Trojan.Encoder.39158

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\recover-files.txt

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%HOMEPATH%\desktop\trivial-merge.htm
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\pushkin.jpeg
%HOMEPATH%\desktop\parnas_01.jpg
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\3.jpg
%HOMEPATH%\desktop\210252809.jpeg
%HOMEPATH%\desktop\1189.jpeg
%APPDATA%\thunderbird\profiles.ini
%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\syscfg.db
%LOCALAPPDATA%low\microsoft\recover-files.txt
%LOCALAPPDATA%low\microsoft\internet explorer\recover-files.txt
%LOCALAPPDATA%low\microsoft\internet explorer\services\recover-files.txt
%LOCALAPPDATA%low\mozilla\recover-files.txt
%LOCALAPPDATA%low\mozilla\temp-{070abd97-84e1-4f5f-9c02-f1d76dd9fce4}\recover-files.txt
%LOCALAPPDATA%low\mozilla\temp-{1fae114c-c2b0-4da1-b23a-8e5ad0c3d722}\recover-files.txt
%LOCALAPPDATA%low\mozilla\temp-{3571406e-c08c-4c74-b145-8857b365f6e7}\recover-files.txt
%LOCALAPPDATA%low\oracle\recover-files.txt
%LOCALAPPDATA%low\oracle\java\recover-files.txt
%LOCALAPPDATA%low\oracle\java\au\recover-files.txt
%LOCALAPPDATA%low\sun\recover-files.txt
%LOCALAPPDATA%low\sun\java\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\recover-files.txt
%LOCALAPPDATA%low\recover-files.txt
%LOCALAPPDATA%\programs\recover-files.txt
%LOCALAPPDATA%\thunderbird\profiles\hmz1jddi.default\recover-files.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\safebrowsing\google4\recover-files.txt
%TEMP%\recover-files.txt
%TEMP%\hsperfdata_user\recover-files.txt
%TEMP%\low\recover-files.txt
%TEMP%\microsoft .net framework 4 setup_4.0.30319\recover-files.txt
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\recover-files.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\recover-files.txt
%TEMP%\opera installer\recover-files.txt
%TEMP%\wpdnse\recover-files.txt
%LOCALAPPDATA%\thunderbird\recover-files.txt
%LOCALAPPDATA%\thunderbird\profiles\recover-files.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\recover-files.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\recover-files.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\doomed\recover-files.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\cache2\entries\recover-files.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\safebrowsing\recover-files.txt
%LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\recover-files.txt
%LOCALAPPDATA%\programs\common\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\thumbnails\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\safebrowsing\google4\recover-files.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\recover-files.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\recover-files.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\recover-files.txt
%LOCALAPPDATA%\microsoft\feeds cache\recover-files.txt
%LOCALAPPDATA%\microsoft\feeds cache\15ivkcr3\recover-files.txt
%LOCALAPPDATA%\microsoft\feeds cache\6fwa5ftw\recover-files.txt
%LOCALAPPDATA%\microsoft\feeds cache\bbs9hw0e\recover-files.txt
%LOCALAPPDATA%\microsoft\feeds cache\xwtafhng\recover-files.txt
%LOCALAPPDATA%\microsoft\internet explorer\recover-files.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\recover-files.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\recover-files.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\recover-files.txt
%LOCALAPPDATA%\microsoft\media player\recover-files.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\recover-files.txt
%LOCALAPPDATA%\microsoft\feeds\recover-files.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\recover-files.txt
%LOCALAPPDATA%\microsoft\credentials\recover-files.txt
%LOCALAPPDATA%\history\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__macosx\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\__macosx\_locales\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\session storage\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\evwhitelist\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\pepperflash\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\pnacl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\swiftshader\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\widevinecdm\recover-files.txt
%LOCALAPPDATA%\microsoft\recover-files.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0000b025\recover-files.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\recover-files.txt
%LOCALAPPDATA%\microsoft\office\recover-files.txt
%LOCALAPPDATA%\microsoft\windows media\recover-files.txt
%LOCALAPPDATA%\microsoft\windows sidebar\recover-files.txt
%LOCALAPPDATA%\microsoft\windows sidebar\gadgets\recover-files.txt
%LOCALAPPDATA%\microsoft help\recover-files.txt
%LOCALAPPDATA%\mozilla\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\m15ucxjx.default\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\doomed\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\offlinecache\recover-files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\safebrowsing\recover-files.txt
%LOCALAPPDATA%\microsoft\windows mail\stationery\recover-files.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\recover-files.txt
%LOCALAPPDATA%\microsoft\windows media\12.0\recover-files.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\new\recover-files.txt
%LOCALAPPDATA%\microsoft\windows mail\recover-files.txt
%LOCALAPPDATA%\microsoft\office\groove\recover-files.txt
%LOCALAPPDATA%\microsoft\office\groove\user\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\burn\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\burn\burn\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\caches\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\explorer\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\gameexplorer\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\ringtones\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\wer\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\wer\erc\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportarchive\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_cab_0fbabd8f\recover-files.txt
%LOCALAPPDATA%\microsoft\office\groove\system\recover-files.txt
%LOCALAPPDATA%\microsoft\windows\history\low\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\temporary\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recover-files.txt
%APPDATA%\mozilla\systemextensionsdev\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\minidumps\recover-files.txt
%APPDATA%\mozilla\firefox\crash reports\recover-files.txt
%APPDATA%\mozilla\firefox\crash reports\events\recover-files.txt
%APPDATA%\mozilla\firefox\pending pings\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\events\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\recover-files.txt
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\recover-files.txt
%APPDATA%\telegram desktop\recover-files.txt
%APPDATA%\thunderbird\recover-files.txt
%APPDATA%\thunderbird\crash reports\recover-files.txt
%HOMEPATH%\desktop\recover-files.txt
%HOMEPATH%\documents\recover-files.txt
%HOMEPATH%\documents\my music\recover-files.txt
%HOMEPATH%\documents\my pictures\recover-files.txt
%HOMEPATH%\documents\my videos\recover-files.txt
%HOMEPATH%\downloads\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\recover-files.txt
%HOMEPATH%\favorites\recover-files.txt
%HOMEPATH%\favorites\links for united states\recover-files.txt
%HOMEPATH%\favorites\microsoft websites\recover-files.txt
%HOMEPATH%\favorites\msn websites\recover-files.txt
%HOMEPATH%\favorites\windows live\recover-files.txt
%HOMEPATH%\links\recover-files.txt
%HOMEPATH%\saved games\recover-files.txt
%APPDATA%\thunderbird\profiles\hmz1jddi.default\recover-files.txt
%HOMEPATH%\contacts\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\recover-files.txt
%APPDATA%\thunderbird\pending pings\recover-files.txt
%APPDATA%\thunderbird\profiles\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\events\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\recover-files.txt
%APPDATA%\mozilla\firefox\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\minidumps\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\default\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\recover-files.txt
%APPDATA%\thunderbird\crash reports\events\recover-files.txt
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions\recover-files.txt
%APPDATA%\microsoft\systemcertificates\my\crls\recover-files.txt
%APPDATA%\mozilla\extensions\recover-files.txt
%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\security\recover-files.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\recover-files.txt
%APPDATA%\recover-files.txt
%APPDATA%\identities\recover-files.txt
%APPDATA%\identities\{1bc91121-7903-48ee-bf78-1bc7ca4b5761}\recover-files.txt
%APPDATA%\media center programs\recover-files.txt
%APPDATA%\microsoft\recover-files.txt
%APPDATA%\microsoft\credentials\recover-files.txt
%APPDATA%\microsoft\crypto\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\recover-files.txt
%APPDATA%\microsoft\crypto\rsa\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\recover-files.txt
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\recover-files.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\recover-files.txt
%APPDATA%\microsoft\internet explorer\recover-files.txt
%APPDATA%\microsoft\internet explorer\quick launch\recover-files.txt
%APPDATA%\microsoft\windows\recent\automaticdestinations\recover-files.txt
%APPDATA%\microsoft\windows\recent\customdestinations\recover-files.txt
%APPDATA%\microsoft\windows\sendto\recover-files.txt
%APPDATA%\microsoft\windows\start menu\recover-files.txt
%APPDATA%\microsoft\windows\start menu\programs\recover-files.txt
%APPDATA%\microsoft\windows\start menu\programs\accessories\recover-files.txt
%APPDATA%\microsoft\windows\themes\recover-files.txt
%APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\recover-files.txt
%APPDATA%\microsoft\windows\start menu\programs\administrative tools\recover-files.txt
%APPDATA%\microsoft\windows\start menu\programs\google chrome\recover-files.txt
%APPDATA%\microsoft\windows\start menu\programs\maintenance\recover-files.txt
%APPDATA%\microsoft\windows\start menu\programs\telegram desktop\recover-files.txt
%APPDATA%\microsoft\windows\start menu\programs\winrar\recover-files.txt
%APPDATA%\microsoft\windows\templates\recover-files.txt
%APPDATA%\microsoft\windows\privacie\low\recover-files.txt
%APPDATA%\microsoft\windows\recent\recover-files.txt
%APPDATA%\microsoft\windows\privacie\recover-files.txt
%APPDATA%\microsoft\windows\printer shortcuts\recover-files.txt
%APPDATA%\microsoft\windows\network shortcuts\recover-files.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\recover-files.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\recover-files.txt
%APPDATA%\microsoft\protect\recover-files.txt
%APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\recover-files.txt
%APPDATA%\microsoft\systemcertificates\recover-files.txt
%APPDATA%\microsoft\systemcertificates\my\recover-files.txt
%APPDATA%\mozilla\recover-files.txt
%HOMEPATH%\searches\recover-files.txt
%APPDATA%\microsoft\systemcertificates\my\certificates\recover-files.txt
%APPDATA%\microsoft\windows\recover-files.txt
%APPDATA%\microsoft\windows\iecompatcache\recover-files.txt
%APPDATA%\microsoft\windows\iecompatcache\low\recover-files.txt
%APPDATA%\microsoft\windows\ietldcache\recover-files.txt
%APPDATA%\microsoft\windows\ietldcache\low\recover-files.txt
%APPDATA%\microsoft\windows\libraries\recover-files.txt
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\recover-files.txt
%APPDATA%\microsoft\systemcertificates\my\ctls\recover-files.txt
%HOMEPATH%\favorites\links\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\recover-files.txt
%LOCALAPPDATA%\google\chrome\application\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\recover-files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\recover-files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\recover-files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\recover-files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\recover-files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\recover-files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\caps\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\cache\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\databases\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension state\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\__macosx\recover-files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\recover-files.txt
%LOCALAPPDATA%\google\chrome\recover-files.txt
%LOCALAPPDATA%\google\recover-files.txt
%LOCALAPPDATA%\recover-files.txt
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\recover-files.txt
C:\users\default\recover-files.txt
C:\users\default\appdata\recover-files.txt
C:\users\default\appdata\local\recover-files.txt
C:\users\default\appdata\local\history\recover-files.txt
C:\users\default\appdata\local\microsoft\recover-files.txt
C:\users\default\appdata\local\microsoft\windows\recover-files.txt
C:\users\default\appdata\local\microsoft\windows\gameexplorer\recover-files.txt
C:\users\default\appdata\local\microsoft\windows\<INETFILES>\recover-files.txt
C:\users\default\appdata\local\temp\recover-files.txt
C:\users\default\appdata\roaming\recover-files.txt
C:\users\default\appdata\roaming\media center programs\recover-files.txt
C:\users\default\appdata\roaming\microsoft\recover-files.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\recover-files.txt
%ALLUSERSPROFILE%\recover-files.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\recover-files.txt
%ProgramFiles(x86)%\recover-files.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\recover-files.txt
C:\recover-files.txt
C:\$recycle.bin\recover-files.txt
C:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\recover-files.txt
D:\recover-files.txt
D:\$recycle.bin\recover-files.txt
C:\documents and settings\recover-files.txt
D:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\recover-files.txt
C:\kms\recover-files.txt
C:\msocache\recover-files.txt
C:\msocache\all users\recover-files.txt
<Current directory>\recover-files.txt
C:\perflogs\recover-files.txt
C:\perflogs\admin\recover-files.txt
%ProgramFiles%\recover-files.txt
%ProgramFiles%\microsoft sql server compact edition\recover-files.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\recover-files.txt
C:\recovery\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\cookies\recover-files.txt
C:\users\public\desktop\recover-files.txt
C:\users\public\documents\my music\recover-files.txt
C:\users\public\documents\my pictures\recover-files.txt
C:\users\public\documents\my videos\recover-files.txt
C:\users\public\downloads\recover-files.txt
C:\users\public\favorites\recover-files.txt
C:\users\public\libraries\recover-files.txt
C:\users\public\music\sample music\recover-files.txt
C:\users\public\pictures\sample pictures\recover-files.txt
C:\users\public\recorded tv\recover-files.txt
C:\users\public\recorded tv\sample media\recover-files.txt
C:\users\public\videos\sample videos\recover-files.txt
%HOMEPATH%\recover-files.txt
%HOMEPATH%\appdata\recover-files.txt
C:\users\public\recover-files.txt
C:\users\default\links\recover-files.txt
C:\users\public\documents\recover-files.txt
C:\users\default\saved games\recover-files.txt
C:\users\default\favorites\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\recent\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\recover-files.txt
C:\users\default\desktop\recover-files.txt
C:\users\default\documents\recover-files.txt
C:\users\default\documents\my music\recover-files.txt
C:\users\default\documents\my pictures\recover-files.txt
C:\users\default\documents\my videos\recover-files.txt
C:\users\default\downloads\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\recover-files.txt
C:\users\default\appdata\roaming\microsoft\windows\templates\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\th\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ar\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\bg\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ca\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\cs\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\da\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pt_pt\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ro\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ru\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sk\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\sv\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\tr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\uk\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\vi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\zh_cn\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\zh_tw\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\pt_br\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\no\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\nl\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\lv\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\el\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\en\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\es\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fi\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fil\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\fr\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\he\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hu\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\id\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\it\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ja\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\ko\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\lt\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\de\recover-files.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\__macosx\_locales\hr\recover-files.txt
%WINDIR%\recover-files.txt

Moves the following files

from %TEMP%\adobearm.log to %TEMP%\adobearm.log.tpstu
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4.sqclgl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.sqclgl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json.ncrv
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.ncrv
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2.ncrv
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json.sqclgl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4.sqclgl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.xpjxtx
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.kusk
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.kusk
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.rzzrr
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.sagy
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json.sagy
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2.xpjxtx
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.sagy
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.xpjxtx
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4.sqclgl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin.sqclgl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4.sqclgl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4.lfwvu
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json.lfwvu
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json.lfwvu
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json.lfwvu
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json.uegzwb
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.uegzwb
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4.ptnxix
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json.uegzwb
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig.rkwj
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json.rkwj
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.rkwj
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.hsocl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd.hsocl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f.hsocl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595.hsocl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib.uegzwb
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e.hsocl
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4.ptnxix
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4.uzzk
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json.sagy
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.ooctu
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.cqzaaq
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.cqzaaq
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.lqzv
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.hvuxb
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.hvuxb
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.hvuxb
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.agsjlu
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.irnfg
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.wpgnqs
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2.buwc
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.hnnirp
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.oszrz
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.oszrz
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.cywv
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.cywv
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4.wpgnqs
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.wpgnqs
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.nxrsb
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.eyjg
from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.dbnzoh
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.ooctu
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4.kknu
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.ernqvn
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini.ernqvn
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.ernqvn
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4.vhuf
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4.sdzedq
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4.sdzedq
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4.sdzedq
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.sdzedq
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.sdzedq
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.sdzedq
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.sdzedq
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.biwh
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.biwh
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.sagy
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.vggq
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.vggq
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4.bpjid
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json.tnjcc
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\compatibility.ini.lrpo
from %TEMP%\dd_vcredist_amd64_20230912172247.log to %TEMP%\dd_vcredist_amd64_20230912172247.log.gvrdt
from %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log.wksjme
from %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log.wksjme
from %TEMP%\dd_vcredist_amd64_20230912172315.log to %TEMP%\dd_vcredist_amd64_20230912172315.log.wksjme
from %TEMP%\dd_vcredist_x86_20230912171710.log to %TEMP%\dd_vcredist_x86_20230912171710.log.wksjme
from %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log.lojh
from %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log.bungx
from %TEMP%\dd_vcredist_amd64_20230912172134.log to %TEMP%\dd_vcredist_amd64_20230912172134.log.lojh
from %TEMP%\dd_vcredist_x86_20230912171759.log to %TEMP%\dd_vcredist_x86_20230912171759.log.pqylht
from %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log.pqylht
from %TEMP%\dd_vcredist_x86_20230912171936.log to %TEMP%\dd_vcredist_x86_20230912171936.log.uhlh
from %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log.xdffi
from %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log.xdffi
from %TEMP%\dd_vcredist_x86_20230912172157.log to %TEMP%\dd_vcredist_x86_20230912172157.log.xdffi
from %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log.bungx
from %TEMP%\dd_vcredist_amd64_20230912172034.log to %TEMP%\dd_vcredist_amd64_20230912172034.log.czcktn
from %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log.pqylht
from %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log.czcktn
from %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log.pncfp
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.tpstu
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.tpstu
from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.tpstu
from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.jtlpww
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.jtlpww
from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.jtlpww
from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.dqyu
from %TEMP%\dd_vcredistmsi12db.txt to %TEMP%\dd_vcredistmsi12db.txt.dqyu
from %TEMP%\armui.ini to %TEMP%\armui.ini.tpstu
from %TEMP%\dd_vcredistui12db.txt to %TEMP%\dd_vcredistui12db.txt.dqyu
from %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log.whzrzv
from %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log.whzrzv
from %TEMP%\dd_vcredist_amd64_20230912171735.log to %TEMP%\dd_vcredist_amd64_20230912171735.log.caqj
from %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log.caqj
from %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log.caqj
from %TEMP%\dd_vcredist_amd64_20230912171824.log to %TEMP%\dd_vcredist_amd64_20230912171824.log.caqj
from %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log.uuckem
from %TEMP%\dd_vcredist_amd64_20230912171641.log to %TEMP%\dd_vcredist_amd64_20230912171641.log.dqyu
from %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log.hjjwq
from %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log.lojh
from %TEMP%\dd_vcredist_x86_20230912172224.log to %TEMP%\dd_vcredist_x86_20230912172224.log.hjjwq
from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred.odsjt
from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\music.library-ms.ajovau
from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\pictures.library-ms.ajovau
from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\videos.library-ms.ajovau
from %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.yxzevk
from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.zwcsig
from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.ijjo
from %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail to %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.ijjo
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.pxgup
from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.pxgup
from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json.thvsth
from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.lrpo
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json.lrpo
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4.lrpo
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2024-06-05_11_w-7ab47btxtewdh4a2yehg==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2024-06-05_11_w-7ab47btxtewdh4a2yehg==.jsonlz4.lrpo
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json.lrpo
from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\5f7236a2-9322-44c3-bb87-2d449394bfb3 to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\5f7236a2-9322-44c3-bb87-2d449394bfb3.dbnzoh
from %TEMP%\dd_vcredist_x86_20230912172322.log to %TEMP%\dd_vcredist_x86_20230912172322.log.hjjwq
from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\documents.library-ms.gwcm
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.nxrsb
from %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json to %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.impwn
from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47.qejgf
from %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log.strn
from %TEMP%\dd_vcredist_x86_20230912172350.log to %TEMP%\dd_vcredist_x86_20230912172350.log.ozjcl
from %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt to %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.ozjcl
from %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt to %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.ozjcl
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.ozjcl
from %TEMP%\jusched.log to %TEMP%\jusched.log.xgnqft
from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.ywnoat
from %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log.hjjwq
from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.gxfs
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.epnd
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.nnspn
from %TEMP%\rgia609.tmp to %TEMP%\rgia609.tmp.miuzv
from %TEMP%\rgia609.tmp-tmp to %TEMP%\rgia609.tmp-tmp.miuzv
from %TEMP%\setupexe(202309121734336dc).log to %TEMP%\setupexe(202309121734336dc).log.cvwjla
from %TEMP%\tmpaddon to %TEMP%\tmpaddon.qeohty
from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.cusv
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.jhjoiy
from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a.dbnzoh
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.impwn

Modifies the following files

D:\install.log
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest
C:\users\public\videos\sample videos\wildlife.wmv
C:\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv
C:\users\public\pictures\sample pictures\tulips.jpg
C:\users\public\pictures\sample pictures\penguins.jpg
C:\users\public\pictures\sample pictures\lighthouse.jpg
C:\users\public\pictures\sample pictures\koala.jpg
C:\users\public\pictures\sample pictures\jellyfish.jpg
C:\users\public\pictures\sample pictures\hydrangeas.jpg
C:\users\public\pictures\sample pictures\desert.jpg
C:\users\public\pictures\sample pictures\chrysanthemum.jpg
C:\users\public\music\sample music\sleep away.mp3
C:\users\public\music\sample music\maid with the flaxen hair.mp3
C:\users\public\music\sample music\kalimba.mp3
C:\users\public\libraries\recordedtv.library-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
C:\users\default\ntuser.dat.log1
C:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail
C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink
C:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winre.wim
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\boot.sdi
C:\kms\kms_vl_all_aio_debug.log
C:\kms\kms_vl_all_aio.cmd
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\docs.crx

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'18#.#2.126.81':80
'18#.#2.126.82':80
'18#.#2.126.83':80
'18#.#2.126.84':80
'18#.#2.126.85':80
'18#.#2.126.86':80
'18#.#2.126.87':80
'18#.#2.126.88':80
'w.##ys.io':80
'w.##ys.io':443

TCP

HTTP POST requests

http://18#.#2.126.89/update.php?id######

Other

'w.##ys.io':443

UDP

DNS ASK w.##ys.io

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial