Trojan.Encoder.42191

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\smsss

Creates the following files on removable media

<Drive name for removable media>:\data breach warning.txt
<Drive name for removable media>:\fnsym5r5i.readme.txt

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'%WINDIR%\syswow64\net.exe' stop "Acronis VSS Provider" /y
'%WINDIR%\syswow64\net.exe' stop "Enterprise Client Service" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Agent" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos AutoUpdate Service" /y

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe

Terminates or attempts to terminate

the following user processes:

firefox.exe
iexplore.exe

Modifies file system

Creates the following files

%TEMP%\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\fnsym5r5i.readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\entries\fnsym5r5i.readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\fnsym5r5i.readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\safebrowsing\google4\fnsym5r5i.readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\safebrowsing\fnsym5r5i.readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\startupcache\fnsym5r5i.readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\fnsym5r5i.readme.txt
%LOCALAPPDATA%\thunderbird\profiles\fnsym5r5i.readme.txt
%LOCALAPPDATA%\thunderbird\fnsym5r5i.readme.txt
%LOCALAPPDATA%\data breach warning.txt.fnsym5r5i
%LOCALAPPDATA%\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\mozilla\temp-{28060726-42ae-4e49-b300-93149d394ff5}\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\mozilla\temp-{bc1f1f78-2666-4310-aef7-f6fd5ba4bc43}\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\mozilla\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\oracle\java\au\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\oracle\java\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\oracle\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\fnsym5r5i.readme.txt
%TEMP%\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\fnsym5r5i.readme.txt
%ProgramFiles(x86)%\uninstall information\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\security\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\fnsym5r5i.readme.txt
%APPDATA%\identities\{1bba5dcd-58f3-46ae-861d-68cf42722c36}\fnsym5r5i.readme.txt
%APPDATA%\identities\fnsym5r5i.readme.txt
%APPDATA%\media center programs\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\fnsym5r5i.readme.txt
%ProgramFiles(x86)%\uninstall information\de2762679da881
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\mozilla\temp-{12c7f776-de07-4d8a-a6eb-93019fcb4f66}\fnsym5r5i.readme.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\cache2\doomed\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\fnsym5r5i.readme.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\q0evdndb.default\fnsym5r5i.readme.txt
%TEMP%\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
%WINDIR%\pchealth\errorrep\powershell.exe
D:\readme.txt.fnsym5r5i
D:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted.fnsym5r5i
D:\fnsym5r5i.readme.txt
C:\kms\readme.txt.fnsym5r5i
C:\kms\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted.fnsym5r5i
C:\kms\6ccacd8608530f.fnsym5r5i
C:\kms\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\fnsym5r5i.readme.txt
%APPDATA%\adobe\update.exe
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\fnsym5r5i.readme.txt
%TEMP%\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\application\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\user data\caps\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\user data\evwhitelist\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\user data\pepperflash\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\user data\pnacl\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\user data\widevinecdm\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\user data\swiftshader\fnsym5r5i.readme.txt
%TEMP%\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
%ProgramFiles%\mozilla thunderbird\readme.txt
%ProgramFiles%\uninstall information\readme.txt
%HOMEPATH%\fnsym5r5i.readme.txt.ahiflnjot
%ProgramFiles%\reference assemblies\readme.txt
%HOMEPATH%\data breach warning.txt.fnsym5r5i.ahiflnjot
%ProgramFiles%\msbuild\readme.txt
%HOMEPATH%\ahiflnjot.readme.txt
C:\users\readme.txt.ahiflnjot
C:\users\kivrkp4g24s35ponzgvbepo7zstqmsseeimbkox3zssy7d4y5kuq7.dragonforce_encrypted.ahiflnjot
C:\users\fnsym5r5i.readme.txt.ahiflnjot
C:\users\ahiflnjot.readme.txt
<Current directory>\kivrkp4g24s35ponzgvbepo7zstqmsseeimbkox3zssy7d4y5kuq7.dragonforce_encrypted.ahiflnjot
%LOCALAPPDATA%\thunderbird\profiles\dm02c46v.default\fnsym5r5i.readme.txt
<Current directory>\fnsym5r5i.readme.txt.ahiflnjot
<Current directory>\ahiflnjot.readme.txt
C:\readme.txt.fnsym5r5i.ahiflnjot
C:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted.fnsym5r5i.ahiflnjot
C:\fnsym5r5i.readme.txt.ahiflnjot
C:\ahiflnjot.readme.txt
%TEMP%\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
%APPDATA%\mgxdd.vbs
%TEMP%\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
%ALLUSERSPROFILE%\ahiflnjot.ico
%LOCALAPPDATA%\google\chrome\user data\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\chrome\fnsym5r5i.readme.txt
%LOCALAPPDATA%\google\fnsym5r5i.readme.txt
%ProgramFiles%\microsoft sync framework\readme.txt
%ProgramFiles%\microsoft sql server compact edition\readme.txt
%ProgramFiles%\microsoft office\readme.txt
%ProgramFiles%\microsoft analysis services\readme.txt
%ProgramFiles%\java\readme.txt
%ProgramFiles%\internet explorer\readme.txt
%ProgramFiles%\dvd maker\readme.txt
%CommonProgramFiles%\readme.txt
C:\msocache\all users\readme.txt
<Current directory>\readme.txt
%ProgramFiles(x86)%\windows photo viewer\en-us\69ddcba757bf72
%ProgramFiles(x86)%\windows photo viewer\en-us\smss.exe
C:\users\readme.txt
C:\recovery\readme.txt
C:\kms\6ccacd8608530f
C:\kms\idle.exe
%WINDIR%\branding\shellbrd\98994d21571dda
%WINDIR%\branding\shellbrd\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
%TEMP%\6fc79d7d50b4fe.fnsym5r5i
%WINDIR%\pchealth\errorrep\e978f868350d50
%ProgramFiles%\mozilla firefox\readme.txt
%TEMP%\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
%ProgramFiles%\microsoft synchronization services\readme.txt
%TEMP%\wpdnse\fnsym5r5i.readme.txt
%LOCALAPPDATA%\microsoft help\fnsym5r5i.readme.txt
%TEMP%\opera installer\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\doomed\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\entries\4dcacdd154d23ce903bf34716afe0fbdc08801f3.fnsym5r5i
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\entries\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\offlinecache\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\safebrowsing\google4\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\safebrowsing\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\thumbnails\fnsym5r5i.readme.txt
%APPDATA%\mozilla\extensions\fnsym5r5i.readme.txt
%TEMP%\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\fnsym5r5i.readme.txt
%LOCALAPPDATA%\programs\common\fnsym5r5i.readme.txt
%LOCALAPPDATA%\programs\fnsym5r5i.readme.txt
%TEMP%\hsperfdata_user\fnsym5r5i.readme.txt
%TEMP%\low\fnsym5r5i.readme.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\fnsym5r5i.readme.txt
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\fnsym5r5i.readme.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\fnsym5r5i.readme.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\fnsym5r5i.readme.txt
<Current directory>\readme.txt.ahiflnjot
%APPDATA%\mozilla\firefox\crash reports\events\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\fnsym5r5i.readme.txt
%HOMEPATH%\saved games\data breach warning.txt
%HOMEPATH%\recent\data breach warning.txt
%HOMEPATH%\sendto\data breach warning.txt
%HOMEPATH%\searches\data breach warning.txt
%HOMEPATH%\nethood\data breach warning.txt
%HOMEPATH%\printhood\data breach warning.txt
%HOMEPATH%\local settings\data breach warning.txt
%HOMEPATH%\links\data breach warning.txt
%HOMEPATH%\favorites\windows live\data breach warning.txt
%HOMEPATH%\favorites\msn websites\data breach warning.txt
%HOMEPATH%\favorites\microsoft websites\data breach warning.txt
%HOMEPATH%\favorites\links for united states\data breach warning.txt
%HOMEPATH%\documents\my videos\data breach warning.txt
%HOMEPATH%\favorites\links\data breach warning.txt
%HOMEPATH%\favorites\data breach warning.txt
%HOMEPATH%\downloads\data breach warning.txt
%HOMEPATH%\documents\my pictures\data breach warning.txt
%TEMP%\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
%HOMEPATH%\documents\my music\data breach warning.txt
%HOMEPATH%\desktop\data breach warning.txt
%HOMEPATH%\documents\data breach warning.txt
%HOMEPATH%\contacts\data breach warning.txt
%HOMEPATH%\cookies\data breach warning.txt
%HOMEPATH%\templates\data breach warning.txt
D:\data breach warning.txt
C:\fnsym5r5i.readme.txt
%ALLUSERSPROFILE%\readme.txt
%TEMP%\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
%ProgramFiles(x86)%\readme.txt
%ProgramFiles%\readme.txt
C:\msocache\readme.txt
C:\kms\readme.txt
D:\readme.txt
C:\readme.txt
%HOMEPATH%\desktop\gfbwxjwe.log
%TEMP%\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
C:\users\public\documents\my music\data breach warning.txt
C:\users\public\log.log
%ALLUSERSPROFILE%\kernelquick.sys
%TEMP%\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
%ALLUSERSPROFILE%\fnsym5r5i.ico
%TEMP%\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
%TEMP%\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
%TEMP%\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
m:\data breach warning.txt
%HOMEPATH%\start menu\data breach warning.txt
<Current directory>\data breach warning.txt
%HOMEPATH%\application data\data breach warning.txt
%HOMEPATH%\data breach warning.txt
C:\users\public\videos\sample videos\data breach warning.txt
C:\users\default\documents\my music\data breach warning.txt
C:\users\default\cookies\data breach warning.txt
C:\users\default\desktop\data breach warning.txt
C:\users\default\application data\data breach warning.txt
C:\users\default\data breach warning.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\data breach warning.txt
C:\recovery\data breach warning.txt
C:\kms\data breach warning.txt
C:\documents and settings\data breach warning.txt
C:\data breach warning.txt
%TEMP%\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
%TEMP%\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
%TEMP%\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
%TEMP%\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
%TEMP%\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
%TEMP%\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
%TEMP%\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
%TEMP%\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
%TEMP%\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
%TEMP%\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
C:\users\default\documents\my pictures\data breach warning.txt
C:\users\default\links\data breach warning.txt
C:\users\default\documents\data breach warning.txt
C:\users\default\local settings\data breach warning.txt
C:\users\public\recorded tv\sample media\data breach warning.txt
C:\users\default\downloads\data breach warning.txt
C:\users\public\recorded tv\data breach warning.txt
C:\users\public\pictures\sample pictures\data breach warning.txt
C:\users\public\favorites\data breach warning.txt
C:\users\public\music\sample music\data breach warning.txt
C:\users\public\libraries\data breach warning.txt
C:\users\public\downloads\data breach warning.txt
C:\users\public\documents\my videos\data breach warning.txt
C:\users\default\saved games\data breach warning.txt
C:\users\public\documents\my pictures\data breach warning.txt
%TEMP%\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
C:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted.fnsym5r5i
C:\users\public\documents\data breach warning.txt
C:\users\default\sendto\data breach warning.txt
C:\users\public\data breach warning.txt
C:\users\default\templates\data breach warning.txt
C:\users\default\start menu\data breach warning.txt
C:\users\default\nethood\data breach warning.txt
C:\users\default\recent\data breach warning.txt
C:\users\default\documents\my videos\data breach warning.txt
C:\users\default\favorites\data breach warning.txt
C:\users\default\printhood\data breach warning.txt
C:\users\public\desktop\data breach warning.txt
%HOMEPATH%\documents\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\pending pings\fnsym5r5i.readme.txt
<Current directory>\data breach warning.txt.fnsym5r5i
%TEMP%\6fc79d7d50b4fe
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\fnsym5r5i.readme.txt
%APPDATA%\mozilla\systemextensionsdev\fnsym5r5i.readme.txt
%APPDATA%\mozilla\fnsym5r5i.readme.txt
%APPDATA%\telegram desktop\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\crash reports\events\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\crash reports\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\pending pings\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\dm02c46v.default\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\events\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\minidumps\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\events\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\minidumps\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\security_state\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\fnsym5r5i.readme.txt
C:\readme.txt.fnsym5r5i
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.fnsym5r5i
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.fnsym5r5i
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\fnsym5r5i.readme.txt
%HOMEPATH%\music\data breach warning.txt.fnsym5r5i
%HOMEPATH%\links\fnsym5r5i.readme.txt
%HOMEPATH%\pictures\data breach warning.txt.fnsym5r5i
%HOMEPATH%\music\fnsym5r5i.readme.txt
%HOMEPATH%\saved games\data breach warning.txt.fnsym5r5i
%HOMEPATH%\pictures\fnsym5r5i.readme.txt
%HOMEPATH%\saved games\fnsym5r5i.readme.txt
%HOMEPATH%\searches\data breach warning.txt.fnsym5r5i
%HOMEPATH%\videos\data breach warning.txt.fnsym5r5i
%HOMEPATH%\searches\fnsym5r5i.readme.txt
%HOMEPATH%\videos\fnsym5r5i.readme.txt
%HOMEPATH%\desktop\cpyxbzgg.log
%HOMEPATH%\desktop\szouamxa.log
%HOMEPATH%\desktop\soypdbhw.log
%HOMEPATH%\desktop\cxrfndme.log
%HOMEPATH%\desktop\vadfkpsp.log
%HOMEPATH%\data breach warning.txt.fnsym5r5i
%HOMEPATH%\fnsym5r5i.readme.txt
C:\users\data breach warning.txt.fnsym5r5i
C:\users\fnsym5r5i.readme.txt
%HOMEPATH%\favorites\fnsym5r5i.readme.txt
%HOMEPATH%\favorites\data breach warning.txt.fnsym5r5i
%HOMEPATH%\links\data breach warning.txt.fnsym5r5i
%HOMEPATH%\favorites\windows live\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\fnsym5r5i.readme.txt
%HOMEPATH%\favorites\windows live\data breach warning.txt.fnsym5r5i
%APPDATA%\thunderbird\profiles\fnsym5r5i.readme.txt
%APPDATA%\thunderbird\fnsym5r5i.readme.txt
%APPDATA%\data breach warning.txt.fnsym5r5i
%APPDATA%\fnsym5r5i.readme.txt
%HOMEPATH%\appdata\fnsym5r5i.readme.txt
%HOMEPATH%\contacts\data breach warning.txt.fnsym5r5i
%HOMEPATH%\contacts\fnsym5r5i.readme.txt
%HOMEPATH%\desktop\data breach warning.txt.fnsym5r5i
%HOMEPATH%\desktop\fnsym5r5i.readme.txt
%APPDATA%\mozilla\firefox\crash reports\fnsym5r5i.readme.txt
<Current directory>\fnsym5r5i.readme.txt
%HOMEPATH%\downloads\data breach warning.txt.fnsym5r5i
%HOMEPATH%\downloads\fnsym5r5i.readme.txt
%HOMEPATH%\favorites\links\data breach warning.txt.fnsym5r5i
%HOMEPATH%\favorites\links\fnsym5r5i.readme.txt
%HOMEPATH%\favorites\links for united states\data breach warning.txt.fnsym5r5i
%HOMEPATH%\favorites\links for united states\fnsym5r5i.readme.txt
%HOMEPATH%\favorites\microsoft websites\data breach warning.txt.fnsym5r5i
%HOMEPATH%\favorites\microsoft websites\fnsym5r5i.readme.txt
%HOMEPATH%\favorites\msn websites\data breach warning.txt.fnsym5r5i
%HOMEPATH%\favorites\msn websites\fnsym5r5i.readme.txt
%HOMEPATH%\documents\data breach warning.txt.fnsym5r5i
%TEMP%\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe

Moves the following files

from D:\data breach warning.txt to D:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted
from %ProgramFiles%\winrar\winrar.chm to %ProgramFiles%\winrar\5atqmt7w5kr33unz.dragonforce_encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2.fnsym5r5i.ahiflnjot
from %ProgramFiles%\winrar\wincon64.sfx to %ProgramFiles%\winrar\5atqmvdczpdnko7xks2g.dragonforce_encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\temporary\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\mailviews.dat.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\mailviews.dat.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\events\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\events\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.db.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.db.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions\fnsym5r5i.readme.txt.ahiflnjot
from %ProgramFiles%\winrar\zipnew.dat to %ProgramFiles%\winrar\c4trgdxlemr3kpot.dragonforce_encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\minidumps\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\minidumps\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fnsym5r5i.readme.txt.ahiflnjot
from %ProgramFiles%\winrar\zip64.sfx to %ProgramFiles%\winrar\o4trgzitls4t2qg.dragonforce_encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.fnsym5r5i.ahiflnjot
from %ProgramFiles%\winrar\zip.sfx to %ProgramFiles%\winrar\o4trgo7xks2g.dragonforce_encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\links\fnsym5r5i.readme.txt to %HOMEPATH%\links\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\data breach warning.txt.fnsym5r5i to %APPDATA%\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\contacts\fnsym5r5i.readme.txt to %HOMEPATH%\contacts\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\contacts\data breach warning.txt.fnsym5r5i to %HOMEPATH%\contacts\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\desktop\fnsym5r5i.readme.txt to %HOMEPATH%\desktop\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\desktop\data breach warning.txt.fnsym5r5i to %HOMEPATH%\desktop\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\documents\fnsym5r5i.readme.txt to %HOMEPATH%\documents\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\documents\data breach warning.txt.fnsym5r5i to %HOMEPATH%\documents\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\downloads\fnsym5r5i.readme.txt to %HOMEPATH%\downloads\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\downloads\data breach warning.txt.fnsym5r5i to %HOMEPATH%\downloads\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\favorites\links\fnsym5r5i.readme.txt to %HOMEPATH%\favorites\links\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\favorites\links\data breach warning.txt.fnsym5r5i to %HOMEPATH%\favorites\links\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\favorites\links for united states\fnsym5r5i.readme.txt to %HOMEPATH%\favorites\links for united states\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\favorites\links for united states\data breach warning.txt.fnsym5r5i to %HOMEPATH%\favorites\links for united states\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\favorites\microsoft websites\fnsym5r5i.readme.txt to %HOMEPATH%\favorites\microsoft websites\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\favorites\microsoft websites\data breach warning.txt.fnsym5r5i to %HOMEPATH%\favorites\microsoft websites\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\favorites\msn websites\fnsym5r5i.readme.txt to %HOMEPATH%\favorites\msn websites\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\favorites\msn websites\data breach warning.txt.fnsym5r5i to %HOMEPATH%\favorites\msn websites\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\favorites\windows live\fnsym5r5i.readme.txt to %HOMEPATH%\favorites\windows live\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\favorites\windows live\data breach warning.txt.fnsym5r5i to %HOMEPATH%\favorites\windows live\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\favorites\fnsym5r5i.readme.txt to %HOMEPATH%\favorites\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mgxdd.vbs to %APPDATA%\mgxdd.vbs.ahiflnjot
from %HOMEPATH%\appdata\fnsym5r5i.readme.txt to %HOMEPATH%\appdata\fnsym5r5i.readme.txt.ahiflnjot
from %ProgramFiles%\winrar\wincon.sfx to %ProgramFiles%\winrar\5atqmvdczprl3i7p.dragonforce_encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.db.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.db.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json.fnsym5r5i.ahiflnjot
from %ProgramFiles%\winrar\whatsnew.txt to %ProgramFiles%\winrar\5at3fanx4s7reoxtcwug.dragonforce_encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.fnsym5r5i to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles.ini.fnsym5r5i to %APPDATA%\thunderbird\profiles.ini.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\installs.ini.fnsym5r5i to %APPDATA%\thunderbird\installs.ini.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\fnsym5r5i.readme.txt to %APPDATA%\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\favorites\data breach warning.txt.fnsym5r5i to %HOMEPATH%\favorites\data breach warning.txt.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\profiles\dm02c46v.default\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\profiles\dm02c46v.default\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\fnsym5r5i.readme.txt.ahiflnjot
from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\zlrb3anwziq35m7jews35sxxlsyb3dde.dragonforce_encrypted
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\temporary\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite.fnsym5r5i.ahiflnjot
from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\zlrb3anwziq3fan4zarlhmdt2lub5msecwqqp.dragonforce_encrypted
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite-shm.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite-shm.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\minidumps\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\minidumps\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858.fnsym5r5i.ahiflnjot
from %ProgramFiles%\mozilla firefox\accessible.tlb to %ProgramFiles%\mozilla firefox\kliq3soxeztq6dnllsu3ppv.dragonforce_encrypted
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\security_state\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\security_state\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\pending pings\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\pending pings\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json.fnsym5r5i to %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cert9.db.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cert9.db.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles.ini.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles.ini.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\installs.ini.fnsym5r5i to %APPDATA%\mozilla\firefox\installs.ini.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\systemextensionsdev\fnsym5r5i.readme.txt to %APPDATA%\mozilla\systemextensionsdev\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\fnsym5r5i.readme.txt to %APPDATA%\mozilla\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\telegram desktop\unins000.dat.fnsym5r5i to %APPDATA%\telegram desktop\unins000.dat.fnsym5r5i.ahiflnjot
from %APPDATA%\telegram desktop\fnsym5r5i.readme.txt to %APPDATA%\telegram desktop\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\crash reports\events\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\crash reports\events\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\thunderbird\crash reports\installtime20210406220621.fnsym5r5i to %APPDATA%\thunderbird\crash reports\installtime20210406220621.fnsym5r5i.ahiflnjot
from %APPDATA%\thunderbird\crash reports\fnsym5r5i.readme.txt to %APPDATA%\thunderbird\crash reports\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\content-prefs.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\content-prefs.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite-shm.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite-shm.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pluginreg.dat.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pluginreg.dat.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite.fnsym5r5i.ahiflnjot
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\4ytq3mxcezrq2awe4ax32uon2tr67dx3zak3fanklsu3fmxb2yub3.dragonforce_encrypted
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-wal.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-wal.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-shm.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-shm.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\permissions.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\permissions.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\key4.db.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\key4.db.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\fnsym5r5i.readme.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\fnsym5r5i.readme.txt.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite-shm.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite-shm.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json.fnsym5r5i.ahiflnjot
from %HOMEPATH%\links\data breach warning.txt.fnsym5r5i to %HOMEPATH%\links\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\music\fnsym5r5i.readme.txt to %HOMEPATH%\music\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\music\data breach warning.txt.fnsym5r5i to %HOMEPATH%\music\data breach warning.txt.fnsym5r5i.ahiflnjot
from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\times.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.fnsym5r5i
from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.fnsym5r5i
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.fnsym5r5i
from %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json to %APPDATA%\thunderbird\profiles\dm02c46v.default\times.json.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\crashes\store.json.mozlz4.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118155.a231c87b-227a-4be7-9b0a-acb8c08103e2.first-shutdown.jsonlz4.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118154.fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.main.jsonlz4.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\archived\2024-08\1723416118071.e09e81b6-b02f-4209-be75-530270eb15e8.new-profile.jsonlz4.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\state.json.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\datareporting\session-state.json.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\.metadata-v2.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\xulstore.json.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\times.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-wal to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-wal.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-shm to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-shm.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\permissions.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\permissions.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite-shm to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite-shm.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite-shm to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite-shm.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\content-prefs.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\content-prefs.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\search.json.mozlz4.fnsym5r5i
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.fnsym5r5i
from %HOMEPATH%\downloads\data breach warning.txt to %HOMEPATH%\downloads\data breach warning.txt.fnsym5r5i
from %HOMEPATH%\favorites\links\data breach warning.txt to %HOMEPATH%\favorites\links\data breach warning.txt.fnsym5r5i
from %HOMEPATH%\favorites\links for united states\data breach warning.txt to %HOMEPATH%\favorites\links for united states\data breach warning.txt.fnsym5r5i
from %HOMEPATH%\favorites\microsoft websites\data breach warning.txt to %HOMEPATH%\favorites\microsoft websites\data breach warning.txt.fnsym5r5i
from %HOMEPATH%\favorites\msn websites\data breach warning.txt to %HOMEPATH%\favorites\msn websites\data breach warning.txt.fnsym5r5i
from %HOMEPATH%\favorites\windows live\data breach warning.txt to %HOMEPATH%\favorites\windows live\data breach warning.txt.fnsym5r5i
from %HOMEPATH%\favorites\data breach warning.txt to %HOMEPATH%\favorites\data breach warning.txt.fnsym5r5i
from %HOMEPATH%\links\data breach warning.txt to %HOMEPATH%\links\data breach warning.txt.fnsym5r5i
from %HOMEPATH%\saved games\data breach warning.txt to %HOMEPATH%\saved games\data breach warning.txt.fnsym5r5i
from %HOMEPATH%\searches\data breach warning.txt to %HOMEPATH%\searches\data breach warning.txt.fnsym5r5i
from %HOMEPATH%\data breach warning.txt to %HOMEPATH%\data breach warning.txt.fnsym5r5i
from <Current directory>\data breach warning.txt to <Current directory>\data breach warning.txt.fnsym5r5i
from C:\readme.txt to C:\readme.txt.fnsym5r5i
from C:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted to C:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted.fnsym5r5i
from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\2i7r3udtzapfmuoez6.dragonforce_encrypted
from %ProgramFiles%\desktop.ini to %ProgramFiles%\2i7r3udtzapfmuoez6.dragonforce_encrypted
from C:\kms\data breach warning.txt to C:\kms\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted
from C:\data breach warning.txt to C:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted
from %HOMEPATH%\desktop\data breach warning.txt to %HOMEPATH%\desktop\data breach warning.txt.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sessioncheckpoints.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage.sqlite.fnsym5r5i
from %HOMEPATH%\documents\data breach warning.txt to %HOMEPATH%\documents\data breach warning.txt.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extensions.json.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\extension-preferences.json.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\directorytree.json.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\compatibility.ini.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addonstartup.json.lz4.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\addons.json.fnsym5r5i
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.fnsym5r5i
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.fnsym5r5i
from %HOMEPATH%\contacts\data breach warning.txt to %HOMEPATH%\contacts\data breach warning.txt.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json.fnsym5r5i
from <Current directory>\readme.txt to <Current directory>\readme.txt.ahiflnjot
from %ProgramFiles%\mozilla firefox\removed-files to %ProgramFiles%\mozilla firefox\e47quddq2y7fusx4zi7r3.dragonforce_encrypted
from %ProgramFiles%\mozilla thunderbird\update-settings.ini to %ProgramFiles%\mozilla thunderbird\eyp3kpot2tqr3soteitqmsdxlstqmuk.dragonforce_encrypted
from <Current directory>\kivrkp4g24s35ponzgvbepo7zstqmsseeimbkox3zssy7d4y5kuq7.dragonforce_encrypted to <Current directory>\kivrkp4g24s35ponzgvbepo7zstqmsseeimbkox3zssy7d4y5kuq7.dragonforce_encrypted.ahiflnjot
from <Current directory>\fnsym5r5i.readme.txt to <Current directory>\fnsym5r5i.readme.txt.ahiflnjot
from C:\readme.txt.fnsym5r5i to C:\readme.txt.fnsym5r5i.ahiflnjot
from C:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted.fnsym5r5i to C:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted.fnsym5r5i.ahiflnjot
from C:\fnsym5r5i.readme.txt to C:\fnsym5r5i.readme.txt.ahiflnjot
from %ProgramFiles%\mozilla thunderbird\thunderbird.visualelementsmanifest.xml to %ProgramFiles%\mozilla thunderbird\eitb5dx62ys36uo72vrl2uoxeyvqpio22yqq5dxtez3qfdx42s7r3awecwqqp.dragonforce_encrypted
from %ProgramFiles%\mozilla thunderbird\removed-files to %ProgramFiles%\mozilla thunderbird\e47quddq2y7fusx4zi7r3.dragonforce_encrypted
from %ProgramFiles%\mozilla thunderbird\precomplete to %ProgramFiles%\mozilla thunderbird\ews35pdczyp3psot2t.dragonforce_encrypted
from %ProgramFiles%\mozilla thunderbird\platform.ini to %ProgramFiles%\mozilla thunderbird\ewq3fan3zas3uox4zstv.dragonforce_encrypted
from %ProgramFiles%\mozilla thunderbird\omni.ja to %ProgramFiles%\mozilla thunderbird\zaqqmu4ez4vv.dragonforce_encrypted
from %ProgramFiles%\mozilla thunderbird\install.log to %ProgramFiles%\mozilla thunderbird\zlrb3anwziqfmdnc2m.dragonforce_encrypted
from %ProgramFiles%\mozilla thunderbird\dependentlibs.list to %ProgramFiles%\mozilla thunderbird\2i7rgsoe2i7qman2zlib3ox2zlsrk.dragonforce_encrypted
from %ProgramFiles%\mozilla thunderbird\crashreporter.ini to %ProgramFiles%\mozilla thunderbird\2zs3fmdke47rgdd7ei7r6ox4zstv.dragonforce_encrypted
from %ProgramFiles%\mozilla thunderbird\application.ini to %ProgramFiles%\mozilla thunderbird\2lpbgdn42zvrkuoczpr37dx4.dragonforce_encrypted
from %ProgramFiles%\mozilla thunderbird\accessible.tlb to %ProgramFiles%\mozilla thunderbird\kliq3soxeztq6dnllsu3ppv.dragonforce_encrypted
from %ProgramFiles%\mozilla firefox\updater.ini to %ProgramFiles%\mozilla firefox\eyp3kpot2ysfmuoez6.dragonforce_encrypted
from %ProgramFiles%\mozilla firefox\update-settings.ini to %ProgramFiles%\mozilla firefox\eyp3kpot2tqr3soteitqmsdxlstqmuk.dragonforce_encrypted
from D:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted to D:\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted.fnsym5r5i
from C:\users\fnsym5r5i.readme.txt to C:\users\fnsym5r5i.readme.txt.ahiflnjot
from C:\users\kivrkp4g24s35ponzgvbepo7zstqmsseeimbkox3zssy7d4y5kuq7.dragonforce_encrypted to C:\users\kivrkp4g24s35ponzgvbepo7zstqmsseeimbkox3zssy7d4y5kuq7.dragonforce_encrypted.ahiflnjot
from %ProgramFiles%\mozilla thunderbird\updater.ini to %ProgramFiles%\mozilla thunderbird\eyp3kpot2ysfmuoez6.dragonforce_encrypted
from C:\users\readme.txt to C:\users\readme.txt.ahiflnjot
from %HOMEPATH%\pictures\data breach warning.txt.fnsym5r5i to %HOMEPATH%\pictures\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\saved games\fnsym5r5i.readme.txt to %HOMEPATH%\saved games\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\saved games\data breach warning.txt.fnsym5r5i to %HOMEPATH%\saved games\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\searches\fnsym5r5i.readme.txt to %HOMEPATH%\searches\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\searches\data breach warning.txt.fnsym5r5i to %HOMEPATH%\searches\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\videos\fnsym5r5i.readme.txt to %HOMEPATH%\videos\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\videos\data breach warning.txt.fnsym5r5i to %HOMEPATH%\videos\data breach warning.txt.fnsym5r5i.ahiflnjot
from %ProgramFiles%\winrar\uninstall.lst to %ProgramFiles%\winrar\5yr37dxxeivqpdwezisrk.dragonforce_encrypted
from %ProgramFiles%\winrar\rarnew.dat to %ProgramFiles%\winrar\e4vr6dxlemr3kpot.dragonforce_encrypted
from %ProgramFiles%\winrar\rarfiles.lst to %ProgramFiles%\winrar\54vr6ix4zi7r3ox2ezug.dragonforce_encrypted
from %ProgramFiles%\winrar\rar.txt to %ProgramFiles%\winrar\54vr6oxtcwug.dragonforce_encrypted
from %ProgramFiles%\winrar\order.htm to %ProgramFiles%\winrar\4as3kso7lstbkdk.dragonforce_encrypted
from %ProgramFiles%\winrar\license.txt to %ProgramFiles%\winrar\4itq3soeez77manpev.dragonforce_encrypted
from %ProgramFiles%\winrar\descript.ion to %ProgramFiles%\winrar\ki7r3pd7zlpbkox4zarg.dragonforce_encrypted
from %ProgramFiles%\winrar\default64.sfx to %ProgramFiles%\winrar\ki7q2poyziun2zwe5znlv.dragonforce_encrypted
from %ProgramFiles%\winrar\default.sfx to %ProgramFiles%\winrar\ki7q2poyziufmtu3og.dragonforce_encrypted
from %HOMEPATH%\fnsym5r5i.readme.txt to %HOMEPATH%\fnsym5r5i.readme.txt.ahiflnjot
from %HOMEPATH%\data breach warning.txt.fnsym5r5i to %HOMEPATH%\data breach warning.txt.fnsym5r5i.ahiflnjot
from %HOMEPATH%\pictures\fnsym5r5i.readme.txt to %HOMEPATH%\pictures\fnsym5r5i.readme.txt.ahiflnjot
from D:\readme.txt to D:\readme.txt.fnsym5r5i
from C:\kms\readme.txt to C:\kms\readme.txt.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\98eb6582-9918-4d79-9779-3f25cee729b9.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\5ef45117-f126-4176-8609-edb7f996f858.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.jsonlz4.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\previous.jsonlz4.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\.metadata-v2.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite-shm to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite-shm.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\e02cbed0-86f0-4963-b66a-5d4a2cc83071.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4.fnsym5r5i
from C:\kms\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted to C:\kms\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117223.e02cbed0-86f0-4963-b66a-5d4a2cc83071.event.jsonlz4.fnsym5r5i
from C:\kms\6ccacd8608530f to C:\kms\6ccacd8608530f.fnsym5r5i
from %ProgramFiles%\mozilla firefox\precomplete to %ProgramFiles%\mozilla firefox\ews35pdczyp3psot2t.dragonforce_encrypted
from %ProgramFiles%\mozilla firefox\platform.ini to %ProgramFiles%\mozilla firefox\ewq3fan3zas3uox4zstv.dragonforce_encrypted
from %ProgramFiles%\mozilla firefox\omni.ja to %ProgramFiles%\mozilla firefox\zaqqmu4ez4vv.dragonforce_encrypted
from %ProgramFiles%\mozilla firefox\install.log to %ProgramFiles%\mozilla firefox\zlrb3anwziqfmdnc2m.dragonforce_encrypted
from %ProgramFiles%\mozilla firefox\firefox.visualelementsmanifest.xml to %ProgramFiles%\mozilla firefox\2str6so3zamfmyx4ezuqfdflzi7qusoeeistupoezlx35mdtlsm3udg.dragonforce_encrypted
from %ProgramFiles%\mozilla firefox\dependentlibs.list to %ProgramFiles%\mozilla firefox\2i7rgsoe2i7qman2zlib3ox2zlsrk.dragonforce_encrypted
from %ProgramFiles%\mozilla firefox\crashreporter.ini to %ProgramFiles%\mozilla firefox\2zs3fmdke47rgdd7ei7r6ox4zstv.dragonforce_encrypted
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\saved-telemetry-pings\71d39899-113e-4a90-b1d6-a0ddeee2b177.fnsym5r5i.ahiflnjot
from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\zivr5dxnzw7r6oxqzlsr5po22yq35dolzsub3dowzstq2soxevrbvdo2.dragonforce_encrypted
from <Current directory>\data breach warning.txt.fnsym5r5i to <Current directory>\kivrkp4g24s35ponzgvbepo7zstqmsseeimbkox3zssy7d4y5kuq7.dragonforce_encrypted
from C:\users\data breach warning.txt.fnsym5r5i to C:\users\kivrkp4g24s35ponzgvbepo7zstqmsseeimbkox3zssy7d4y5kuq7.dragonforce_encrypted
from C:\recovery\data breach warning.txt to C:\recovery\kivrkp4g24s35ponzgvbepo7zstqmsseeimbk.dragonforce_encrypted
from %TEMP%\6fc79d7d50b4fe to %TEMP%\6fc79d7d50b4fe.fnsym5r5i
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2025-02-03_11_de2a2eo29nunltkagq5ija==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2025-02-03_11_de2a2eo29nunltkagq5ija==.jsonlz4.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117246.5ef45117-f126-4176-8609-edb7f996f858.first-shutdown.jsonlz4.fnsym5r5i
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117244.98eb6582-9918-4d79-9779-3f25cee729b9.main.jsonlz4.fnsym5r5i
from %ProgramFiles%\mozilla firefox\application.ini to %ProgramFiles%\mozilla firefox\2lpbgdn42zvrkuoczpr37dx4.dragonforce_encrypted
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4.fnsym5r5i to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4.fnsym5r5i.ahiflnjot

Modifies the following files

C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi.aosit
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url.aosit
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.aosit
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url.aosit
%HOMEPATH%\desktop\telegram.lnk.aosit
%HOMEPATH%\favorites\links\web slice gallery.url.aosit
%HOMEPATH%\desktop\google chrome.lnk.aosit
%HOMEPATH%\desktop\1189.jpeg.aosit
%HOMEPATH%\contacts\user.contact.aosit
C:\users\public\videos\sample videos\wildlife.wmv.aosit
C:\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv.aosit
C:\users\public\music\sample music\kalimba.mp3.aosit
C:\users\public\music\sample music\sleep away.mp3.aosit
C:\users\public\pictures\sample pictures\desert.jpg.aosit
C:\users\public\pictures\sample pictures\chrysanthemum.jpg.aosit
C:\users\public\music\sample music\maid with the flaxen hair.mp3.aosit
C:\users\public\desktop\opera.lnk.aosit
C:\users\public\desktop\acrobat reader dc.lnk.aosit
C:\users\public\desktop\firefox.lnk.aosit
C:\users\public\desktop\mozilla thunderbird.lnk.aosit
C:\users\public\desktop\steam.lnk.aosit
C:\users\public\libraries\recordedtv.library-ms.aosit
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.aosit
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.aosit
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.aosit
C:\users\default\ntuser.dat.log1.aosit
C:\users\default\ntuser.dat.log2.aosit
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.aosit
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.aosit
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url.aosit

Modifies multiple files.

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'15#.#1.34.165':64951
'<LOCALNET>.60.165':445
'<LOCALNET>.60.166':445
'<LOCALNET>.60.167':445
'<LOCALNET>.60.168':445
'<LOCALNET>.60.169':445
'<LOCALNET>.60.170':445
'<LOCALNET>.60.171':445
'<LOCALNET>.60.172':445
'<LOCALNET>.60.173':445
'<LOCALNET>.60.174':445
'<LOCALNET>.60.175':445
'<LOCALNET>.60.162':445
'<LOCALNET>.60.176':445
'<LOCALNET>.60.164':445
'<LOCALNET>.60.178':445
'<LOCALNET>.60.180':445
'<LOCALNET>.60.181':445
'<LOCALNET>.60.182':445
'<LOCALNET>.60.183':445
'<LOCALNET>.60.184':445
'<LOCALNET>.60.185':445
'<LOCALNET>.60.186':445
'<LOCALNET>.60.187':445
'<LOCALNET>.60.188':445
'<LOCALNET>.60.189':445
'<LOCALNET>.60.190':445
'<LOCALNET>.60.177':445
'<LOCALNET>.60.191':445
'<LOCALNET>.60.179':445
'<LOCALNET>.60.163':445
'<LOCALNET>.60.161':445
'<LOCALNET>.60.160':445
'<LOCALNET>.60.132':445
'<LOCALNET>.60.133':445
'<LOCALNET>.60.134':445
'<LOCALNET>.60.135':445
'<LOCALNET>.60.136':445
'<LOCALNET>.60.137':445
'<LOCALNET>.60.138':445
'<LOCALNET>.60.139':445
'<LOCALNET>.60.140':445
'<LOCALNET>.60.141':445
'<LOCALNET>.60.142':445
'<LOCALNET>.60.143':445
'<LOCALNET>.60.130':445
'<LOCALNET>.60.144':445
'<LOCALNET>.60.146':445
'<LOCALNET>.60.147':445
'<LOCALNET>.60.148':445
'<LOCALNET>.60.149':445
'<LOCALNET>.60.150':445
'<LOCALNET>.60.151':445
'<LOCALNET>.60.152':445
'<LOCALNET>.60.153':445
'<LOCALNET>.60.154':445
'<LOCALNET>.60.155':445
'<LOCALNET>.60.156':445
'<LOCALNET>.60.157':445
'<LOCALNET>.60.158':445
'<LOCALNET>.60.145':445
'<LOCALNET>.60.159':445
'<LOCALNET>.60.129':445
'<LOCALNET>.60.131':445
'<LOCALNET>.60.192':445
'<LOCALNET>.60.196':445
'<LOCALNET>.60.229':445
'<LOCALNET>.60.230':445
'<LOCALNET>.60.231':445
'<LOCALNET>.60.232':445
'<LOCALNET>.60.233':445
'<LOCALNET>.60.234':445
'<LOCALNET>.60.235':445
'<LOCALNET>.60.236':445
'<LOCALNET>.60.237':445
'<LOCALNET>.60.238':445
'<LOCALNET>.60.239':445
'<LOCALNET>.60.240':445
'<LOCALNET>.60.227':445
'<LOCALNET>.60.228':445
'<LOCALNET>.60.241':445
'<LOCALNET>.60.244':445
'<LOCALNET>.60.245':445
'<LOCALNET>.60.246':445
'<LOCALNET>.60.247':445
'<LOCALNET>.60.248':445
'<LOCALNET>.60.249':445
'<LOCALNET>.60.250':445
'<LOCALNET>.60.251':445
'<LOCALNET>.60.252':445
'<LOCALNET>.60.253':445
'<LOCALNET>.60.254':445
'<LOCALNET>.1.221':8000
'<LOCALNET>.60.242':445
'<LOCALNET>.60.243':445
'<LOCALNET>.60.226':445
'<LOCALNET>.60.224':445
'<LOCALNET>.60.94':445
'<LOCALNET>.60.197':445
'<LOCALNET>.60.198':445
'<LOCALNET>.60.199':445
'<LOCALNET>.60.200':445
'<LOCALNET>.60.201':445
'<LOCALNET>.60.202':445
'<LOCALNET>.60.203':445
'<LOCALNET>.60.204':445
'<LOCALNET>.60.205':445
'<LOCALNET>.60.206':445
'<LOCALNET>.60.207':445
'<LOCALNET>.60.208':445
'<LOCALNET>.60.209':445
'<LOCALNET>.60.210':445
'<LOCALNET>.60.211':445
'<LOCALNET>.60.212':445
'<LOCALNET>.60.213':445
'<LOCALNET>.60.214':445
'<LOCALNET>.60.215':445
'<LOCALNET>.60.216':445
'<LOCALNET>.60.217':445
'<LOCALNET>.60.218':445
'<LOCALNET>.60.219':445
'<LOCALNET>.60.220':445
'<LOCALNET>.60.221':445
'<LOCALNET>.60.222':445
'<LOCALNET>.60.223':445
'<LOCALNET>.60.193':445
'<LOCALNET>.60.195':445
'<LOCALNET>.60.194':445
'<LOCALNET>.60.128':445
'<LOCALNET>.60.127':445
'<LOCALNET>.60.126':445
'<LOCALNET>.60.34':445
'<LOCALNET>.60.35':445
'<LOCALNET>.60.36':445
'<LOCALNET>.60.37':445
'<LOCALNET>.60.38':445
'<LOCALNET>.60.39':445
'<LOCALNET>.60.40':445
'<LOCALNET>.60.41':445
'<LOCALNET>.60.42':445
'<LOCALNET>.60.43':445
'<LOCALNET>.60.44':445
'<LOCALNET>.60.31':445
'<LOCALNET>.60.45':445
'<LOCALNET>.60.33':445
'<LOCALNET>.60.47':445
'<LOCALNET>.60.49':445
'<LOCALNET>.60.50':445
'<LOCALNET>.60.51':445
'<LOCALNET>.60.52':445
'<LOCALNET>.60.53':445
'<LOCALNET>.60.54':445
'<LOCALNET>.60.55':445
'<LOCALNET>.60.56':445
'<LOCALNET>.60.57':445
'<LOCALNET>.60.58':445
'<LOCALNET>.60.59':445
'<LOCALNET>.60.46':445
'<LOCALNET>.60.30':445
'<LOCALNET>.60.48':445
'<LOCALNET>.60.29':445
'<LOCALNET>.60.28':445
'15#.#3.184.57':4433
'<LOCALNET>.60.1':445
'<LOCALNET>.60.2':445
'<LOCALNET>.60.3':445
'<LOCALNET>.60.4':445
'<LOCALNET>.60.5':445
'<LOCALNET>.60.6':445
'<LOCALNET>.60.7':445
'<LOCALNET>.60.8':445
'<LOCALNET>.60.9':445
'<LOCALNET>.60.10':445
'<LOCALNET>.60.11':445
'<LOCALNET>.60.12':445
'<LOCALNET>.60.13':445
'<LOCALNET>.60.0':445
'<LOCALNET>.60.14':445
'<LOCALNET>.60.16':445
'<LOCALNET>.60.17':445
'<LOCALNET>.60.18':445
'<LOCALNET>.60.19':445
'<LOCALNET>.60.20':445
'<LOCALNET>.60.21':445
'<LOCALNET>.60.22':445
'<LOCALNET>.60.23':445
'<LOCALNET>.60.24':445
'<LOCALNET>.60.25':445
'<LOCALNET>.60.26':445
'<LOCALNET>.60.27':445
'<LOCALNET>.60.60':445
'<LOCALNET>.60.15':445
'<LOCALNET>.60.61':445
'<LOCALNET>.60.32':445
'<LOCALNET>.60.62':445
'<LOCALNET>.60.97':445
'<LOCALNET>.60.99':445
'<LOCALNET>.60.100':445
'<LOCALNET>.60.101':445
'<LOCALNET>.60.102':445
'<LOCALNET>.60.103':445
'<LOCALNET>.60.104':445
'<LOCALNET>.60.105':445
'<LOCALNET>.60.106':445
'<LOCALNET>.60.107':445
'<LOCALNET>.60.108':445
'<LOCALNET>.60.109':445
'<LOCALNET>.60.110':445
'<LOCALNET>.60.111':445
'<LOCALNET>.60.112':445
'<LOCALNET>.60.113':445
'<LOCALNET>.60.114':445
'<LOCALNET>.60.115':445
'<LOCALNET>.60.116':445
'<LOCALNET>.60.117':445
'<LOCALNET>.60.118':445
'<LOCALNET>.60.119':445
'<LOCALNET>.60.120':445
'<LOCALNET>.60.121':445
'<LOCALNET>.60.122':445
'<LOCALNET>.60.123':445
'<LOCALNET>.60.124':445
'<LOCALNET>.60.125':445
'<LOCALNET>.60.96':445
'<LOCALNET>.60.63':445
'<LOCALNET>.60.98':445
'<LOCALNET>.60.225':445
'10#.#71.35.26':9443
'<LOCALNET>.60.93':445
'<LOCALNET>.60.65':445
'<LOCALNET>.60.66':445
'<LOCALNET>.60.67':445
'<LOCALNET>.60.68':445
'<LOCALNET>.60.69':445
'<LOCALNET>.60.70':445
'<LOCALNET>.60.71':445
'<LOCALNET>.60.72':445
'<LOCALNET>.60.73':445
'<LOCALNET>.60.74':445
'<LOCALNET>.60.75':445
'<LOCALNET>.60.76':445
'<LOCALNET>.60.77':445
'<LOCALNET>.60.64':445
'<LOCALNET>.60.78':445
'<LOCALNET>.60.80':445
'<LOCALNET>.60.81':445
'<LOCALNET>.60.82':445
'<LOCALNET>.60.83':445
'<LOCALNET>.60.84':445
'<LOCALNET>.60.85':445
'<LOCALNET>.60.86':445
'<LOCALNET>.60.87':445
'<LOCALNET>.60.88':445
'<LOCALNET>.60.89':445
'<LOCALNET>.60.90':445
'<LOCALNET>.60.91':445
'<LOCALNET>.60.92':445
'<LOCALNET>.60.79':445
'<LOCALNET>.60.95':445
'15#.#3.184.57':10443

TCP

Other

'15#.#3.184.57':4433
'10#.#71.35.26':9443

Miscellaneous

Creates and executes the following

'%TEMP%\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe'
'%TEMP%\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe'
'%APPDATA%\adobe\update.exe' "%TEMP%\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\mGxdd.vbs"
'%TEMP%\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe'
'%TEMP%\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe'
'%TEMP%\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe'
'%TEMP%\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe'
'%TEMP%\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe'
'%TEMP%\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe'
'%TEMP%\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe'
'%TEMP%\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe'
'%TEMP%\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe'
'%TEMP%\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe'
'%TEMP%\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe'
'%TEMP%\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe'
'%TEMP%\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe'
'%TEMP%\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe'
'%TEMP%\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe'
'%TEMP%\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe'
'%TEMP%\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe'
'%TEMP%\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'
'%TEMP%\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe'
'%TEMP%\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe'
'%TEMP%\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe'
'%TEMP%\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe'
'%TEMP%\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe'
'%TEMP%\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe'
'%TEMP%\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe'

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 12 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\smss.exe'" /f
'%WINDIR%\syswow64\net1.exe' stop "Enterprise Client Service" /y
'%WINDIR%\syswow64\net1.exe' stop "Acronis VSS Provider" /y
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://katt.gdn/lp/thanks.php"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://katt.gdn/lp/thanks.php
'%WINDIR%\syswow64\mshta.exe' %TEMP%\SIPxYF0Yn.hta
'%WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe'
'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet
'%WINDIR%\syswow64\net1.exe' stop "Sophos Agent" /y
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn jv5TWmamBar /tr "mshta %TEMP%\SIPxYF0Yn.hta" /sc minute /mo 25 /ru "user" /f
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://katt.gdn/lp/thanks.php /crash-reporter-parent-id=2320
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "& { }"
'%TEMP%\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe' ' (with hidden window)
'%TEMP%\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe' ' (with hidden window)
'%TEMP%\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe' ' (with hidden window)
'%TEMP%\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn jv5TWmamBar /tr "mshta %TEMP%\SIPxYF0Yn.hta" /sc minute /mo 25 /ru "user" /f' (with hidden window)
'%TEMP%\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe' ' (with hidden window)
'%APPDATA%\adobe\update.exe' "%TEMP%\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"' (with hidden window)
'%TEMP%\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe' ' (with hidden window)
'%TEMP%\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe' ' (with hidden window)
'%TEMP%\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe' ' (with hidden window)
'%TEMP%\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe' ' (with hidden window)
'%TEMP%\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe' ' (with hidden window)
'%TEMP%\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe' ' (with hidden window)
'%TEMP%\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe' ' (with hidden window)
'%TEMP%\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe' ' (with hidden window)
'%TEMP%\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe' ' (with hidden window)
'%TEMP%\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe' ' (with hidden window)
'%TEMP%\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe' ' (with hidden window)
'%TEMP%\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe' ' (with hidden window)
'%TEMP%\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe' ' (with hidden window)
'%TEMP%\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe' ' (with hidden window)
'%TEMP%\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe' ' (with hidden window)
'%TEMP%\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe' ' (with hidden window)
'%TEMP%\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe' ' (with hidden window)
'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet' (with hidden window)
'%TEMP%\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe' ' (with hidden window)
'%TEMP%\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe' ' (with hidden window)
'%TEMP%\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe' ' (with hidden window)
'%TEMP%\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe' ' (with hidden window)
'%TEMP%\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe' ' (with hidden window)
'%TEMP%\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe' ' (with hidden window)

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial