Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\ilscache\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\pl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\pt_br\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\pt_pt\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ro\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ru\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\sk\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\sl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\sr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\sv\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\th\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\tr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\uk\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\vi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\nl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\no\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\zh_cn\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\zh_tw\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\es_419\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\es\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\en_us\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\en_gb\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\en\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\fr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\el\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\da\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\cs\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\ca\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\bg\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\ar\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_metadata\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\lv\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\lt\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ko\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\sl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\sr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\sv\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\th\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\tr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\uk\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\vi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\zh_cn\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\zh_tw\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_metadata\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ar\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\bg\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ca\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\sk\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\cs\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ja\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\da\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\de\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\el\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\en\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\es\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\fi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\de\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\fil\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\et\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\hi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\hr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\hu\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\id\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\it\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\he\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\hu\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\fil\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\fr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ro\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ru\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sk\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sv\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\th\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\tr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\uk\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\vi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\zh_cn\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\zh_tw\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_metadata\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\pt_br\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\pt_pt\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\css\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\fi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\et\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\es_419\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\es\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\en_gb\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\fi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\en\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\de\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\da\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\cs\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\ca\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\bg\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\images\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\html\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\pl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\no\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\nl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\hi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\hr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\hu\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_metadata\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ar\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\bg\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ca\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\cs\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\da\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\de\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\el\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\en_gb\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\en_us\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\he\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\es\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ms\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\es_419\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\et\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\fi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\fil\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\fr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\he\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ru\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\hi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\fil\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\it\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ja\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ko\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\lt\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\lv\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\id\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\el\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ro\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ko\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ja\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ko\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\lt\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\lv\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ms\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\nl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\no\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_br\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_pt\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ro\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ru\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sk\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\id\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\it\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\da\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\cs\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ca\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\bg\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ar\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\en_gb\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\zh_tw\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\zh_cn\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\vi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\uk\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\tr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\th\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sv\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hu\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\he\how-to-decrypt.txt
- %ALLUSERSPROFILE%\microsoft\office\how-to-decrypt.txt
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\how-to-decrypt.txt
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\how-to-decrypt.txt
- %ALLUSERSPROFILE%\microsoft\rac\statedata\how-to-decrypt.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\how-to-decrypt.txt
- %ALLUSERSPROFILE%\microsoft toolkit\how-to-decrypt.txt
- %ALLUSERSPROFILE%\mozilla\logs\how-to-decrypt.txt
- %ALLUSERSPROFILE%\sun\java\java update\how-to-decrypt.txt
- C:\users\public\pictures\sample pictures\how-to-decrypt.txt
- C:\users\public\videos\sample videos\how-to-decrypt.txt
- %LOCALAPPDATA%\adobe\acrobat\dc\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extension state\how-to-decrypt.txt
- %ALLUSERSPROFILE%\microsoft\network\downloader\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ar\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\bg\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ca\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\cs\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\da\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\de\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_metadata\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\el\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\de\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\es\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\es_419\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\et\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fil\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\en_us\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sk\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\pt_br\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\en_us\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\bg\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ca\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\cs\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\da\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\de\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\el\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\en_gb\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\en_us\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\es\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\es_419\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\et\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\eu\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\fi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ar\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\fil\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\fr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\pl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\no\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\nl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ms\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\lv\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\el\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\lt\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ja\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\it\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\id\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\hu\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\hr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\hi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\he\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_metadata\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\zh_tw\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\zh_cn\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\es_419\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\et\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fil\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\he\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\hi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\hu\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\id\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\it\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ja\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ko\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\lt\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\lv\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\es\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ms\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\vi\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\nl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\no\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pt_br\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pt_pt\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ro\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\pt_pt\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ru\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\en_gb\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sv\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\th\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\tr\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\uk\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sl\how-to-decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\fr\how-to-decrypt.txt
Moves the following files
- from %TEMP%\adobearm.log to %TEMP%\adobearm.log.devillock
- from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv.devillock
- from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv.devillock
- from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv.devillock
- from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv.devillock
- from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv.devillock
- from %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav to %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav.devillock
- from %APPDATA%\adobe\acrobat\dc\tmdocs.sav to %APPDATA%\adobe\acrobat\dc\tmdocs.sav.devillock
- from %TEMP%\dotnetfxsdk.log to %TEMP%\dotnetfxsdk.log.devillock
- from %TEMP%\dotnetfx.log to %TEMP%\dotnetfx.log.devillock
- from %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt to %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt.devillock
- from %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt to %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt.devillock
- from %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt to %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt.devillock
- from %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt to %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt.devillock
- from %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log.devillock
- from %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log.devillock
- from %TEMP%\dd_vcredist_x86_20151216210157.log to %TEMP%\dd_vcredist_x86_20151216210157.log.devillock
- from %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log.devillock
- from %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log.devillock
- from %TEMP%\dd_vcredist_amd64_20151216210341.log to %TEMP%\dd_vcredist_amd64_20151216210341.log.devillock
- from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.devillock
- from %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt.devillock
- from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.devillock
- from %TEMP%\aspnetsetup_00003.log to %TEMP%\aspnetsetup_00003.log.devillock
- from %TEMP%\aspnetsetup_00002.log to %TEMP%\aspnetsetup_00002.log.devillock
- from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.devillock
- from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.devillock
- from %TEMP%\aspnetsetup.log to %TEMP%\aspnetsetup.log.devillock
- from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.devillock
- from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log.devillock
- from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv.devillock
- from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.devillock
Modifies the following files
- %ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xml
- C:\users\public\pictures\sample pictures\lighthouse.jpg
- C:\users\public\pictures\sample pictures\koala.jpg
- C:\users\public\pictures\sample pictures\jellyfish.jpg
- C:\users\public\pictures\sample pictures\hydrangeas.jpg
- C:\users\public\pictures\sample pictures\desert.jpg
- C:\users\public\pictures\sample pictures\chrysanthemum.jpg
- %ALLUSERSPROFILE%\sun\java\java update\jaureglist.xml
- %ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-uninstall.log
- %ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-install.log
- %ALLUSERSPROFILE%\microsoft toolkit\settings.xml
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.dat
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racwmieventdata.dat
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racwmidatabookmarks.dat
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racmetadata.dat
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\cache.dat
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.dat
- %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico
- %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico
- %ALLUSERSPROFILE%\microsoft\office\mysite.ico
- %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico
- %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico
- %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico
- %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr1.dat
- %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr0.dat
- %ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xml
- C:\users\public\pictures\sample pictures\penguins.jpg
- C:\users\public\pictures\sample pictures\tulips.jpg
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''