Trojan.Siggen30.8143

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SHAVELPUSSY' = '"%LOCALAPPDATA%\1A263EB6-D490-791D-CBD5-0B87632E0AB0\SHAVELPUSSY.exe" '
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8c.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\Software\Classes\mimicfile\shell\open\command] '' = 'notepad.exe "%LOCALAPPDATA%\README_SHAVEL.txt"'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKCU\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\Software\Classes\.com] '' = 'mimicfile'

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

modifies the following system settings:

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'

Injects code into

the following system processes:

<SYSTEM32>\wbadmin.exe
<SYSTEM32>\wbengine.exe
<SYSTEM32>\vds.exe

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\7za.exe
%LOCALAPPDATA%\readme_shavel.txt
C:\readme_shavel.txt
C:\temp\session.tmp
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\session.tmp
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\xdel.exe
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything64.dll
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything32.dll
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything2.ini
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything.ini
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything.exe
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\shavelpussy.exe
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\7za.exe
%TEMP%\7zipsfx.000\xdel.exe
%TEMP%\7zipsfx.000\enc_default_default_2024-08-23_22-53-04=pussylikeashavel@cyberfear.com.exe
%TEMP%\7zipsfx.000\everything2.ini
%TEMP%\7zipsfx.000\everything.ini
%TEMP%\7zipsfx.000\everything64.dll
%TEMP%\7zipsfx.000\everything32.dll
%TEMP%\7zipsfx.000\everything.exe
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything.ini.tmp
%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything.db.tmp

Deletes the following files

%TEMP%\7zipsfx.000\7za.exe
%TEMP%\7zipsfx.000\enc_default_default_2024-08-23_22-53-04=pussylikeashavel@cyberfear.com.exe
%TEMP%\7zipsfx.000\everything.exe
%TEMP%\7zipsfx.000\xdel.exe
%TEMP%\7zipsfx.000\everything.ini
%TEMP%\7zipsfx.000\everything2.ini
%TEMP%\7zipsfx.000\everything32.dll
%TEMP%\7zipsfx.000\everything64.dll
%LOCALAPPDATA%\readme_shavel.txt

Moves the following files

from %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\oemprint.cat to %ProgramFiles%\microsoft office\office14\oemprint.cat.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\xmlfile.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\xmlfile.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\visualizer.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\visualizer.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\usercontrol.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\usercontrol.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\usercontrol.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\usercontrol.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\textfile.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\textfile.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\splashscreen.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\splashscreen.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\2 top.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\2 top.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\settingsinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\settingsinternal.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settingsinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settingsinternal.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settings.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settings.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\resourceinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\resourceinternal.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resourceinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resourceinternal.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resource.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resource.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\datatype\address.accft to %ProgramFiles%\microsoft office\templates\1033\access\datatype\address.accft.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\assets.accdt to %ProgramFiles%\microsoft office\templates\1033\access\assets.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\datatype\category.accft to %ProgramFiles%\microsoft office\templates\1033\access\datatype\category.accft.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\1 right.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\1 right.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\1 top.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\1 top.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\datatype\name.accft to %ProgramFiles%\microsoft office\templates\1033\access\datatype\name.accft.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\datatype\payment type.accft to %ProgramFiles%\microsoft office\templates\1033\access\datatype\payment type.accft.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\2 right.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\2 right.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\datatype\phone.accft to %ProgramFiles%\microsoft office\templates\1033\access\datatype\phone.accft.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\text.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\text.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\datatype\priority.accft to %ProgramFiles%\microsoft office\templates\1033\access\datatype\priority.accft.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\comments.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\comments.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\datatype\start end dates.accft to %ProgramFiles%\microsoft office\templates\1033\access\datatype\start end dates.accft.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\contacts.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\contacts.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\datatype\tags.accft to %ProgramFiles%\microsoft office\templates\1033\access\datatype\tags.accft.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\datatype\status.accft to %ProgramFiles%\microsoft office\templates\1033\access\datatype\status.accft.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\details.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\details.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\module.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\module.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dataset.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dataset.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\1033\prottplv.doc to %ProgramFiles%\microsoft office\office14\1033\prottplv.doc.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\loginform.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\loginform.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfig.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfig.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\aboutbox.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\aboutbox.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\sales pipeline.accdt to %ProgramFiles%\microsoft office\templates\1033\access\sales pipeline.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\northwind.accdt to %ProgramFiles%\microsoft office\templates\1033\access\northwind.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\wss\107.accdt to %ProgramFiles%\microsoft office\templates\1033\access\wss\107.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\wss\1100.accdt to %ProgramFiles%\microsoft office\templates\1033\access\wss\1100.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\marketing projects.accdt to %ProgramFiles%\microsoft office\templates\1033\access\marketing projects.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\mdiparent.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\mdiparent.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\tasks.accdt to %ProgramFiles%\microsoft office\templates\1033\access\tasks.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\students.accdt to %ProgramFiles%\microsoft office\templates\1033\access\students.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\faculty.accdt to %ProgramFiles%\microsoft office\templates\1033\access\faculty.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\1033\prottpln.xls to %ProgramFiles%\microsoft office\office14\1033\prottpln.xls.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\1033\prottplv.xls to %ProgramFiles%\microsoft office\office14\1033\prottplv.xls.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\1033\prottpln.doc to %ProgramFiles%\microsoft office\office14\1033\prottpln.doc.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfiginternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfiginternal.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\appconfigurationinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\appconfigurationinternal.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfo.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfo.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfointernal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfointernal.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\assemblyinfointernal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\assemblyinfointernal.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\class.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\class.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\class.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\class.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\codefile.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\codefile.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\dataset.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\dataset.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\dialog.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\dialog.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dialog.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dialog.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\emptydatabase.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\emptydatabase.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\emptydatabase.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\emptydatabase.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\explorer.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\explorer.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\form.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\form.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\form.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\form.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\interface.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\interface.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\mdiparent.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\mdiparent.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\events.accdt to %ProgramFiles%\microsoft office\templates\1033\access\events.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\issues.accdt to %ProgramFiles%\microsoft office\templates\1033\access\issues.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\charitable contributions.accdt to %ProgramFiles%\microsoft office\templates\1033\access\charitable contributions.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\fiverules.potx to %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx to %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs to %ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv to %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat to %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.pussylikeashavel@cyberfear.com
from %LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything.ini.tmp to %LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything.ini
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8 to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx to %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\mspub.exe to %ProgramFiles%\microsoft office\office14\mspub.exe.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\msaccess.exe to %ProgramFiles%\microsoft office\office14\msaccess.exe.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\excelcnv.exe to %ProgramFiles%\microsoft office\office14\excelcnv.exe.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\excel.exe to %ProgramFiles%\microsoft office\office14\excel.exe.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\outlook.exe to %ProgramFiles%\microsoft office\office14\outlook.exe.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\installed_resources14.xss to %ProgramFiles%\microsoft office\office14\installed_resources14.xss.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\groove.exe to %ProgramFiles%\microsoft office\office14\groove.exe.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex to %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex.pussylikeashavel@cyberfear.com
from %LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything.db.tmp to %LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything.db
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat.pussylikeashavel@cyberfear.com
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.pussylikeashavel@cyberfear.com
from %ProgramFiles%\mozilla thunderbird\omni.ja to %ProgramFiles%\mozilla thunderbird\omni.ja.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\license to %ProgramFiles%\java\jre1.8.0_45\license.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\issues.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\issues.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings to %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.pussylikeashavel@cyberfear.com
from %ProgramFiles%\mozilla thunderbird\removed-files to %ProgramFiles%\mozilla thunderbird\removed-files.pussylikeashavel@cyberfear.com
from %ProgramFiles%\mozilla thunderbird\precomplete to %ProgramFiles%\mozilla thunderbird\precomplete.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\cmap\identity-h to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\cmap\identity-h.pussylikeashavel@cyberfear.com
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\cmap\identity-v to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\cmap\identity-v.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\contacts.accdt to %ProgramFiles%\microsoft office\templates\1033\access\contacts.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\accwiz\acwzlib.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwzlib.accde.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\users.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\users.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\tasks.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\tasks.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\tabs.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\tabs.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\msgbox.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\msgbox.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\media.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\media.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\part\list.accdt to %ProgramFiles%\microsoft office\templates\1033\access\part\list.accdt.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.db to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.db.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.db to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.db.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\copyright to %ProgramFiles%\java\jre1.8.0_45\copyright.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\access\projects.accdt to %ProgramFiles%\microsoft office\templates\1033\access\projects.accdt.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\classlist to %ProgramFiles%\java\jre1.8.0_45\lib\classlist.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.zip to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.zip.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\meta-index.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklist to %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklist.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\security\cacerts to %ProgramFiles%\java\jre1.8.0_45\lib\security\cacerts.pussylikeashavel@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\release to %ProgramFiles%\java\jre1.8.0_45\release.pussylikeashavel@cyberfear.com
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.pussylikeashavel@cyberfear.com
from %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls to %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.pussylikeashavel@cyberfear.com

Modifies the following files

%ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.pussylikeashavel@cyberfear.com
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.pussylikeashavel@cyberfear.com
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\e09e81b6-b02f-4209-be75-530270eb15e8.pussylikeashavel@cyberfear.com
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.pussylikeashavel@cyberfear.com
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\a231c87b-227a-4be7-9b0a-acb8c08103e2.pussylikeashavel@cyberfear.com
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\saved-telemetry-pings\fec8b5cf-e9a0-4cf7-b788-f1bad94c2cc2.pussylikeashavel@cyberfear.com
%HOMEPATH%\desktop\glidescope_review_rev_010.docx.pussylikeashavel@cyberfear.com
%HOMEPATH%\desktop\hanni_umami_chapter.doc.pussylikeashavel@cyberfear.com
%HOMEPATH%\desktop\nwfieldnotes1966.docx.pussylikeashavel@cyberfear.com
%HOMEPATH%\desktop\ovp25012015.doc.pussylikeashavel@cyberfear.com
%ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.pussylikeashavel@cyberfear.com
%ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv.pussylikeashavel@cyberfear.com
%ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.pussylikeashavel@cyberfear.com
%ProgramFiles%\microsoft office\templates\1033\fiverules.potx.pussylikeashavel@cyberfear.com
%ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.pussylikeashavel@cyberfear.com
%ProgramFiles%\microsoft office\office14\installed_resources14.xss.pussylikeashavel@cyberfear.com
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.pussylikeashavel@cyberfear.com
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat.pussylikeashavel@cyberfear.com
%ProgramFiles%\mozilla thunderbird\omni.ja.pussylikeashavel@cyberfear.com
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi.pussylikeashavel@cyberfear.com
%ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.pussylikeashavel@cyberfear.com
%ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.pussylikeashavel@cyberfear.com
%ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.pussylikeashavel@cyberfear.com
%ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.pussylikeashavel@cyberfear.com
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.pussylikeashavel@cyberfear.com
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.pussylikeashavel@cyberfear.com

Substitutes the following files

%LOCALAPPDATA%\readme_shavel.txt

Moves itself

from <Full path to file> to <Full path to file>.pussylikeashavel@cyberfear.com

Network activity

Connects to

'<LOCALNET>.9.0':445
'<LOCALNET>.9.161':445
'<LOCALNET>.9.162':445
'<LOCALNET>.9.163':445
'<LOCALNET>.9.164':445
'<LOCALNET>.9.165':445
'<LOCALNET>.9.166':445
'<LOCALNET>.9.167':445
'<LOCALNET>.9.168':445
'<LOCALNET>.9.169':445
'<LOCALNET>.9.170':445
'<LOCALNET>.9.171':445
'<LOCALNET>.9.172':445
'<LOCALNET>.9.173':445
'<LOCALNET>.9.175':445
'<LOCALNET>.9.189':445
'<LOCALNET>.9.176':445
'<LOCALNET>.9.177':445
'<LOCALNET>.9.178':445
'<LOCALNET>.9.179':445
'<LOCALNET>.9.180':445
'<LOCALNET>.9.181':445
'<LOCALNET>.9.182':445
'<LOCALNET>.9.183':445
'<LOCALNET>.9.184':445
'<LOCALNET>.9.185':445
'<LOCALNET>.9.186':445
'<LOCALNET>.9.187':445
'<LOCALNET>.9.188':445
'<LOCALNET>.9.160':445
'<LOCALNET>.9.174':445
'<LOCALNET>.9.159':445
'<LOCALNET>.9.142':445
'<LOCALNET>.9.129':445
'<LOCALNET>.9.130':445
'<LOCALNET>.9.131':445
'<LOCALNET>.9.132':445
'<LOCALNET>.9.133':445
'<LOCALNET>.9.134':445
'<LOCALNET>.9.135':445
'<LOCALNET>.9.136':445
'<LOCALNET>.9.137':445
'<LOCALNET>.9.138':445
'<LOCALNET>.9.139':445
'<LOCALNET>.9.140':445
'<LOCALNET>.9.141':445
'<LOCALNET>.9.143':445
'<LOCALNET>.9.157':445
'<LOCALNET>.9.144':445
'<LOCALNET>.9.145':445
'<LOCALNET>.9.146':445
'<LOCALNET>.9.147':445
'<LOCALNET>.9.148':445
'<LOCALNET>.9.149':445
'<LOCALNET>.9.150':445
'<LOCALNET>.9.151':445
'<LOCALNET>.9.152':445
'<LOCALNET>.9.153':445
'<LOCALNET>.9.154':445
'<LOCALNET>.9.155':445
'<LOCALNET>.9.156':445
'<LOCALNET>.9.158':445
'<LOCALNET>.9.207':445
'<LOCALNET>.9.253':445
'<LOCALNET>.9.192':445
'<LOCALNET>.9.225':445
'<LOCALNET>.9.226':445
'<LOCALNET>.9.227':445
'<LOCALNET>.9.228':445
'<LOCALNET>.9.229':445
'<LOCALNET>.9.230':445
'<LOCALNET>.9.231':445
'<LOCALNET>.9.232':445
'<LOCALNET>.9.233':445
'<LOCALNET>.9.234':445
'<LOCALNET>.9.235':445
'<LOCALNET>.9.236':445
'<LOCALNET>.9.237':445
'<LOCALNET>.9.239':445
'<LOCALNET>.9.191':445
'<LOCALNET>.9.240':445
'<LOCALNET>.9.241':445
'<LOCALNET>.9.242':445
'<LOCALNET>.9.243':445
'<LOCALNET>.9.244':445
'<LOCALNET>.9.245':445
'<LOCALNET>.9.246':445
'<LOCALNET>.9.247':445
'<LOCALNET>.9.248':445
'<LOCALNET>.9.249':445
'<LOCALNET>.9.250':445
'<LOCALNET>.9.251':445
'<LOCALNET>.9.252':445
'<LOCALNET>.9.224':445
'<LOCALNET>.9.128':445
'<LOCALNET>.9.223':445
'<LOCALNET>.9.206':445
'<LOCALNET>.9.193':445
'<LOCALNET>.9.194':445
'<LOCALNET>.9.195':445
'<LOCALNET>.9.196':445
'<LOCALNET>.9.197':445
'<LOCALNET>.9.198':445
'<LOCALNET>.9.199':445
'<LOCALNET>.9.200':445
'<LOCALNET>.9.201':445
'<LOCALNET>.9.202':445
'<LOCALNET>.9.203':445
'<LOCALNET>.9.204':445
'<LOCALNET>.9.205':445
'<LOCALNET>.9.190':445
'<LOCALNET>.9.221':445
'<LOCALNET>.9.208':445
'<LOCALNET>.9.209':445
'<LOCALNET>.9.210':445
'<LOCALNET>.9.211':445
'<LOCALNET>.9.212':445
'<LOCALNET>.9.213':445
'<LOCALNET>.9.214':445
'<LOCALNET>.9.215':445
'<LOCALNET>.9.216':445
'<LOCALNET>.9.217':445
'<LOCALNET>.9.218':445
'<LOCALNET>.9.219':445
'<LOCALNET>.9.220':445
'<LOCALNET>.9.222':445
'<LOCALNET>.9.238':445
'<LOCALNET>.9.127':445
'<LOCALNET>.9.110':445
'<LOCALNET>.9.33':445
'<LOCALNET>.9.34':445
'<LOCALNET>.9.35':445
'<LOCALNET>.9.36':445
'<LOCALNET>.9.37':445
'<LOCALNET>.9.38':445
'<LOCALNET>.9.39':445
'<LOCALNET>.9.40':445
'<LOCALNET>.9.41':445
'<LOCALNET>.9.42':445
'<LOCALNET>.9.43':445
'<LOCALNET>.9.44':445
'<LOCALNET>.9.45':445
'<LOCALNET>.9.47':445
'<LOCALNET>.9.61':445
'<LOCALNET>.9.48':445
'<LOCALNET>.9.49':445
'<LOCALNET>.9.50':445
'<LOCALNET>.9.51':445
'<LOCALNET>.9.52':445
'<LOCALNET>.9.53':445
'<LOCALNET>.9.54':445
'<LOCALNET>.9.55':445
'<LOCALNET>.9.56':445
'<LOCALNET>.9.57':445
'<LOCALNET>.9.58':445
'<LOCALNET>.9.59':445
'<LOCALNET>.9.60':445
'<LOCALNET>.9.32':445
'<LOCALNET>.9.46':445
'<LOCALNET>.9.31':445
'<LOCALNET>.9.14':445
'<LOCALNET>.9.1':445
'<LOCALNET>.9.2':445
'<LOCALNET>.9.3':445
'<LOCALNET>.9.4':445
'<LOCALNET>.9.5':445
'<LOCALNET>.9.6':445
'<LOCALNET>.9.7':445
'<LOCALNET>.9.8':445
'<LOCALNET>.9.9':445
'<LOCALNET>.9.10':445
'<LOCALNET>.9.11':445
'<LOCALNET>.9.12':445
'<LOCALNET>.9.13':445
'<LOCALNET>.9.15':445
'<LOCALNET>.9.29':445
'<LOCALNET>.9.16':445
'<LOCALNET>.9.17':445
'<LOCALNET>.9.18':445
'<LOCALNET>.9.19':445
'<LOCALNET>.9.20':445
'<LOCALNET>.9.21':445
'<LOCALNET>.9.22':445
'<LOCALNET>.9.23':445
'<LOCALNET>.9.24':445
'<LOCALNET>.9.25':445
'<LOCALNET>.9.26':445
'<LOCALNET>.9.27':445
'<LOCALNET>.9.28':445
'<LOCALNET>.9.30':445
'<LOCALNET>.9.79':445
'<LOCALNET>.9.125':445
'<LOCALNET>.9.64':445
'<LOCALNET>.9.97':445
'<LOCALNET>.9.98':445
'<LOCALNET>.9.99':445
'<LOCALNET>.9.100':445
'<LOCALNET>.9.101':445
'<LOCALNET>.9.102':445
'<LOCALNET>.9.103':445
'<LOCALNET>.9.104':445
'<LOCALNET>.9.105':445
'<LOCALNET>.9.106':445
'<LOCALNET>.9.107':445
'<LOCALNET>.9.108':445
'<LOCALNET>.9.109':445
'<LOCALNET>.9.111':445
'<LOCALNET>.9.63':445
'<LOCALNET>.9.112':445
'<LOCALNET>.9.113':445
'<LOCALNET>.9.114':445
'<LOCALNET>.9.115':445
'<LOCALNET>.9.116':445
'<LOCALNET>.9.117':445
'<LOCALNET>.9.118':445
'<LOCALNET>.9.119':445
'<LOCALNET>.9.120':445
'<LOCALNET>.9.121':445
'<LOCALNET>.9.122':445
'<LOCALNET>.9.123':445
'<LOCALNET>.9.124':445
'<LOCALNET>.9.96':445
'<LOCALNET>.9.126':445
'<LOCALNET>.9.95':445
'<LOCALNET>.9.78':445
'<LOCALNET>.9.65':445
'<LOCALNET>.9.66':445
'<LOCALNET>.9.67':445
'<LOCALNET>.9.68':445
'<LOCALNET>.9.69':445
'<LOCALNET>.9.70':445
'<LOCALNET>.9.71':445
'<LOCALNET>.9.72':445
'<LOCALNET>.9.73':445
'<LOCALNET>.9.74':445
'<LOCALNET>.9.75':445
'<LOCALNET>.9.76':445
'<LOCALNET>.9.77':445
'<LOCALNET>.9.62':445
'<LOCALNET>.9.93':445
'<LOCALNET>.9.80':445
'<LOCALNET>.9.81':445
'<LOCALNET>.9.82':445
'<LOCALNET>.9.83':445
'<LOCALNET>.9.84':445
'<LOCALNET>.9.85':445
'<LOCALNET>.9.86':445
'<LOCALNET>.9.87':445
'<LOCALNET>.9.88':445
'<LOCALNET>.9.89':445
'<LOCALNET>.9.90':445
'<LOCALNET>.9.91':445
'<LOCALNET>.9.92':445
'<LOCALNET>.9.94':445
'<LOCALNET>.9.254':445

Miscellaneous

Searches for the following windows

ClassName: 'EVERYTHING_TASKBAR_NOTIFICATION' WindowName: ''

Creates and executes the following

'%TEMP%\7zipsfx.000\7za.exe' i
'%TEMP%\7zipsfx.000\7za.exe' x -y -p2191281892375931812 Everything64.dll
'%TEMP%\7zipsfx.000\enc_default_default_2024-08-23_22-53-04=pussylikeashavel@cyberfear.com.exe'
'%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\shavelpussy.exe'
'%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\shavelpussy.exe' -e ul1
'%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\shavelpussy.exe' -e watch -pid 2388 -!
'%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything.exe' -startup
'%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\shavelpussy.exe' -e ul2

Executes the following

'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\wbengine.exe'
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -H off
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
'<SYSTEM32>\wbadmin.exe' delete catalog -quiet
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\vds.exe'
'<SYSTEM32>\wbadmin.exe' delete catalog -quiet' (with hidden window)
'<SYSTEM32>\bcdedit.exe' /set {default} recoveryenabled no' (with hidden window)
'%TEMP%\7zipsfx.000\7za.exe' x -y -p2191281892375931812 Everything64.dll' (with hidden window)
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP' (with hidden window)
'%TEMP%\7zipsfx.000\enc_default_default_2024-08-23_22-53-04=pussylikeashavel@cyberfear.com.exe' ' (with hidden window)
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
'%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\shavelpussy.exe' -e watch -pid 2388 -!' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"' (with hidden window)
'%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\shavelpussy.exe' -e ul2' (with hidden window)
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\everything.exe' -startup' (with hidden window)
'%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\shavelpussy.exe' ' (with hidden window)
'%LOCALAPPDATA%\1a263eb6-d490-791d-cbd5-0b87632e0ab0\shavelpussy.exe' -e ul1' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"' (with hidden window)
'<SYSTEM32>\powercfg.exe' -H off' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'%TEMP%\7zipsfx.000\7za.exe' i' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial