Trojan.Encoder.38900

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini.enc

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\applicantform_en.doc
%APPDATA%\thunderbird\profiles.ini
%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\tileimage.bmp

Modifies file system

Creates the following files

%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest.enc
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\f58155b4b1d5a524ca0261c3ee99fb50_d4602615-9d50-4880-be41-678935e93eaa.enc
%APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.enc
%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.enc
%APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.enc
%APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.enc
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini.enc
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk.enc
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk.enc
%APPDATA%\microsoft\windows\libraries\music.library-ms.enc
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi.enc
%LOCALAPPDATA%low\sun\java\deployment\deployment.properties.enc
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk.enc
%APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.enc
%APPDATA%\microsoft\protect\credhist.enc
%APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\71e6321a-7203-4cd6-882b-58bcea299d05.enc
%APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\ec2e5fbc-5cd2-48b5-bd25-b5b2c4d33d98.enc
%APPDATA%\microsoft\protect\s-1-5-21-1238866942-1249195528-555854008-1000\preferred.enc
%APPDATA%\microsoft\windows\libraries\desktop.ini.enc
%APPDATA%\microsoft\windows\libraries\documents.library-ms.enc
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk.enc
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json.enc
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk.enc
%TEMP%\opera_crashreporter.log.enc
%TEMP%\jusched.log.enc
%TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt.enc
%TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt.enc
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt.enc
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt.enc
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt.enc
%TEMP%\opera installer\opera_installer_20220928171325.log.enc
%TEMP%\opera installer\opera_installer_20220928171326.log.enc
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\startupcache\webext.sc.lz4.enc
%LOCALAPPDATA%low\oracle\java\au\au.msi.enc
%LOCALAPPDATA%low\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico.enc
%TEMP%\rgi5839.tmp.enc
%TEMP%\rgi5839.tmp-tmp.enc
%TEMP%\setupexe(20220928171621f0c).log.enc
%TEMP%\tmpaddon.enc
%TEMP%\wmsetup.log.enc
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\.startup-incomplete.enc
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\cache2\entries\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f.enc
%LOCALAPPDATA%\thunderbird\profiles\npsdfqy3.default-release\startupcache\startupcache.8.little.enc
%TEMP%\opera installer\opera_installer_20220928171336.log.enc
%TEMP%\ose00000.exe.enc
%TEMP%\javadeployreg.log.enc
%TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt.enc
%APPDATA%\microsoft\windows\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\administrative tools\desktop.ini.enc
%APPDATA%\microsoft\windows\start menu\programs\desktop.ini.enc
%APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.enc
%APPDATA%\microsoft\windows\libraries\videos.library-ms.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.enc
%APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.enc
%APPDATA%\mozilla\firefox\installs.ini.enc
%APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk.enc
%APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.enc
%APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.enc
%APPDATA%\microsoft\windows\libraries\pictures.library-ms.enc
%APPDATA%\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms.enc
%APPDATA%\microsoft\windows\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms.enc
%APPDATA%\microsoft\windows\recent\customdestinations\6824f4a902c78fbd.customdestinations-ms.enc
%APPDATA%\microsoft\windows\recent\customdestinations\7e4dca80246863e3.customdestinations-ms.enc
%APPDATA%\microsoft\windows\recent\customdestinations\f255fa30b6018a38.customdestinations-ms.enc
%APPDATA%\microsoft\windows\recent\desktop.ini.enc
%APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.enc
%APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk.enc
%APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.enc
%APPDATA%\microsoft\windows\start menu\desktop.ini.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.enc
%APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.enc
%APPDATA%\microsoft\windows\sendto\desktop.ini.enc
%APPDATA%\microsoft\windows\sendto\fax recipient.lnk.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\graph.emf.enc
%APPDATA%\microsoft\windows\sendto\documents.mydocs.enc
%TEMP%\dd_vcredistmsi7a3c.txt.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\180089313729568cf6d0caf9991f0fa4115478f0.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\299eb705093e52d32165bfb83e05061ad4e4b4e6.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\2b8fb3a7c1e8990ce64886d66718692d2b2ed2bc.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\2cb84dd9abb4e1485d83397c59b193094e1abfc7.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\340a10d652987df5e54312e31f5c22f6e8dba574.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\39d80535a21e286b3c662765c5f09aceb927e77d.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\4c5a1680d3b63616e845aca183dd3af5ad89c635.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\7330b218fe46e63c30e077c3456a7239baaead12.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\startupcache\scriptcache-child.bin.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\15d495dc6f1f43eb03dbaa196b6c77a4aa79bb6f.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\a2f1b3da369eab62efa8bdaf2aaad94562df2b2f.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\a5551287b6c6366d0a84e59496d80fa3ce34961a.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\b131b7dd97d20d09cd32dd304a9f24fb08fa28b6.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\bc9a334d14ae8d5cdcf1f5f5128ba1f4cdd083ac.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\ca7b107e288f94eb98b38094e8c5546e41a7b930.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\dfdc36497a0baee2972009ee6deccc06c2e352c6.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\f769c892f960b70f50c63fb08ae2f0647a51e85d.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\offlinecache\index.sqlite.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\82c47fa9f5f29d08908329a836215460fd85b37b.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\9c571ec4d1abdf04dec3542cba1cbcdb49632bf7.enc
%TEMP%\dd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\914fe2803961970b111b9c8e3e595d1e2e159890.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\grid_(inch).wmf.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\memo.emf.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\month_calendar.emf.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\music.emf.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\seyes.emf.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\shorthand.emf.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\startupcache\urlcache.bin.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cache2\entries\0e0c6fa1da983516c579dee2be5f4bd13fd21317.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\startupcache\webext.sc.lz4.enc
%LOCALAPPDATA%\microsoft\windows mail\windowsmail.pat.enc
%LOCALAPPDATA%\microsoft\windows media\12.0\wmsdkns.dtd.enc
%LOCALAPPDATA%\microsoft\windows sidebar\settings.ini.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\offlinecache\index.sqlite.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\startupcache\scriptcache-child.bin.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\startupcache\scriptcache.bin.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\startupcache\startupcache.4.little.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\to_do_list.emf.enc
%LOCALAPPDATA%\microsoft\windows mail\windowsmail.msmessagestore.enc
%TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt.enc
%TEMP%\dd_vcredist_x86_20220928170410.log.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\startupcache\webext.sc.lz4.enc
%TEMP%\dd_vcredist_amd64_20220928170250.log.enc
%TEMP%\dd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log.enc
%TEMP%\dd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log.enc
%TEMP%\dd_vcredist_amd64_20220928170328.log.enc
%TEMP%\dd_vcredist_x86_20220928165536.log.enc
%TEMP%\dd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log.enc
%TEMP%\dd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log.enc
%TEMP%\dd_vcredist_x86_20220928165710.log.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\startupcache\startupcache.8.little.enc
%TEMP%\dd_vcredist_amd64_20220928170114.log.enc
%TEMP%\dd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log.enc
%TEMP%\dd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log.enc
%TEMP%\dd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log.enc
%TEMP%\dd_vcredist_x86_20220928170143.log.enc
%TEMP%\dd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log.enc
%TEMP%\dd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log.enc
%TEMP%\dd_vcredist_x86_20220928170221.log.enc
%TEMP%\dd_vcredist_x86_20220928170335.log.enc
%TEMP%\dd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log.enc
%TEMP%\dd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log.enc
%TEMP%\dd_vcredist_x86_20220928165916.log.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\startupcache\urlcache.bin.enc
%TEMP%\dd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log.enc
%LOCALAPPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\startupcache\scriptcache.bin.enc
%TEMP%\adobearm.log.enc
%TEMP%\adobesfx.log.enc
%TEMP%\armui.ini.enc
%TEMP%\aspnetsetup_00000.log.enc
%TEMP%\aspnetsetup_00001.log.enc
%TEMP%\chrome_installer.log.enc
%TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.enc
%TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.enc
%TEMP%\dd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log.enc
%TEMP%\dd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log.enc
%TEMP%\dd_vcredist_amd64_20220928165956.log.enc
%TEMP%\dd_vcredist_amd64_20220928165349.log.enc
%TEMP%\dd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log.enc
%TEMP%\dd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log.enc
%TEMP%\dd_vcredist_amd64_20220928165628.log.enc
%TEMP%\dd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log.enc
%TEMP%\dd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log.enc
%TEMP%\dd_vcredist_amd64_20220928165746.log.enc
%TEMP%\dd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log.enc
%TEMP%\dd_setuputility.txt.enc
%TEMP%\dd_vcredistui7a3c.txt.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\grid_(cm).wmf.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addonstartup.json.lz4.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\compatibility.ini.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\state.json.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\directorytree.json.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\enigmail.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extension-preferences.json.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\extensions.json.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\favicons.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\formhistory.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\global-messages-db.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\session-state.json.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764036.a6077284-6dcc-4781-9fb7-7f9d7b5132bf.first-shutdown.jsonlz4.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\permissions.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\a6077284-6dcc-4781-9fb7-7f9d7b5132bf.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\saved-telemetry-pings\e60182f3-3480-48d0-bc12-b3b897042a6b.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\search.json.mozlz4.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\history.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\parent.lock.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2918063365piupsah.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\openpgp.sqlite.enc
%APPDATA%\thunderbird\crash reports\installtime20210406220621.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\times.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\trrblacklist.txt.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\user.js.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\xulstore.json.enc
%APPDATA%\mozilla\firefox\profiles.ini.enc
%APPDATA%\telegram desktop\telegram.exe.enc
%APPDATA%\telegram desktop\unins000.exe.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\crashes\store.json.mozlz4.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411764034.d092fa80-6cc0-49cc-9da4-f67b3d6cdc55.main.jsonlz4.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\datareporting\archived\2022-09\1664411763506.e60182f3-3480-48d0-bc12-b3b897042a6b.new-profile.jsonlz4.enc
%APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\compatibility.ini.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite.enc
%APPDATA%\telegram desktop\updater.exe.enc
%APPDATA%\thunderbird\installs.ini.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sessioncheckpoints.json.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage.sqlite.enc
%HOMEPATH%\favorites\msn websites\msn entertainment.url.enc
%HOMEPATH%\favorites\msn websites\msn money.url.enc
%HOMEPATH%\favorites\msn websites\msn sports.url.enc
%HOMEPATH%\favorites\msn websites\msn.url.enc
%HOMEPATH%\favorites\msn websites\msnbc news.url.enc
%HOMEPATH%\favorites\windows live\get windows live.url.enc
%HOMEPATH%\favorites\windows live\windows live gallery.url.enc
%HOMEPATH%\favorites\windows live\windows live mail.url.enc
%HOMEPATH%\favorites\microsoft websites\microsoft store.url.enc
%HOMEPATH%\favorites\msn websites\msn autos.url.enc
%HOMEPATH%\favorites\windows live\windows live spaces.url.enc
%HOMEPATH%\links\downloads.lnk.enc
%HOMEPATH%\links\recentplaces.lnk.enc
%HOMEPATH%\music\desktop.ini.enc
%HOMEPATH%\ntuser.ini.enc
%HOMEPATH%\pictures\desktop.ini.enc
%HOMEPATH%\saved games\desktop.ini.enc
%HOMEPATH%\searches\desktop.ini.enc
%HOMEPATH%\searches\everywhere.search-ms.enc
%HOMEPATH%\links\desktop.ini.enc
%HOMEPATH%\links\desktop.lnk.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\.metadata-v2.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt.enc
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\times.json.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\webappsstore.sqlite.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\xulstore.json.enc
%APPDATA%\thunderbird\profiles.ini.enc
%HOMEPATH%\contacts\desktop.ini.enc
%HOMEPATH%\contacts\user.contact.enc
%HOMEPATH%\desktop\desktop.ini.enc
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url.enc
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.enc
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url.enc
%HOMEPATH%\desktop\google chrome.lnk.enc
%HOMEPATH%\favorites\desktop.ini.enc
%HOMEPATH%\favorites\links\desktop.ini.enc
%HOMEPATH%\favorites\links\web slice gallery.url.enc
%HOMEPATH%\favorites\links for united states\desktop.ini.enc
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.enc
%HOMEPATH%\favorites\links for united states\usa.gov.url.enc
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url.enc
%HOMEPATH%\desktop\telegram.lnk.enc
%HOMEPATH%\documents\desktop.ini.enc
%HOMEPATH%\downloads\desktop.ini.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\bookmarkbackups\bookmarks-2022-09-28_11_3a7quggif+d7xxwa176j2q==.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\search.json.mozlz4.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessioncheckpoints.json.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore-backups\recovery.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sessionstore.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\shield-preference-experiments.json.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\dc5a4164-f290-4a08-a5ec-0fe7810acbc6.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\bef7f9cf-b0b1-42d8-a037-8d586d4d1e42.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\fbcd22a2-e53a-4131-9ef1-1935f505d9ca.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\.metadata-v2.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\times.json.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\default\moz-extension+++db487e04-ae57-4773-9556-37dac4cedf3c^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\.metadata-v2.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\saved-telemetry-pings\f9af9616-8535-4ace-8050-4454f33ad475.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\containers.json.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\content-prefs.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\crashes\store.json.mozlz4.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759331.f9af9616-8535-4ace-8050-4454f33ad475.new-profile.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759476.fbcd22a2-e53a-4131-9ef1-1935f505d9ca.event.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759547.bef7f9cf-b0b1-42d8-a037-8d586d4d1e42.main.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\broadcast-listeners.json.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\archived\2022-09\1664411759551.dc5a4164-f290-4a08-a5ec-0fe7810acbc6.first-shutdown.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extensions.json.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\favicons.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\formhistory.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\handlers.json.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\parent.lock.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\permissions.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\session-state.json.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\datareporting\state.json.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\extension-preferences.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\webappsstore.sqlite.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0186ea91-e835-4919-9366-c7e15b92110b.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\0bfb99e9-0e75-47d0-b739-94e23d793342.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\1f6a84f6-29b5-43da-aa85-b8cf32dd80d0.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\a847dc89-db3d-4896-9bef-b610ec76e43d.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\d9d62ad7-4327-4aa9-97e7-aeb5486c45ee.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\saved-telemetry-pings\ee43e28f-610b-4229-a7d7-171f6ed032bd.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\search.json.mozlz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\handlers.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\prefs.js.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\securitypreloadstate.txt.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\recovery.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\upgrade.jsonlz4-20200708170202.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\shield-preference-experiments.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\.metadata-v2.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\default\moz-extension+++d39c0de0-06d0-4e01-844c-98b240b2f278^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.s...
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\storage\permanent\chrome\.metadata-v2.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\security_state\data.safe.bin.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessioncheckpoints.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sessionstore-backups\previous.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt.enc
%APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json.enc
%APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\bookmarkbackups\bookmarks-2023-10-09_11_wowu13vthwkcthdlkwm-la==.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\broadcast-listeners.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\compatibility.ini.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\containers.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\crashes\store.json.mozlz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160101.d9d62ad7-4327-4aa9-97e7-aeb5486c45ee.new-profile.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160111.ee43e28f-610b-4229-a7d7-171f6ed032bd.health.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160264.0186ea91-e835-4919-9366-c7e15b92110b.first-shutdown.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\session-state.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\state.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extension-preferences.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\extensions.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\manifest.json.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160174.0bfb99e9-0e75-47d0-b739-94e23d793342.event.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160236.a847dc89-db3d-4896-9bef-b610ec76e43d.health.jsonlz4.enc
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\datareporting\archived\2023-05\1685574160262.1f6a84f6-29b5-43da-aa85-b8cf32dd80d0.main.jsonlz4.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\genko_2.emf.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\genko_1.emf.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\dotted_lines.emf.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\manifest.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\log.enc
%LOCALAPPDATA%\google\chrome\user data\default\cache\index.enc
%LOCALAPPDATA%\google\chrome\user data\default\chromedwritefontcache.enc
%LOCALAPPDATA%\google\chrome\user data\default\cookies.enc
%LOCALAPPDATA%\google\chrome\user data\default\cookies-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\current session.enc
%LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db.enc
%LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\000003.log.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\manifest.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_2.enc
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_3.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\manifest-000001.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension state\000003.log.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension state\current.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension state\lock.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension state\log.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension state\manifest-000001.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\lock.enc
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\current.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_1.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\manifest.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\messages.json.enc
%LOCALAPPDATA%\google\chrome\application\visualelementsmanifest.xml.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\secondarytile.png.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\bn.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ca.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\cs.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\da.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\de.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\el.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\en-gb.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\en-us.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ar.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\hu.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\am.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fa.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fi.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fil.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fr.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\gu.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\he.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\hi.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\hr.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\es.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\es-419.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\et.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\libexif.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\search.crx.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_child.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_elf.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_watcher.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\d3dcompiler_47.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\docs.crx.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\drive.crx.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\libglesv2.dll.enc
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_0.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\youtube.crx.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\delegate_execute.exe.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\external_extensions.json.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\ffmpegsumo.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\icudtl.dat.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\chrome.7z.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\setup.exe.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\libegl.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\gmail.crx.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\external_extensions.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\messages.json.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\bg.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\vi.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\zh-cn.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\zh-tw.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\metro_driver.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\nacl64.exe.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\nacl_irt_x86_32.nexe.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\nacl_irt_x86_64.nexe.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\natives_blob.bin.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\manifest.json.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\uk.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\it.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\tr.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\snapshot_blob.bin.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\logo.png.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\smalllogo.png.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\splash-620x300.png.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\widevinecdmadapter.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\xinput1_3.dll.enc
%LOCALAPPDATA%\google\chrome\application\chrome.exe.enc
%LOCALAPPDATA%\google\chrome\application\debug.log.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\resources.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\pepflashplayer.dll.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\id.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\te.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\pt-pt.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ko.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\lt.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\lv.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ml.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\mr.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ms.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\nb.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\nl.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\th.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ja.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\kn.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ro.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ru.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sk.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sl.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sr.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sv.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sw.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ta.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\pt-br.pak.enc
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\pl.pak.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\visited links.enc
%LOCALAPPDATA%\google\chrome\user data\default\web data-journal.enc
%LOCALAPPDATA%\google\chrome\user data\first run.enc
%LOCALAPPDATA%\google\chrome\user data\local state.enc
%LOCALAPPDATA%\google\chrome\user data\safe browsing cookies.enc
%LOCALAPPDATA%\google\chrome\user data\safe browsing cookies-journal.enc
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\popular government questions from usa~dgov~.feed-ms.enc
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\usa~dgov updates~c news and features~.feed-ms.enc
%LOCALAPPDATA%\google\chrome\user data\default\top sites-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\top sites.enc
%LOCALAPPDATA%\google\chrome\user data\default\web data.enc
%LOCALAPPDATA%\microsoft\feeds\feedsstore.feedsdb-ms.enc
%LOCALAPPDATA%\microsoft\feeds cache\1zlrvj28\desktop.ini.enc
%LOCALAPPDATA%\microsoft\feeds cache\1zlrvj28\fwlink[1].enc
%LOCALAPPDATA%\microsoft\feeds cache\5uzys9tz\desktop.ini.enc
%LOCALAPPDATA%\microsoft\feeds cache\5uzys9tz\fwlink[1].enc
%LOCALAPPDATA%\microsoft\feeds cache\5uzys9tz\fwlink[2].enc
%LOCALAPPDATA%\microsoft\feeds cache\desktop.ini.enc
%LOCALAPPDATA%\microsoft\feeds cache\id3ykpjl\desktop.ini.enc
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\microsoft at home~.feed-ms.enc
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\microsoft at work~.feed-ms.enc
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\msnbc news~.feed-ms.enc
%LOCALAPPDATA%\google\chrome\user data\default\favicons.enc
%LOCALAPPDATA%\microsoft\feeds cache\id3ykpjl\fwlink[1].enc
%LOCALAPPDATA%\google\chrome\user data\default\google profile.ico.enc
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\732e.tmp.enc
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\732f.tmp.enc
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\fe57.tmp.enc
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\fe58.tmp.enc
%LOCALAPPDATA%\google\chrome\user data\default\login data.enc
%LOCALAPPDATA%\google\chrome\user data\default\login data-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\network action predictor.enc
%LOCALAPPDATA%\google\chrome\user data\default\shortcuts-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\history.enc
%LOCALAPPDATA%\google\chrome\user data\default\shortcuts.enc
%LOCALAPPDATA%\google\chrome\user data\default\network action predictor-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\readme.enc
%LOCALAPPDATA%\google\chrome\user data\default\secure preferences.enc
%LOCALAPPDATA%\google\chrome\user data\default\session storage\000003.log.enc
%LOCALAPPDATA%\google\chrome\user data\default\session storage\current.enc
%LOCALAPPDATA%\google\chrome\user data\default\session storage\lock.enc
%LOCALAPPDATA%\google\chrome\user data\default\session storage\log.enc
%LOCALAPPDATA%\google\chrome\user data\default\session storage\manifest-000001.enc
%LOCALAPPDATA%\google\chrome\user data\default\preferences.enc
%LOCALAPPDATA%\google\chrome\user data\default\quotamanager.enc
%LOCALAPPDATA%\google\chrome\user data\default\quotamanager-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\history-journal.enc
%LOCALAPPDATA%\microsoft\feeds cache\id3ykpjl\fwlink[2].enc
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.enc
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\desktop.ini.enc
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\desktop.ini.enc
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_08339354\report.wer.enc
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_cab_0aad3c95\report.wer.enc
%LOCALAPPDATA%\microsoft\windows mail\account{350369bb-200d-4d96-81b8-56c5695dc723}.oeaccount.enc
%LOCALAPPDATA%\microsoft\windows mail\account{9c584664-a771-4c09-b4c0-7ca12081c64c}.oeaccount.enc
%LOCALAPPDATA%\microsoft\windows mail\account{b257fb43-fb0e-4759-a396-c4eb90e5b9e4}.oeaccount.enc
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\desktop.ini.enc
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\desktop.ini.enc
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\favicon[1].ico.enc
%LOCALAPPDATA%\microsoft\windows mail\backup\new\edb00001.log.enc
%LOCALAPPDATA%\microsoft\windows mail\edb.log.enc
%LOCALAPPDATA%\microsoft\windows mail\edb00001.log.enc
%LOCALAPPDATA%\microsoft\windows mail\edbres00001.jrs.enc
%LOCALAPPDATA%\microsoft\windows mail\edbres00002.jrs.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\cave_drawings.gif.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\connectivity.gif.enc
%LOCALAPPDATA%\microsoft\windows mail\stationery\desktop.ini.enc
%LOCALAPPDATA%\microsoft\windows mail\backup\new\windowsmail.msmessagestore.enc
%LOCALAPPDATA%\microsoft\windows mail\backup\new\windowsmail.pat.enc
%LOCALAPPDATA%\microsoft\windows mail\edb.chk.enc
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\desktop.ini.enc
%LOCALAPPDATA%\microsoft\feeds cache\q2xofo16\desktop.ini.enc
%LOCALAPPDATA%\microsoft\feeds cache\q2xofo16\fwlink[1].enc
%LOCALAPPDATA%\microsoft\media player\currentdatabase_372.wmdb.enc
%LOCALAPPDATA%\microsoft\media player\localmls_3.wmdb.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\01_music_auto_rated_at_5_stars.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\02_music_added_in_the_last_month.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\03_music_rated_at_4_or_5_stars.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\04_music_played_in_the_last_month.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\05_pictures_taken_in_the_last_month.wpl.enc
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\desktop.ini.enc
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.bak.enc
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\desktop.ini.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\06_pictures_rated_4_or_5_stars.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\10_all_music.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\11_all_pictures.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\12_all_video.wpl.enc
%LOCALAPPDATA%\microsoft\windows\burn\burn\desktop.ini.enc
%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog.etl.enc
%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl.enc
%LOCALAPPDATA%\microsoft\windows\history\desktop.ini.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\07_tv_recorded_in_the_last_week.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\08_video_rated_at_4_or_5_stars.wpl.enc
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0003b056\09_music_played_the_most.wpl.enc
%LOCALAPPDATA%\google\chrome\user data\default\favicons-journal.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\manifest.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\manifest.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\messages.json.enc
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\messages.json.enc
%HOMEPATH%\searches\indexed locations.search-ms.enc
%HOMEPATH%\videos\desktop.ini.enc

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_idx.db
%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_32.db
%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_96.db
%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_256.db
%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_1024.db
%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_sr.db

Changes user data files extensions (Trojan.Encoder).

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial