Trojan.Encoder.38973

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'BrowserUpdateCheck' = '%LOCALAPPDATA%\<File name>.exe'

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\64bit_notes.htm
%APPDATA%\thunderbird\profiles.ini
%APPDATA%\mozilla\firefox\profiles.ini

Modifies file system

Creates the following files

%LOCALAPPDATA%\<File name>.exe
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\how_to_back_files.txt
%ALLUSERSPROFILE%\sun\java\java update\how_to_back_files.txt
C:\users\default\how_to_back_files.txt
C:\users\public\desktop\how_to_back_files.txt
C:\users\public\documents\how_to_back_files.txt
C:\users\public\downloads\how_to_back_files.txt
C:\users\public\libraries\how_to_back_files.txt
C:\users\public\music\sample music\how_to_back_files.txt
C:\users\public\pictures\sample pictures\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\how_to_back_files.txt
C:\users\public\pictures\how_to_back_files.txt
C:\users\public\recorded tv\sample media\how_to_back_files.txt
C:\users\public\recorded tv\how_to_back_files.txt
C:\users\public\videos\sample videos\how_to_back_files.txt
C:\users\public\videos\how_to_back_files.txt
C:\users\public\how_to_back_files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\how_to_back_files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\offlinecache\how_to_back_files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\how_to_back_files.txt
C:\users\public\music\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\how_to_back_files.txt
%ProgramFiles(x86)%\how_to_back_files.txt
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\how_to_back_files.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how_to_back_files.txt
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\how_to_back_files.txt
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\how_to_back_files.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\how_to_back_files.txt
%ALLUSERSPROFILE%\oracle\java\javapath\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\how_to_back_files.txt
%TEMP%\opera installer\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\how_to_back_files.txt
%TEMP%\how_to_back_files.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\entries\how_to_back_files.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\how_to_back_files.txt
%HOMEPATH%\links\how_to_back_files.txt
%HOMEPATH%\contacts\how_to_back_files.txt
%HOMEPATH%\desktop\how_to_back_files.txt
%HOMEPATH%\documents\how_to_back_files.txt
%HOMEPATH%\downloads\how_to_back_files.txt
%HOMEPATH%\favorites\links\how_to_back_files.txt
%HOMEPATH%\favorites\links for united states\how_to_back_files.txt
%HOMEPATH%\favorites\microsoft websites\how_to_back_files.txt
%HOMEPATH%\favorites\msn websites\how_to_back_files.txt
%HOMEPATH%\favorites\windows live\how_to_back_files.txt
%ProgramFiles(x86)%\steam\how_to_back_files.txt
%APPDATA%\thunderbird\profiles\hmz1jddi.default\how_to_back_files.txt
%HOMEPATH%\music\how_to_back_files.txt
%HOMEPATH%\pictures\how_to_back_files.txt
%HOMEPATH%\saved games\how_to_back_files.txt
%HOMEPATH%\searches\how_to_back_files.txt
%HOMEPATH%\videos\how_to_back_files.txt
%HOMEPATH%\how_to_back_files.txt
D:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\how_to_back_files.txt
C:\users\how_to_back_files.txt
D:\how_to_back_files.txt
C:\users\public\a1965a0b3e0b2dd766735baa06c5e8f419ab070a92408411bdb0dc1ffb69d8fc
%HOMEPATH%\favorites\how_to_back_files.txt
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\how_to_back_files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\how_to_back_files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\how_to_back_files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\how_to_back_files.txt
%LOCALAPPDATA%\how_to_back_files.txt
%LOCALAPPDATA%low\oracle\java\au\how_to_back_files.txt
%LOCALAPPDATA%low\sun\java\deployment\how_to_back_files.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\how_to_back_files.txt
%APPDATA%\mozilla\firefox\crash reports\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\how_to_back_files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\how_to_back_files.txt
%APPDATA%\thunderbird\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\how_to_back_files.txt
%APPDATA%\mozilla\firefox\how_to_back_files.txt
%APPDATA%\telegram desktop\how_to_back_files.txt
%APPDATA%\thunderbird\crash reports\how_to_back_files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\how_to_back_files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\how_to_back_files.txt
%ProgramFiles(x86)%\steam\public\how_to_back_files.txt

Moves the following files

from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.ox4444
from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.ox4444
from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.ox4444
from %ProgramFiles(x86)%\steam\steam.cfg to %ProgramFiles(x86)%\steam\steam.cfg.ox4444
from %ProgramFiles(x86)%\steam\steam.exe to %ProgramFiles(x86)%\steam\steam.exe.ox4444
from %ProgramFiles(x86)%\steam\uninstall.exe to %ProgramFiles(x86)%\steam\uninstall.exe.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_brazilian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_brazilian.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_bulgarian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_bulgarian.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_czech.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_czech.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_danish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_danish.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_dutch.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_dutch.txt.ox4444
from %TEMP%\setupexe(202309121734336dc).log to %TEMP%\setupexe(202309121734336dc).log.ox4444
from %TEMP%\tmpaddon to %TEMP%\tmpaddon.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_english.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_english.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_german.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_german.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_greek.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_greek.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_hungarian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_hungarian.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_italian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_italian.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_japanese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_japanese.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_korean.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_korean.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_koreana.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_koreana.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_latam.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_latam.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_norwegian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_norwegian.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_polish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_polish.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_finnish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_finnish.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_french.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_french.txt.ox4444
from %TEMP%\rgia609.tmp-tmp to %TEMP%\rgia609.tmp-tmp.ox4444
from %TEMP%\rgia609.tmp to %TEMP%\rgia609.tmp.ox4444
from %TEMP%\ose00000.exe to %TEMP%\ose00000.exe.ox4444
from %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912171759.log to %TEMP%\dd_vcredist_x86_20230912171759.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912171936.log to %TEMP%\dd_vcredist_x86_20230912171936.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912172157.log to %TEMP%\dd_vcredist_x86_20230912172157.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912172224.log to %TEMP%\dd_vcredist_x86_20230912172224.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912172322.log to %TEMP%\dd_vcredist_x86_20230912172322.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log.ox4444
from %TEMP%\dd_vcredist_x86_20230912172350.log to %TEMP%\dd_vcredist_x86_20230912172350.log.ox4444
from %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt to %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.ox4444
from %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt to %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.ox4444
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.ox4444
from %TEMP%\jusched.log to %TEMP%\jusched.log.ox4444
from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.ox4444
from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.ox4444
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.ox4444
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.ox4444
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.ox4444
from %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_portuguese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_portuguese.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_romanian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_romanian.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_russian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_russian.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_schinese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_schinese.txt.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\npspwrap.dll to %ProgramFiles(x86)%\microsoft office\office14\npspwrap.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\oisctrl.dll to %ProgramFiles(x86)%\microsoft office\office14\oisctrl.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\olkfstub.dll to %ProgramFiles(x86)%\microsoft office\office14\olkfstub.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\onbttnie.dll to %ProgramFiles(x86)%\microsoft office\office14\onbttnie.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\onbttnielinkednotes.dll to %ProgramFiles(x86)%\microsoft office\office14\onbttnielinkednotes.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\onenotesyncpc.dll to %ProgramFiles(x86)%\microsoft office\office14\onenotesyncpc.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\onlntcomlib.dll to %ProgramFiles(x86)%\microsoft office\office14\onlntcomlib.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\owssupp.dll to %ProgramFiles(x86)%\microsoft office\office14\owssupp.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\ppslax.dll to %ProgramFiles(x86)%\microsoft office\office14\ppslax.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\stscopy.dll to %ProgramFiles(x86)%\microsoft office\office14\stscopy.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\stsupld.dll to %ProgramFiles(x86)%\microsoft office\office14\stsupld.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\vviewdwg.dll to %ProgramFiles(x86)%\microsoft office\office14\vviewdwg.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\vviewer.dll to %ProgramFiles(x86)%\microsoft office\office14\vviewer.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\1033\bhointl.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\bhointl.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\1033\mapishellr.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\mapishellr.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\1033\ocltint.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\ocltint.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\1033\stsucres.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\stsucres.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\1033\stsupld.intl.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\stsupld.intl.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\1033\vviewres.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\vviewres.dll.ox4444
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll.ox4444
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmgdsrv.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmgdsrv.dll.ox4444
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolap100.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolap100.dll.ox4444
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolui100.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolui100.dll.ox4444
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\npauthz.dll to %ProgramFiles(x86)%\microsoft office\office14\npauthz.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\namecontrolproxy.dll to %ProgramFiles(x86)%\microsoft office\office14\namecontrolproxy.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\nameext.dll to %ProgramFiles(x86)%\microsoft office\office14\nameext.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\name.dll to %ProgramFiles(x86)%\microsoft office\office14\name.dll.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_spanish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_spanish.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_swedish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_swedish.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_tchinese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_tchinese.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_thai.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_thai.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_turkish.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_turkish.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_ukrainian.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_ukrainian.txt.ox4444
from %ProgramFiles(x86)%\steam\public\steambootstrapper_vietnamese.txt to %ProgramFiles(x86)%\steam\public\steambootstrapper_vietnamese.txt.ox4444
from %ProgramFiles(x86)%\steam\logs\bootstrap_log.txt to %ProgramFiles(x86)%\steam\logs\bootstrap_log.txt.ox4444
from %ProgramFiles(x86)%\steam\bin\steamservice.exe to %ProgramFiles(x86)%\steam\bin\steamservice.exe.ox4444
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.ox4444
from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaclientpkg.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaclientpkg.dll.ox4444
from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaproject.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaproject.dll.ox4444
from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaclientpkgui.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaclientpkgui.dll.ox4444
from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaprojectui.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaprojectui.dll.ox4444
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.adapter.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.adapter.dll.ox4444
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.dll.ox4444
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.comrpcchannel.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.comrpcchannel.dll.ox4444
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.designtime.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.designtime.dll.ox4444
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\system.addin.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\system.addin.dll.ox4444
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\microsoft.visualstudio.tools.applications.project.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\microsoft.visualstudio.tools.applications.project.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\authzax.dll to %ProgramFiles(x86)%\microsoft office\office14\authzax.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll to %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\ieawsdc.dll to %ProgramFiles(x86)%\microsoft office\office14\ieawsdc.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\inlaunch.dll to %ProgramFiles(x86)%\microsoft office\office14\inlaunch.dll.ox4444
from %ProgramFiles(x86)%\microsoft office\office14\msohtmed.exe to %ProgramFiles(x86)%\microsoft office\office14\msohtmed.exe.ox4444
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll.ox4444
from %TEMP%\dd_vcredist_x86_20230912171710.log to %TEMP%\dd_vcredist_x86_20230912171710.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912172315.log to %TEMP%\dd_vcredist_amd64_20230912172315.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4.ox4444
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.ox4444
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.ox4444
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.ox4444
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.ox4444
from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\compatibility.ini.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4.ox4444
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json to %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.ox4444
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.ox4444
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json.ox4444
from %TEMP%\adobearm.log to %TEMP%\adobearm.log.ox4444
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.ox4444
from %TEMP%\armui.ini to %TEMP%\armui.ini.ox4444
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.ox4444
from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.ox4444
from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.ox4444
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.ox4444
from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.ox4444
from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.ox4444
from %TEMP%\dd_vcredistmsi12db.txt to %TEMP%\dd_vcredistmsi12db.txt.ox4444
from %TEMP%\dd_vcredistui12db.txt to %TEMP%\dd_vcredistui12db.txt.ox4444
from %TEMP%\dd_vcredist_amd64_20230912171641.log to %TEMP%\dd_vcredist_amd64_20230912171641.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912171735.log to %TEMP%\dd_vcredist_amd64_20230912171735.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912171824.log to %TEMP%\dd_vcredist_amd64_20230912171824.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912172034.log to %TEMP%\dd_vcredist_amd64_20230912172034.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912172134.log to %TEMP%\dd_vcredist_amd64_20230912172134.log.ox4444
from %TEMP%\dd_vcredist_amd64_20230912172247.log to %TEMP%\dd_vcredist_amd64_20230912172247.log.ox4444
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.ox4444
from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2024-03-22_11_w-7ab47btxtewdh4a2yehg==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2024-03-22_11_w-7ab47btxtewdh4a2yehg==.jsonlz4.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4.ox4444
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4.ox4444
from %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log.ox4444
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as80.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as80.xsl.ox4444

Modifies the following files

D:\install.log
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url
%HOMEPATH%\favorites\msn websites\msnbc news.url
%HOMEPATH%\favorites\msn websites\msn.url
%HOMEPATH%\favorites\msn websites\msn sports.url
%HOMEPATH%\favorites\msn websites\msn money.url
%HOMEPATH%\favorites\msn websites\msn entertainment.url
%HOMEPATH%\favorites\msn websites\msn autos.url
%HOMEPATH%\favorites\windows live\windows live spaces.url
%HOMEPATH%\favorites\windows live\windows live mail.url
%HOMEPATH%\favorites\windows live\windows live gallery.url
%HOMEPATH%\favorites\windows live\get windows live.url
%HOMEPATH%\favorites\desktop.ini
%HOMEPATH%\links\recentplaces.lnk
%HOMEPATH%\links\downloads.lnk
%HOMEPATH%\links\desktop.lnk
%HOMEPATH%\links\desktop.ini
%HOMEPATH%\music\desktop.ini
%HOMEPATH%\pictures\desktop.ini
%HOMEPATH%\saved games\desktop.ini
%HOMEPATH%\searches\indexed locations.search-ms
%HOMEPATH%\searches\everywhere.search-ms
%HOMEPATH%\searches\desktop.ini
%HOMEPATH%\videos\desktop.ini
<Drive name for removable media>:\split.avi
D:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\desktop.ini
C:\users\desktop.ini
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial