Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\decrypt-files.txt
- %APPDATA%\microsoft\word\startup\decrypt-files.txt
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\0x29a.db
- D:\decrypt-files.txt
- D:\$recycle.bin\decrypt-files.txt
- D:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- C:\decrypt-files.txt
- C:\$recycle.bin\decrypt-files.txt
- C:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- C:\documents and settings\decrypt-files.txt
- C:\kms\decrypt-files.txt
- C:\msocache\decrypt-files.txt
- C:\perflogs\decrypt-files.txt
- <Current directory>\decrypt-files.txt
- C:\recovery\decrypt-files.txt
- C:\recovery\windowsre\decrypt-files.txt
- C:\users\default\decrypt-files.txt
- C:\users\default\appdata\decrypt-files.txt
- C:\users\default\appdata\roaming\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\cloudstore\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\recent\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\sendto\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessibility\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\system tools\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\decrypt-files.txt
- C:\users\default\appdata\roaming\microsoft\windows\templates\decrypt-files.txt
- C:\users\default\cookies\decrypt-files.txt
- C:\users\default\desktop\decrypt-files.txt
- C:\users\default\documents\decrypt-files.txt
- C:\users\default\documents\my music\decrypt-files.txt
- C:\users\default\documents\my pictures\decrypt-files.txt
- C:\users\default\documents\my videos\decrypt-files.txt
- C:\users\default\downloads\decrypt-files.txt
- C:\users\default\favorites\decrypt-files.txt
- C:\users\default\links\decrypt-files.txt
- C:\users\default\saved games\decrypt-files.txt
- C:\users\public\decrypt-files.txt
- C:\users\public\accountpictures\decrypt-files.txt
- C:\users\public\desktop\decrypt-files.txt
- C:\users\public\documents\decrypt-files.txt
- C:\users\public\documents\my music\decrypt-files.txt
- C:\users\public\documents\my pictures\decrypt-files.txt
- C:\users\public\documents\my videos\decrypt-files.txt
- C:\users\public\downloads\decrypt-files.txt
- C:\users\public\libraries\decrypt-files.txt
- %HOMEPATH%\decrypt-files.txt
- %HOMEPATH%\.oracle_jre_usage\decrypt-files.txt
- %HOMEPATH%\3d objects\decrypt-files.txt
- %HOMEPATH%\appdata\decrypt-files.txt
- %APPDATA%\decrypt-files.txt
- %APPDATA%\adobe\decrypt-files.txt
- %APPDATA%\adobe\flash player\decrypt-files.txt
- %APPDATA%\adobe\flash player\nativecache\decrypt-files.txt
- %APPDATA%\microsoft\decrypt-files.txt
- %APPDATA%\microsoft\addins\decrypt-files.txt
- %APPDATA%\microsoft\bibliography\decrypt-files.txt
- %APPDATA%\microsoft\bibliography\style\decrypt-files.txt
- %APPDATA%\microsoft\credentials\decrypt-files.txt
- %APPDATA%\microsoft\crypto\decrypt-files.txt
- %APPDATA%\microsoft\crypto\keys\decrypt-files.txt
- %APPDATA%\microsoft\crypto\rsa\decrypt-files.txt
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\userdata\decrypt-files.txt
- %APPDATA%\microsoft\internet explorer\userdata\low\decrypt-files.txt
- %APPDATA%\microsoft\network\decrypt-files.txt
- %APPDATA%\microsoft\network\connections\decrypt-files.txt
- %APPDATA%\microsoft\network\connections\pbk\decrypt-files.txt
- %APPDATA%\microsoft\network\connections\pbk\_hiddenpbk\decrypt-files.txt
- %APPDATA%\microsoft\office\decrypt-files.txt
- %APPDATA%\microsoft\office\recent\decrypt-files.txt
- %APPDATA%\microsoft\proof\decrypt-files.txt
- %APPDATA%\microsoft\protect\decrypt-files.txt
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\decrypt-files.txt
- %APPDATA%\microsoft\spelling\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\certificates\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\crls\decrypt-files.txt
- %APPDATA%\microsoft\systemcertificates\my\ctls\decrypt-files.txt
- %APPDATA%\microsoft\templates\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\managed\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\user\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\user\document themes\decrypt-files.txt
- %APPDATA%\microsoft\templates\livecontent\16\user\document themes\1033\decrypt-files.txt
- %APPDATA%\microsoft\uproof\decrypt-files.txt
- %APPDATA%\microsoft\vault\decrypt-files.txt
- %APPDATA%\microsoft\windows\decrypt-files.txt
- %APPDATA%\microsoft\windows\accountpictures\decrypt-files.txt
- %APPDATA%\microsoft\windows\cloudstore\decrypt-files.txt
- %APPDATA%\microsoft\windows\libraries\decrypt-files.txt
- %APPDATA%\microsoft\windows\network shortcuts\decrypt-files.txt
- %APPDATA%\microsoft\windows\printer shortcuts\decrypt-files.txt
- %APPDATA%\microsoft\windows\recent\decrypt-files.txt
- %APPDATA%\microsoft\windows\recent\automaticdestinations\decrypt-files.txt
- %APPDATA%\microsoft\windows\recent\customdestinations\decrypt-files.txt
- %APPDATA%\microsoft\windows\sendto\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\accessibility\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\accessories\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\administrative tools\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\google chrome\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\system tools\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\windows powershell\decrypt-files.txt
- %APPDATA%\microsoft\windows\start menu\programs\winrar\decrypt-files.txt
- %APPDATA%\microsoft\windows\templates\decrypt-files.txt
- %APPDATA%\microsoft\windows\themes\decrypt-files.txt
- %APPDATA%\microsoft\windows\themes\cachedfiles\decrypt-files.txt
- %APPDATA%\microsoft\word\decrypt-files.txt
- %APPDATA%\mozilla\decrypt-files.txt
- %APPDATA%\mozilla\extensions\decrypt-files.txt
- %APPDATA%\mozilla\firefox\decrypt-files.txt
- %APPDATA%\mozilla\firefox\crash reports\decrypt-files.txt
- %APPDATA%\mozilla\firefox\crash reports\events\decrypt-files.txt
- %APPDATA%\mozilla\firefox\pending pings\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\events\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\deletion_request\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\events\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\pending_pings\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\tmp\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\minidumps\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\security_state\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\temporary\decrypt-files.txt
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\decrypt-files.txt
- %APPDATA%\mozilla\systemextensionsdev\decrypt-files.txt
- %APPDATA%\opera software\decrypt-files.txt
- %APPDATA%\opera software\opera stable\decrypt-files.txt
- %APPDATA%\opera software\opera stable\dictionaries\decrypt-files.txt
- %APPDATA%\opera software\opera stable\extension state\decrypt-files.txt
- %APPDATA%\opera software\opera stable\jump list icons\decrypt-files.txt
- %APPDATA%\opera software\opera stable\local storage\decrypt-files.txt
- %APPDATA%\opera software\opera stable\themes_backup\decrypt-files.txt
- %APPDATA%\opera software\opera stable\widevinecdm\decrypt-files.txt
- %APPDATA%\sun\decrypt-files.txt
- %APPDATA%\sun\java\decrypt-files.txt
- %APPDATA%\sun\java\deployment\decrypt-files.txt
- %APPDATA%\telegram desktop\decrypt-files.txt
- %APPDATA%\thunderbird\decrypt-files.txt
- %APPDATA%\thunderbird\crash reports\decrypt-files.txt
- %APPDATA%\thunderbird\crash reports\events\decrypt-files.txt
- %APPDATA%\thunderbird\pending pings\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\b376zl1q.default\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\events\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\minidumps\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\default\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decrypt-files.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\temporary\decrypt-files.txt
- %HOMEPATH%\contacts\decrypt-files.txt
- %HOMEPATH%\cookies\decrypt-files.txt
- %HOMEPATH%\desktop\decrypt-files.txt
- %HOMEPATH%\documents\decrypt-files.txt
- %HOMEPATH%\documents\my music\decrypt-files.txt
- %HOMEPATH%\documents\my pictures\decrypt-files.txt
- %HOMEPATH%\documents\my videos\decrypt-files.txt
- %HOMEPATH%\downloads\decrypt-files.txt
- %HOMEPATH%\favorites\decrypt-files.txt
- %HOMEPATH%\favorites\links\decrypt-files.txt
- %HOMEPATH%\links\decrypt-files.txt
- %HOMEPATH%\pictures\camera roll\decrypt-files.txt
- %HOMEPATH%\saved games\decrypt-files.txt
- %HOMEPATH%\searches\decrypt-files.txt
- %TEMP%\000.bmp
- %APPDATA%\microsoft\speech\files\userlexicons\sp_1ac4c8f9ddfb41f68f665e631938ae55.dat
Moves the following system files
- from C:\recovery\windowsre\boot.sdi to C:\recovery\windowsre\boot.sdi.4e68
- from C:\recovery\windowsre\reagent.xml to C:\recovery\windowsre\reagent.xml.aydfs
- from C:\recovery\windowsre\winre.wim to C:\recovery\windowsre\winre.wim.ncnw
Moves the following files
- from %APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl to %APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl.4drvp0
- from %APPDATA%\microsoft\bibliography\style\chicago.xsl to %APPDATA%\microsoft\bibliography\style\chicago.xsl.4drvp0
- from %APPDATA%\microsoft\bibliography\style\gb.xsl to %APPDATA%\microsoft\bibliography\style\gb.xsl.uhaw4a
- from %APPDATA%\microsoft\bibliography\style\gostname.xsl to %APPDATA%\microsoft\bibliography\style\gostname.xsl.uhaw4a
- from %APPDATA%\microsoft\bibliography\style\gosttitle.xsl to %APPDATA%\microsoft\bibliography\style\gosttitle.xsl.7uj5nhu
- from %APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl to %APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl.7uj5nhu
- from %APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl to %APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl.o08p
- from %APPDATA%\microsoft\bibliography\style\iso690.xsl to %APPDATA%\microsoft\bibliography\style\iso690.xsl.o08p
- from %APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl to %APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl.9mrok
- from %APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl to %APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl.9mrok
- from %APPDATA%\microsoft\bibliography\style\sist02.xsl to %APPDATA%\microsoft\bibliography\style\sist02.xsl.hljbq
- from %APPDATA%\microsoft\bibliography\style\turabian.xsl to %APPDATA%\microsoft\bibliography\style\turabian.xsl.hljbq
- from %APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400 to %APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400.hljbq
- from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400.2k8ex
- from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.5azaf4
- from %APPDATA%\microsoft\office\recent\index.dat to %APPDATA%\microsoft\office\recent\index.dat.8kvj
- from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.az06
- from %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a to %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a.az06
- from %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\39cc278d-3b17-4d71-aa60-d4d7a3dee22c to %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\39cc278d-3b17-4d71-aa60-d4d7a3dee22c.az06
- from %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred.qaybb
- from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm.4yrlq
- from %APPDATA%\Microsoft\Templates\~$Normal.dotm to %APPDATA%\microsoft\templates\~$normal.dotm.4yrlq
- from %APPDATA%\microsoft\uproof\custom.dic to %APPDATA%\microsoft\uproof\custom.dic.4yrlq
- from %APPDATA%\microsoft\windows\libraries\cameraroll.library-ms to %APPDATA%\microsoft\windows\libraries\cameraroll.library-ms.zvpami
- from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\documents.library-ms.zvpami
- from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\music.library-ms.6cjqzl6
- from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\pictures.library-ms.6cjqzl6
- from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\videos.library-ms.obrhrmi
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\5f7b5f1e01b83767.automaticdestinations-ms.obrhrmi
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\6824f4a902c78fbd.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\6824f4a902c78fbd.automaticdestinations-ms.obrhrmi
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms.obrhrmi
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\f8f05350c84c9d76.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\f8f05350c84c9d76.automaticdestinations-ms.obrhrmi
- from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.sijb
- from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.sijb
- from %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail to %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.sijb
- from %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg to %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg.xzmorwx
- from %APPDATA%\microsoft\windows\themes\transcodedwallpaper to %APPDATA%\microsoft\windows\themes\transcodedwallpaper.xzmorwx
- from %APPDATA%\Microsoft\Word\~WRA0003.wbk to %APPDATA%\microsoft\word\~wra0003.wbk.xzmorwx
- from %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856 to %APPDATA%\mozilla\firefox\crash reports\installtime20210823123856.7debvd1
- from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.7debvd1
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addons.json.pszruxw
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4.pszruxw
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\bookmarks-2025-10-27_11_kx2i12ignwmokjfhtrtlyq==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\bookmarkbackups\bookmarks-2025-10-27_11_kx2i12ignwmokjfhtrtlyq==.jsonlz4.pszruxw
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\broadcast-listeners.json.pszruxw
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\compatibility.ini.0ym6
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\containers.json.0ym6
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\crashes\store.json.mozlz4.0ym6
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186024.607ca866-e4d6-4cd9-8292-f41050b95703.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186024.607ca866-e4d6-4cd9-8292-f41050b95703.new-profile.jsonlz4.stua
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186237.f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186237.f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.event.jsonlz4.stua
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186300.bf64c134-4580-4cec-a821-b1c0a18188bf.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186300.bf64c134-4580-4cec-a821-b1c0a18188bf.main.jsonlz4.stua
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186304.df151785-6317-4a9b-a34f-33db9e13ed66.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\archived\2024-08\1723427186304.df151785-6317-4a9b-a34f-33db9e13ed66.first-shutdown.jsonlz4.stua
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\data.safe.bin to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\glean\db\data.safe.bin.wcsr5
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\session-state.json.wcsr5
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\state.json.wcsr5
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extension-preferences.json.lnzlfj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions.json.lnzlfj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\formhistory.sqlite.5juii2
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\handlers.json.5juii2
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.5juii2
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.cis7uvh
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\607ca866-e4d6-4cd9-8292-f41050b95703 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\607ca866-e4d6-4cd9-8292-f41050b95703.cis7uvh
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\bf64c134-4580-4cec-a821-b1c0a18188bf to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\bf64c134-4580-4cec-a821-b1c0a18188bf.cis7uvh
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\df151785-6317-4a9b-a34f-33db9e13ed66 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\df151785-6317-4a9b-a34f-33db9e13ed66.cis7uvh
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\f25f5a62-89ef-4fa6-bcd1-17fb20e245e0 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\saved-telemetry-pings\f25f5a62-89ef-4fa6-bcd1-17fb20e245e0.8als1rj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4.8als1rj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessioncheckpoints.json.8als1rj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\previous.jsonlz4.8als1rj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.baklz4.8als1rj
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\recovery.jsonlz4.ao05pgv
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessionstore-backups\upgrade.jsonlz4-20210823123856.ao05pgv
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shield-preference-experiments.json.ao05pgv
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.ao05pgv
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\.metadata-v2.q4yz
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\.metadata-v2.d3vo9
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.d3vo9
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.ed3w8m
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.ed3w8m
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.ed3w8m
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.ed3w8m
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.zsyjka
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\times.json.zsyjka
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.zsyjka
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\xulstore.json.zsyjka
- from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\times.json to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\times.json.6gv6ak
- from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.6gv6ak
- from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.6gv6ak
- from %APPDATA%\opera software\opera stable\91bb.tmp to %APPDATA%\opera software\opera stable\91bb.tmp.ct2npjp
- from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.ct2npjp
- from %APPDATA%\opera software\opera stable\current session to %APPDATA%\opera software\opera stable\current session.ct2npjp
- from %APPDATA%\opera software\opera stable\default_partner_content.json to %APPDATA%\opera software\opera stable\default_partner_content.json.98or48s
- from %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml to %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml.98or48s
- from %APPDATA%\opera software\opera stable\extension state\000003.log to %APPDATA%\opera software\opera stable\extension state\000003.log.aqjllok
- from %APPDATA%\opera software\opera stable\extension state\current to %APPDATA%\opera software\opera stable\extension state\current.aqjllok
- from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\log.aqjllok
- from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\manifest-000001.aqjllok
- from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.aqjllok
- from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.qjcs
- from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.qjcs
- from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.qjcs
- from %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome_startpage_0.localstorage.qjcs
- from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.qjcs
- from %APPDATA%\opera software\opera stable\network persistent state to %APPDATA%\opera software\opera stable\network persistent state.fzoqw
- from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.fzoqw
- from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.fzoqw
- from %APPDATA%\opera software\opera stable\ssdfp1252.0.1802400714 to %APPDATA%\opera software\opera stable\ssdfp1252.0.1802400714.fzoqw
- from %APPDATA%\opera software\opera stable\ssdfp1252.6.1555693585 to %APPDATA%\opera software\opera stable\ssdfp1252.6.1555693585.fzoqw
- from %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip to %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip.ragmqz
- from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.ragmqz
- from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.ragmqz
- from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.xoctxt
- from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.sbej
- from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\unins000.dat.wgipc
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.wgipc
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.ginnt
- from %APPDATA%\thunderbird\profiles\b376zl1q.default\times.json to %APPDATA%\thunderbird\profiles\b376zl1q.default\times.json.ginnt
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\abook.sqlite.t85jrf
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addons.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addons.json.t85jrf
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addonstartup.json.lz4.t85jrf
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\blist.sqlite.xqs7bm
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\compatibility.ini.xqs7bm
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite.8mlsku
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4.8mlsku
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1df428.new-profile.jsonlz4.bhnpjy6
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb050509c4.main.jsonlz4.bhnpjy6
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.first-shutdown.jsonlz4.bhnpjy6
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\session-state.json.bhnpjy6
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\state.json.bhnpjy6
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\directorytree.json.bhnpjy6
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\enigmail.sqlite.0lyz
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extension-preferences.json.0lyz
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions.json.0lyz
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\favicons.sqlite.ycatio
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\formhistory.sqlite.ycatio
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\global-messages-db.sqlite.cb2zqz
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\history.sqlite.9vopxqq
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\openpgp.sqlite.nigw
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\permissions.sqlite.nigw
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.qy2j
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite.h2crs
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.ylweae
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83.ylweae
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428.ylweae
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4.ylweae
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\search.json.mozlz4.ylweae
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sessioncheckpoints.json.ylweae
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2.vsokrzm
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.9fc7b6w
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage.sqlite.9fc7b6w
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\times.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\times.json.9fc7b6w
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\webappsstore.sqlite.9fc7b6w
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xulstore.json.mtqm
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.mtqm
Modifies the following files
- C:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget
- C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink
- C:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail
- C:\users\default\ntuser.dat.log1
- C:\users\default\ntuser.dat.log2
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tm.blf
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000001.regtrans-ms
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000002.regtrans-ms
- C:\users\public\libraries\recordedtv.library-ms
- %HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp
- %APPDATA%\microsoft\bibliography\style\apasixtheditionofficeonline.xsl
- %APPDATA%\microsoft\bibliography\style\chicago.xsl
- %APPDATA%\microsoft\bibliography\style\gb.xsl
- %APPDATA%\microsoft\bibliography\style\gostname.xsl
- %APPDATA%\microsoft\bibliography\style\gosttitle.xsl
- %APPDATA%\microsoft\bibliography\style\harvardanglia2008officeonline.xsl
- %APPDATA%\microsoft\bibliography\style\ieee2006officeonline.xsl
- %APPDATA%\microsoft\bibliography\style\iso690.xsl
- %APPDATA%\microsoft\bibliography\style\iso690nmerical.xsl
- %APPDATA%\microsoft\bibliography\style\mlaseventheditionofficeonline.xsl
- %APPDATA%\microsoft\bibliography\style\sist02.xsl
- %APPDATA%\microsoft\bibliography\style\turabian.xsl
- %APPDATA%\microsoft\crypto\keys\de7cf8a7901d2ad13e5c67c29e5d1662_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %APPDATA%\microsoft\office\mso1033.acl
- %APPDATA%\microsoft\office\recent\index.dat
- %APPDATA%\microsoft\protect\credhist
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\38ccf745-2ede-4301-8248-5a19e1f1901a
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\39cc278d-3b17-4d71-aa60-d4d7a3dee22c
- %APPDATA%\microsoft\protect\s-1-5-21-4226853953-3309226944-3078887307-1000\preferred
Modifies multiple files.
Substitutes the following files
- %APPDATA%\Microsoft\Windows\Themes\CachedFiles\CachedImage_1152_864_POS2.jpg
- %APPDATA%\Microsoft\Windows\Themes\TranscodedWallpaper
- %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '91.##8.114.4':80
- '91.##8.114.4':443
- '91.##8.114.11':80
- '91.##8.114.25':80
- '91.##8.114.26':80
TCP
HTTP GET requests
HTTP POST requests
- http://91.##8.114.4/layhvfjr.cgi?qa###############
- http://91.##8.114.4/tniybhvxha.action?ig##################################
Other
- '91.##8.114.4':443
Miscellaneous
Executes the following
- '<SYSTEM32>\wbem\wmic.exe' shadowcopy delete' (with hidden window)