1
- from %APPDATA%\microsoft\bibliography\style\gostname.xsl to %APPDATA%\microsoft\bibliography\style\gostname.xsl.zsogy
- from %APPDATA%\microsoft\bibliography\style\gosttitle.xsl to %APPDATA%\microsoft\bibliography\style\gosttitle.xsl.zsogy
- from %APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl to %APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl.7rmtm
- from %APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl to %APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl.7rmtm
- from %APPDATA%\microsoft\bibliography\style\iso690.xsl to %APPDATA%\microsoft\bibliography\style\iso690.xsl.7rmtm
- from %APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl to %APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl.7rmtm
- from %APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl to %APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl.v55vna
- from %APPDATA%\microsoft\bibliography\style\sist02.xsl to %APPDATA%\microsoft\bibliography\style\sist02.xsl.v55vna
- from %APPDATA%\microsoft\bibliography\style\turabian.xsl to %APPDATA%\microsoft\bibliography\style\turabian.xsl.9bssok
- from %APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400 to %APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400.9bssok
- from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400.hmn2wet
- from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.x9nuo
- from %APPDATA%\microsoft\office\recent\index.dat to %APPDATA%\microsoft\office\recent\index.dat.8wyc3
- from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.8wyc3
- from %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a to %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a.bksx2t
- from %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\dd5bc7c6-8594-45bc-bd24-f453fba99ec4 to %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\dd5bc7c6-8594-45bc-bd24-f453fba99ec4.bksx2t
- from %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred.bksx2t
- from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm.urai
- from %APPDATA%\Microsoft\Templates\~$Normal.dotm to %APPDATA%\microsoft\templates\~$normal.dotm.urai
- from %APPDATA%\microsoft\uproof\custom.dic to %APPDATA%\microsoft\uproof\custom.dic.lu2v
- from %APPDATA%\microsoft\windows\libraries\cameraroll.library-ms to %APPDATA%\microsoft\windows\libraries\cameraroll.library-ms.lu2v
- from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\documents.library-ms.6yos
- from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\music.library-ms.6yos
- from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\pictures.library-ms.6yos
- from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\videos.library-ms.6yos
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms.cmgtd
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\6824f4a902c78fbd.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\6824f4a902c78fbd.automaticdestinations-ms.cmgtd
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms.cmgtd
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\f8f05350c84c9d76.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\f8f05350c84c9d76.automaticdestinations-ms.8n2z6q
- from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.np8d5md
- from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.np8d5md
- from %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail to %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.qig2gug
- from %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg to %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg.przdj
- from %APPDATA%\microsoft\windows\themes\transcodedwallpaper to %APPDATA%\microsoft\windows\themes\transcodedwallpaper.przdj
- from %APPDATA%\Microsoft\Word\~WRA0003.wbk to %APPDATA%\microsoft\word\~wra0003.wbk.veq2u
- from %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856 to %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856.9yii1
- from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.ncfym3
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addons.json.ncfym3
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4.wn5xor
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\bookmarks-2026-01-22_11_kx2i12ignwmokjfhtrtlyq==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\bookmarks-2026-01-22_11_kx2i12ignwmokjfhtrtlyq==.jsonlz4.wn5xor
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\broadcast-listeners.json.wn5xor
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\compatibility.ini.2gqfiov
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\containers.json.2gqfiov
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\store.json.mozlz4.rif3
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186024.607ca866-e4d6-4cd9-8292-f41050b95703.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186024.607ca866-e4d6-4cd9-8292-f41050b95703.new-profile.jsonlz4.rif3
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186237.f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186237.f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.event.jsonlz4.xa5i
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186300.bf64c134-4580-4cec-a821-b1c0a18188bf.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186300.bf64c134-4580-4cec-a821-b1c0a18188bf.main.jsonlz4.xa5i
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186304.df151785-6317-4a9b-a34f-33db9e13ed66.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186304.df151785-6317-4a9b-a34f-33db9e13ed66.first-shutdown.jsonlz4.aq0qx
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\data.safe.bin to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\data.safe.bin.aq0qx
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\session-state.json.wsjdd9n
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\state.json.3evw
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extension-preferences.json.3evw
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions.json.3evw
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\formhistory.sqlite.tyrj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\handlers.json.tyrj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.tyrj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.c8ay
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\607ca866-e4d6-4cd9-8292-f41050b95703 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\607ca866-e4d6-4cd9-8292-f41050b95703.c8ay
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\bf64c134-4580-4cec-a821-b1c0a18188bf to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\bf64c134-4580-4cec-a821-b1c0a18188bf.c8ay
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\df151785-6317-4a9b-a34f-33db9e13ed66 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\df151785-6317-4a9b-a34f-33db9e13ed66.c8ay
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\f25f5a62-89ef-4fa6-bcd1-17fb20e245e0 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.snjnb
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4.snjnb
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessioncheckpoints.json.snjnb
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\previous.jsonlz4.snjnb
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.baklz4.bk8ff
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.jsonlz4.bk8ff
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856.bk8ff
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\1e01f83333bad4f4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\1e01f83333bad4f4.bk8ff
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\1e06f8ad978f3db5 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\1e06f8ad978f3db5.bk8ff
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\4984dbbec049ae1a to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\4984dbbec049ae1a.qha37l
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\5802f695ed438e48 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\5802f695ed438e48.qha37l
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\5d3fadd6bef54fea to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\5d3fadd6bef54fea.qha37l
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\618402d7d4853303 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\618402d7d4853303.qha37l
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\628a1d0072cbecd7 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\628a1d0072cbecd7.qha37l
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\67e7e0482fcb91 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\67e7e0482fcb91.qha37l
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\88c347015146120f to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\88c347015146120f.1uhc6kk
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\9803623ba1f8b478 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\9803623ba1f8b478.1uhc6kk
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\ac17e80ffc3c70cd to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\ac17e80ffc3c70cd.1uhc6kk
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\ad7b8894f3e04020 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\ad7b8894f3e04020.1uhc6kk
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\be1d01d9681d14d5 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\be1d01d9681d14d5.1uhc6kk
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\c9728106a3f7dd63 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\c9728106a3f7dd63.1uhc6kk
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\d6fc52c303255c71 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\d6fc52c303255c71.ep7qhnz
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\da4c9310e207ac to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\da4c9310e207ac.ep7qhnz
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\f0293cbb63bd1108 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\f0293cbb63bd1108.3me4
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\startup_shaders to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shader-cache\startup_shaders.3me4
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shield-preference-experiments.json.3me4
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.3me4
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\.metadata-v2.y3zo
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\.metadata-v2.ccqb
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.ssuj1
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.ssuj1
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.ssuj1
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.ngzyj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.ngzyj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.4klj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\times.json.4klj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.uh0u
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\xulstore.json.uh0u
- from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\times.json to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\times.json.vldc
- from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.vldc
- from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.vldc
- from %APPDATA%\opera software\opera stable\91bb.tmp to %APPDATA%\opera software\opera stable\91bb.tmp.dplfm
- from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.dplfm
- from %APPDATA%\opera software\opera stable\current session to %APPDATA%\opera software\opera stable\current session.dplfm
- from %APPDATA%\opera software\opera stable\default_partner_content.json to %APPDATA%\opera software\opera stable\default_partner_content.json.me04z1
- from %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml to %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml.me04z1
- from %APPDATA%\opera software\opera stable\extension state\000003.log to %APPDATA%\opera software\opera stable\extension state\000003.log.wtjori
- from %APPDATA%\opera software\opera stable\extension state\current to %APPDATA%\opera software\opera stable\extension state\current.wtjori
- from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\log.wtjori
- from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\manifest-000001.wtjori
- from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.2cvqeur
- from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.2cvqeur
- from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.2cvqeur
- from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.txrjcfo
- from %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage.txrjcfo
- from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.txrjcfo
- from %APPDATA%\opera software\opera stable\network persistent state to %APPDATA%\opera software\opera stable\network persistent state.5gpg
- from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.5gpg
- from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.5gpg
- from %APPDATA%\opera software\opera stable\ssdfp1252.0.1802400714 to %APPDATA%\opera software\opera stable\ssdfp1252.0.1802400714.5gpg
- from %APPDATA%\opera software\opera stable\ssdfp1252.6.1555693585 to %APPDATA%\opera software\opera stable\ssdfp1252.6.1555693585.5gpg
- from %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip to %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip.ufjb
- from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.burf9
- from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.burf9
- from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.burf9
- from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.f7owrp
- from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\unins000.dat.1mhjvx
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.1mhjvx
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.e37uuw
- from %APPDATA%\thunderbird\profiles\b376zl1q.default\times.json to %APPDATA%\thunderbird\profiles\b376zl1q.default\times.json.3leny78
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\abook.sqlite.yszfmir
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addons.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addons.json.yszfmir
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addonstartup.json.lz4.yszfmir
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\blist.sqlite.yszfmir
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\compatibility.ini.6emu
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite.6emu
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4.iteck
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.jsonlz4.nrzqw
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4.nrzqw
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdown.jsonlz4.nrzqw
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\session-state.json.nrzqw
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\state.json.nrzqw
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\directorytree.json.gxm4ur
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\enigmail.sqlite.gxm4ur
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extension-preferences.json.gxm4ur
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions.json.1vuoma
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\favicons.sqlite.7ms5w
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\formhistory.sqlite.o3lpx
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\global-messages-db.sqlite.m10nt
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\history.sqlite.hsykpn
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\openpgp.sqlite.2avu4y
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\permissions.sqlite.2avu4y
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.tf0cdjt
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite.phown
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.phown
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.mlhji
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428.mlhji
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4.mlhji
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\search.json.mozlz4.mlhji
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sessioncheckpoints.json.mlhji
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2.3io570
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.3io570
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage.sqlite.tqhpjan
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\times.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\times.json.tqhpjan
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\webappsstore.sqlite.tqhpjan
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xulstore.json.tqhpjan
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.62ce
Modifies the following files
- C:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget
- C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink
- C:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail
- C:\users\default\ntuser.dat.log1
- C:\users\default\ntuser.dat.log2
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tm.blf
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000001.regtrans-ms
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000002.regtrans-ms
- C:\users\public\libraries\recordedtv.library-ms
- %HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp
- %APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl
- %APPDATA%\microsoft\bibliography\style\chicago.xsl
- %APPDATA%\microsoft\bibliography\style\gb.xsl
- %APPDATA%\microsoft\bibliography\style\gostname.xsl
- %APPDATA%\microsoft\bibliography\style\gosttitle.xsl
- %APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl
- %APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl
- %APPDATA%\microsoft\bibliography\style\iso690.xsl
- %APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl
- %APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl
- %APPDATA%\microsoft\bibliography\style\sist02.xsl
- %APPDATA%\microsoft\bibliography\style\turabian.xsl
- %APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %APPDATA%\microsoft\office\mso1033.acl
- %APPDATA%\microsoft\office\recent\index.dat
- %APPDATA%\microsoft\protect\credhist
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\dd5bc7c6-8594-45bc-bd24-f453fba99ec4
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred
Modifies multiple files.
Substitutes the following files
- %APPDATA%\Microsoft\Windows\Themes\TranscodedWallpaper
- %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
- %APPDATA%\Microsoft\Windows\Themes\CachedFiles\CachedImage_1152_864_POS2.jpg
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
- '<SYSTEM32>\wbem\wmic.exe' shadowcopy delete' (with hidden window)
