Trojan.Encoder.37973

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\vsico4jhpnzjidousm4epmrj.exe

Creates the following files on removable media

<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\accountsreceivable.ppt
<Drive name for removable media>:\sim_gametheory_to_finance.ppt
<Drive name for removable media>:\ksearch_esa_talk.ppt
<Drive name for removable media>:\20140114.rdf
<Drive name for removable media>:\digest.rdf
<Drive name for removable media>:\bg_search_box.png
<Drive name for removable media>:\breakpoint.png
<Drive name for removable media>:\hhhlcert.pem
<Drive name for removable media>:\systisoft.pem
<Drive name for removable media>:\ck_ugo.pem
<Drive name for removable media>:\server.pem
<Drive name for removable media>:\ck.pem
<Drive name for removable media>:\fil_20060629111052.pdf
<Drive name for removable media>:\spib_pima.pdf
<Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf
<Drive name for removable media>:\file1.ppt
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\taxus_baccata.rdf
<Drive name for removable media>:\price030215.zip
<Drive name for removable media>:\excel_example.zip
<Drive name for removable media>:\contractualdeadlines.zip
<Drive name for removable media>:\applicant.xlsx
<Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx
<Drive name for removable media>:\al.xlsx
<Drive name for removable media>:\disclosuredetails.xlsx
<Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx
<Drive name for removable media>:\contractualdeadlines.xls
<Drive name for removable media>:\calculatorworksheet.xls
<Drive name for removable media>:\subjectclassification.xls
<Drive name for removable media>:\excel_example.xls
<Drive name for removable media>:\price030215.xls
<Drive name for removable media>:\removedtitles_records.xls
<Drive name for removable media>:\guide_reorganization_mapping.xls
<Drive name for removable media>:\flower_trans_matte.wmv
<Drive name for removable media>:\babyboymaintoscenesbackground.wmv
<Drive name for removable media>:\babyboymaintoscenesbackground_pal.wmv
<Drive name for removable media>:\fungalnameauthors.rtf
<Drive name for removable media>:\pubnet_855.rtf
<Drive name for removable media>:\router_manual.rtf
<Drive name for removable media>:\phytoremediation.rtf
<Drive name for removable media>:\sioc.rdf
<Drive name for removable media>:\7790_preview.pdf
<Drive name for removable media>:\calibre.png
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\lom602.pdf
<Drive name for removable media>:\10thingscondoms.pdf
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\chromesetup.exe
<Drive name for removable media>:\notepad.exe
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\dotnetfx45_full_setup.exe
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\removedtitles_records.zip
<Drive name for removable media>:\contenttypes.rdf
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\api-hashmap.html
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
<Drive name for removable media>:\video.mp4
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4
<Drive name for removable media>:\video_1.mp4
<Drive name for removable media>:\51.mp4
<Drive name for removable media>:\etc6_m_1.mov
<Drive name for removable media>:\scan.mov
<Drive name for removable media>:\spanner.mov
<Drive name for removable media>:\firefly1.mov
<Drive name for removable media>:\13.jpg
<Drive name for removable media>:\210252809.jpg
<Drive name for removable media>:\region-north-karelia.jpg
<Drive name for removable media>:\pushkin.jpg
<Drive name for removable media>:\168.jpg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\4f0bf7ff71f28.jpeg
<Drive name for removable media>:\parnas_01.jpeg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\region-north-karelia.jpeg
<Drive name for removable media>:\alert.html
<Drive name for removable media>:\adadsi.html
<Drive name for removable media>:\about.html
<Drive name for removable media>:\howto-index.html
<Drive name for removable media>:\---==%$$$open_me_up$$$==---.txt

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

deletes volume shadow copies.

Terminates or attempts to terminate

the following system processes:

%WINDIR%\explorer.exe
System

the following user processes:

iexplore.exe
firefox.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\advice_process.htm
%APPDATA%\thunderbird\profiles.ini
%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\toolbar.bmp

Modifies file system

Creates the following files

D:\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\offlinecache\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\safebrowsing\google4\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\safebrowsing\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\startupcache\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\thumbnails\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\bcjnbgva.default\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\offlinecache\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\safebrowsing\google4\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\safebrowsing\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\startupcache\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\thumbnails\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft help\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\doomed\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\doomed\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\windows sidebar\gadgets\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\internet explorer\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\media player\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\office\groove\system\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\office\groove\user\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\office\groove\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\office\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\new\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\windows mail\stationery\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\windows mail\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\windows media\12.0\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\windows media\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\windows sidebar\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\feeds cache\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\feeds cache\5uzys9tz\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\mozilla\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\mozilla\temp-{6caf41d3-d3bc-4111-be0f-6767486b42d5}\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\mozilla\temp-{9cda0b19-0440-4e70-9631-93e7041926aa}\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\mozilla\temp-{c524df81-3d66-47d3-a687-5ed5a39c6588}\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\mozilla\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\oracle\java\au\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\oracle\java\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\oracle\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\programs\common\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\mozilla\temp-{10ec5a16-76a1-4966-833c-89c100352a7c}\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\microsoft\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\mozilla\temp-{74a94761-d090-449f-b0e6-cb7d26a06c26}\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\microsoft\internet explorer\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\microsoft\internet explorer\services\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\programs\---==%$$$open_me_up$$$==---.txt
%TEMP%\low\---==%$$$open_me_up$$$==---.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\---==%$$$open_me_up$$$==---.txt
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\---==%$$$open_me_up$$$==---.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\---==%$$$open_me_up$$$==---.txt
%TEMP%\opera installer\---==%$$$open_me_up$$$==---.txt
%TEMP%\wpdnse\---==%$$$open_me_up$$$==---.txt
%TEMP%\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\feeds cache\q2xofo16\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\thunderbird\profiles\49zr3fqa.default\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\entries\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\safebrowsing\google4\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\safebrowsing\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\startupcache\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\thunderbird\profiles\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\thunderbird\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\doomed\---==%$$$open_me_up$$$==---.txt
%TEMP%\hsperfdata_user\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\feeds cache\id3ykpjl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\feeds cache\1zlrvj28\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\session storage\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\evwhitelist\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\pepperflash\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\pnacl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\swiftshader\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\widevinecdm\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\credentials\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\microsoft\feeds\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__macosx\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__macosx\_locales\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\minidumps\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\security_state\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.f...
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3561288849sdhlie.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\temporary\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extensions\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2918063365piupsah.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\temporary\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\bookmarkbackups\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\crashes\events\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\crashes\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore-backups\---==%$$$open_me_up$$$==---.txt
%APPDATA%\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\contacts\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\desktop\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\documents\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\downloads\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\favorites\links\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\favorites\links for united states\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\favorites\microsoft websites\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\favorites\msn websites\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\systemextensionsdev\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\favorites\windows live\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\links\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\music\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\pictures\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\saved games\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\searches\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\videos\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\appdata\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\crash reports\events\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\crash reports\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\pending pings\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\49zr3fqa.default\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\events\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\default\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\temporary\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\---==%$$$open_me_up$$$==---.txt
%APPDATA%\telegram desktop\---==%$$$open_me_up$$$==---.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\minidumps\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\minidumps\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\pending pings\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\systemcertificates\my\certificates\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\systemcertificates\my\crls\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\systemcertificates\my\ctls\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\systemcertificates\my\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\systemcertificates\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\extensions\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\crash reports\events\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\crash reports\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\bookmarkbackups\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\events\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\---==%$$$open_me_up$$$==---.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\internet explorer\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\internet explorer\quick launch\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\protect\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\security\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\---==%$$$open_me_up$$$==---.txt
%APPDATA%\identities\---==%$$$open_me_up$$$==---.txt
%APPDATA%\media center programs\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\credentials\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\crypto\rsa\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\crypto\---==%$$$open_me_up$$$==---.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\---==%$$$open_me_up$$$==---.txt
%APPDATA%\identities\{d59a8b31-5854-4768-ba01-cd66beadf546}\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\support\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\oracle\java\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\oracle\java\javapath\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\mozilla\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\mf\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\wpd\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft help\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\mozilla\updates\e7cf176e110c211b\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\mozilla\updates\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\sun\java\java update\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\sun\java\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\sun\---==%$$$open_me_up$$$==---.txt
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\---==%$$$open_me_up$$$==---.txt
C:\recovery\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\local\microsoft\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\local\temp\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\local\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\roaming\media center programs\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\---==%$$$open_me_up$$$==---.txt
C:\users\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\arm\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\setup\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\assistance\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\crypto\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\---==%$$$open_me_up$$$==---.txt
C:\perflogs\---==%$$$open_me_up$$$==---.txt
C:\msocache\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\---==%$$$open_me_up$$$==---.txt
C:\perflogs\admin\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\---==%$$$open_me_up$$$==---.txt
C:\kms\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
<Current directory>\---==%$$$open_me_up$$$==---.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\rac\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\search\data\temp\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\search\data\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\search\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\adobe\arm\s\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\vault\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\rac\temp\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\rac\outbound\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\devicesync\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\drm\server\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\drm\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\ehome\logs\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\ehome\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\media player\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\msdn\8.0\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\network\connections\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\network\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\office\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\microsoft\msdn\---==%$$$open_me_up$$$==---.txt
%HOMEPATH%\favorites\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\roaming\microsoft\---==%$$$open_me_up$$$==---.txt
C:\users\default\documents\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ar\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ca\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\cs\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\da\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\de\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\el\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\en\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\es\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\bg\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fil\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\roaming\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hu\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\zh_cn\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\zh_tw\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\vi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\uk\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\id\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\it\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ja\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ko\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\lt\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\lv\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\nl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\he\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\no\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pt_br\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ro\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ru\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sk\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sv\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\th\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\tr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pt_pt\---==%$$$open_me_up$$$==---.txt
C:\users\default\appdata\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pl\---==%$$$open_me_up$$$==---.txt
%ALLUSERSPROFILE%\oracle\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\caps\---==%$$$open_me_up$$$==---.txt
C:\users\public\desktop\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\cache\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension state\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\__macosx\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\---==%$$$open_me_up$$$==---.txt
C:\users\public\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\databases\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\---==%$$$open_me_up$$$==---.txt
C:\users\public\videos\---==%$$$open_me_up$$$==---.txt
C:\users\public\videos\sample videos\---==%$$$open_me_up$$$==---.txt
C:\users\default\downloads\---==%$$$open_me_up$$$==---.txt
C:\users\default\favorites\---==%$$$open_me_up$$$==---.txt
C:\users\default\links\---==%$$$open_me_up$$$==---.txt
C:\users\default\music\---==%$$$open_me_up$$$==---.txt
C:\users\default\pictures\---==%$$$open_me_up$$$==---.txt
C:\users\default\saved games\---==%$$$open_me_up$$$==---.txt
C:\users\default\videos\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\---==%$$$open_me_up$$$==---.txt
C:\users\default\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\---==%$$$open_me_up$$$==---.txt
C:\users\public\documents\---==%$$$open_me_up$$$==---.txt
C:\users\public\favorites\---==%$$$open_me_up$$$==---.txt
C:\users\public\libraries\---==%$$$open_me_up$$$==---.txt
C:\users\public\music\sample music\---==%$$$open_me_up$$$==---.txt
C:\users\public\music\---==%$$$open_me_up$$$==---.txt
C:\users\public\pictures\sample pictures\---==%$$$open_me_up$$$==---.txt
C:\users\public\pictures\---==%$$$open_me_up$$$==---.txt
C:\users\public\recorded tv\sample media\---==%$$$open_me_up$$$==---.txt
C:\users\default\desktop\---==%$$$open_me_up$$$==---.txt
C:\users\public\recorded tv\---==%$$$open_me_up$$$==---.txt
C:\users\public\downloads\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\---==%$$$open_me_up$$$==---.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\---==%$$$open_me_up$$$==---.txt
C:\---==%$$$open_me_up$$$==---.txt

Deletes the following files

%TEMP%\wpdnse\---==%$$$open_me_up$$$==---.txt

Moves the following files

from %TEMP%\adobearm.log to %TEMP%\adobearm.log_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\places.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\places.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\places.sqlite-shm to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\places.sqlite-shm_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\places.sqlite-wal to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\places.sqlite-wal_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pluginreg.dat to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pluginreg.dat_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\prefs.js to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\prefs.js_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0186ea91-e835-4919-9366-c7e15b92110b to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0186ea91-e835-4919-9366-c7e15b92110b_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0bfb99e9-0e75-47d0-b739-94e23d793342 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0bfb99e9-0e75-47d0-b739-94e23d793342_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\1f6a84f6-29b5-43da-aa85-b8cf32dd80d0 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\1f6a84f6-29b5-43da-aa85-b8cf32dd80d0_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\a847dc89-db3d-4896-9bef-b610ec76e43d to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\a847dc89-db3d-4896-9bef-b610ec76e43d_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\d9d62ad7-4327-4aa9-97e7-aeb5486c45ee to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\d9d62ad7-4327-4aa9-97e7-aeb5486c45ee_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\parent.lock to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\parent.lock_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\permissions.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\permissions.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\ee43e28f-610b-4229-a7d7-171f6ed032bd to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\ee43e28f-610b-4229-a7d7-171f6ed032bd_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessioncheckpoints.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\previous.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\recovery.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\upgrade.jsonlz4-20200708170202_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\shield-preference-experiments.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\.metadata-v2_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.s... to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.s...
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\.metadata-v2_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\search.json.mozlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\securitypreloadstate.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\securitypreloadstate.txt_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\key4.db to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\key4.db_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2918063365piupsah.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\broadcast-listeners.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\compatibility.ini_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\containers.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\containers.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\content-prefs.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\content-prefs.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cookies.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cookies.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cookies.sqlite-wal to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cookies.sqlite-wal_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\crashes\store.json.mozlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160101.d9d62ad7-4327-4aa9-97e7-aeb5486c45ee.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160101.d9d62ad7-4327-4aa9-97e7-aeb5486c45ee.new-profile.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160111.ee43e28f-610b-4229-a7d7-171f6ed032bd.health.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160111.ee43e28f-610b-4229-a7d7-171f6ed032bd.health.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160174.0bfb99e9-0e75-47d0-b739-94e23d793342.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160174.0bfb99e9-0e75-47d0-b739-94e23d793342.event.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160236.a847dc89-db3d-4896-9bef-b610ec76e43d.health.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160236.a847dc89-db3d-4896-9bef-b610ec76e43d.health.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160262.1f6a84f6-29b5-43da-aa85-b8cf32dd80d0.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160262.1f6a84f6-29b5-43da-aa85-b8cf32dd80d0.main.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160264.0186ea91-e835-4919-9366-c7e15b92110b.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160264.0186ea91-e835-4919-9366-c7e15b92110b.first-shutdown.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\session-state.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\state.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extension-preferences.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extensions.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extensions.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\favicons.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\favicons.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\favicons.sqlite-shm to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\favicons.sqlite-shm_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\favicons.sqlite-wal to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\favicons.sqlite-wal_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\formhistory.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\manifest.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\manifest.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\handlers.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\handlers.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3561288849sdhlie.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\key4.db to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\key4.db_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\mailviews.dat to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\mailviews.dat_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\parent.lock to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\parent.lock_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\bookmarkbackups\bookmarks-2023-08-28_11_wowu13vthwkcthdlkwm-la==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\bookmarkbackups\bookmarks-2023-08-28_11_wowu13vthwkcthdlkwm-la==.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\times.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\times.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\trrblacklist.txt to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\trrblacklist.txt_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\user.js to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\user.js_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\webappsstore.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\webappsstore.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\webappsstore.sqlite-shm to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\webappsstore.sqlite-shm_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\webappsstore.sqlite-wal to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\webappsstore.sqlite-wal_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\xulstore.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\xulstore.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini_r00t_{jjcvxn}.payload
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe_r00t_{jjcvxn}.payload
from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\unins000.dat_r00t_{jjcvxn}.payload
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe_r00t_{jjcvxn}.payload
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json to %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cert9.db to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cert9.db_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\compatibility.ini_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js to %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json to %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928165916.log to %TEMP%\dd_vcredist_x86_20220928165916.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928170143.log to %TEMP%\dd_vcredist_x86_20220928170143.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928170221.log to %TEMP%\dd_vcredist_x86_20220928170221.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928170335.log to %TEMP%\dd_vcredist_x86_20220928170335.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928170410.log to %TEMP%\dd_vcredist_x86_20220928170410.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt to %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt_r00t_{jjcvxn}.payload
from %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt to %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt_r00t_{jjcvxn}.payload
from %TEMP%\opera installer\opera_installer_20220928171325.log to %TEMP%\opera installer\opera_installer_20220928171325.log_r00t_{jjcvxn}.payload
from %TEMP%\opera installer\opera_installer_20220928171326.log to %TEMP%\opera installer\opera_installer_20220928171326.log_r00t_{jjcvxn}.payload
from %TEMP%\opera installer\opera_installer_20220928171336.log to %TEMP%\opera installer\opera_installer_20220928171336.log_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\f58155b4b1d5a524ca0261c3ee99fb50_d4602615-9d50-4880-be41-678935e93eaa to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\f58155b4b1d5a524ca0261c3ee99fb50_d4602615-9d50-4880-be41-678935e93eaa_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928165710.log to %TEMP%\dd_vcredist_x86_20220928165710.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928165536.log to %TEMP%\dd_vcredist_x86_20220928165536.log_r00t_{jjcvxn}.payload
from %TEMP%\armui.ini to %TEMP%\armui.ini_r00t_{jjcvxn}.payload
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log_r00t_{jjcvxn}.payload
from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log_r00t_{jjcvxn}.payload
from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt_r00t_{jjcvxn}.payload
from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt_r00t_{jjcvxn}.payload
from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredistmsi7a3c.txt to %TEMP%\dd_vcredistmsi7a3c.txt_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredistui7a3c.txt to %TEMP%\dd_vcredistui7a3c.txt_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165349.log to %TEMP%\dd_vcredist_amd64_20220928165349.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log_r00t_{jjcvxn}.payload
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165628.log to %TEMP%\dd_vcredist_amd64_20220928165628.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165746.log to %TEMP%\dd_vcredist_amd64_20220928165746.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165956.log to %TEMP%\dd_vcredist_amd64_20220928165956.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928170114.log to %TEMP%\dd_vcredist_amd64_20220928170114.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928170250.log to %TEMP%\dd_vcredist_amd64_20220928170250.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928170328.log to %TEMP%\dd_vcredist_amd64_20220928170328.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\bef7f9cf-b0b1-42d8-a037-8d586d4d1e42 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\bef7f9cf-b0b1-42d8-a037-8d586d4d1e42_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\dc5a4164-f290-4a08-a5ec-0fe7810acbc6 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\dc5a4164-f290-4a08-a5ec-0fe7810acbc6_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\f9af9616-8535-4ace-8050-4454f33ad475 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\f9af9616-8535-4ace-8050-4454f33ad475_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\fbcd22a2-e53a-4131-9ef1-1935f505d9ca to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\fbcd22a2-e53a-4131-9ef1-1935f505d9ca_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\search.json.mozlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessioncheckpoints.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore-backups\recovery.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\shield-preference-experiments.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\.metadata-v2_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\.metadata-v2_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\times.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\webappsstore.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\webappsstore.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\permissions.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\permissions.sqlite_r00t_{jjcvxn}.payload
from %TEMP%\dd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\71e6321a-7203-4cd6-882b-58bcea299d05 to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\71e6321a-7203-4cd6-882b-58bcea299d05_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\cd53466d-bb23-48f7-b2ac-adb7029cd1be to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\cd53466d-bb23-48f7-b2ac-adb7029cd1be_r00t_{jjcvxn}.payload
from %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\preferred_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addonstartup.json.lz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\bookmarkbackups\bookmarks-2022-09-28_11_3a7quggif+d7xxwa176j2q==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\bookmarkbackups\bookmarks-2022-09-28_11_3a7quggif+d7xxwa176j2q==.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\broadcast-listeners.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\compatibility.ini_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\containers.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\content-prefs.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\content-prefs.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\store.json.mozlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759331.f9af9616-8535-4ace-8050-4454f33ad475.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759331.f9af9616-8535-4ace-8050-4454f33ad475.new-profile.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759476.fbcd22a2-e53a-4131-9ef1-1935f505d9ca.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759476.fbcd22a2-e53a-4131-9ef1-1935f505d9ca.event.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759547.bef7f9cf-b0b1-42d8-a037-8d586d4d1e42.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759547.bef7f9cf-b0b1-42d8-a037-8d586d4d1e42.main.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759551.dc5a4164-f290-4a08-a5ec-0fe7810acbc6.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759551.dc5a4164-f290-4a08-a5ec-0fe7810acbc6.first-shutdown.jsonlz4_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\session-state.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\state.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extension-preferences.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\favicons.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\favicons.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\formhistory.sqlite_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\handlers.json_r00t_{jjcvxn}.payload
from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\parent.lock to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\parent.lock_r00t_{jjcvxn}.payload
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini_r00t_{jjcvxn}.payload

Modifies the following files

D:\install.log
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
C:\kms\kms_vl_all_aio_debug.log
C:\kms\kms_vl_all_aio.cmd
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_144.bmp
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi

Modifies multiple files.

Deletes itself.

Modifies user data files (Trojan.Encoder).

Network activity

Connects to

'yi#.su':443

TCP

Other

'yi#.su':443

UDP

DNS ASK yi#.su

Miscellaneous

Searches for the following windows

ClassName: 'Progman' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'Media Center Tray Applet' WindowName: ''
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
ClassName: '' WindowName: 'View Available Networks'

Creates and executes the following

'<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 && del "<Full path to file>"' (with hidden window)

Executes the following

'%WINDIR%\explorer.exe'
'%WINDIR%\syswow64\notepad.exe' %HOMEPATH%\Desktop\---==%$$$OPEN_ME_UP$$$==---.txt
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 && del "<Full path to file>"
'%WINDIR%\syswow64\ping.exe' 127.0.0.1

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial