Trojan.Encoder.45262

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Classes\CoffinFleet.encrypted\shell\open\command] '' = '"%APPDATA%\Microsoft\Windows\UpdateOrchestrator\WaaSMedic.exe" "%TEMP%\onefile_2744_134256919100047874\coffin_fleet_ransom...

Creates the following files on removable media

<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\about.htm
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\trivial-merge.html
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\alert.html
<Drive name for removable media>:\tree_view.html
<Drive name for removable media>:\adadsi.html
<Drive name for removable media>:\region-north-karelia.jpeg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\13.jpg
<Drive name for removable media>:\region-north-karelia.jpg
<Drive name for removable media>:\3.jpg
<Drive name for removable media>:\4f0bf7ff71f28.jpg
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4
<Drive name for removable media>:\firefly1.mov
<Drive name for removable media>:\video.mp4
<Drive name for removable media>:\51.mp4
<Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4
<Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
<Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf
<Drive name for removable media>:\dualectls.pdf
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\lom602.pdf
<Drive name for removable media>:\7790_preview.pdf
<Drive name for removable media>:\cert.pem
<Drive name for removable media>:\irgeek.pem
<Drive name for removable media>:\bg_search_box.png
<Drive name for removable media>:\hhhlcert.pem
<Drive name for removable media>:\ck.pem
<Drive name for removable media>:\asm.png
<Drive name for removable media>:\dissolveanother.png
<Drive name for removable media>:\block.png
<Drive name for removable media>:\breakpoint.png
<Drive name for removable media>:\cbz.png
<Drive name for removable media>:\background.png
<Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt
<Drive name for removable media>:\sim_gametheory_to_finance.ppt
<Drive name for removable media>:\proposaltemplates.ppt
<Drive name for removable media>:\accountsreceivable.ppt
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\router_manual.rtf
<Drive name for removable media>:\phytoremediation.rtf
<Drive name for removable media>:\myhrvoldhanssenbiharfamine.rtf
<Drive name for removable media>:\waterlandhealthkano.rtf
<Drive name for removable media>:\krsweden.rtf
<Drive name for removable media>:\calculatorworksheet.xls
<Drive name for removable media>:\flower_trans_matte.wmv
<Drive name for removable media>:\babyboymaintoscenesbackground_pal.wmv
<Drive name for removable media>:\military_callsigns_0311.rtf
<Drive name for removable media>:\removedtitles_records.xls
<Drive name for removable media>:\excel_example.xls
<Drive name for removable media>:\suspendedcompanies.xlsx
<Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx
<Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx
<Drive name for removable media>:\national_autism_preparation_programs.xlsx
<Drive name for removable media>:\removedtitles_records.zip
<Drive name for removable media>:\al.xlsx
<Drive name for removable media>:\2013_finalsummaryforweb.xlsx
<Drive name for removable media>:\highly_cited_2001.xlsx
<Drive name for removable media>:\calculatorworksheet.zip
<Drive name for removable media>:\productos.zip
<Drive name for removable media>:\1sm_price.zip
<Drive name for removable media>:\system volume information\wpsettings.dat
<Drive name for removable media>:\price030215.zip

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM Taskmgr.exe
'<SYSTEM32>\taskkill.exe' /F /IM procexp.exe
'<SYSTEM32>\taskkill.exe' /F /IM procexp64.exe
'<SYSTEM32>\taskkill.exe' /F /IM ProcessHacker.exe

Patches code

in NTDLL dll

gktr.exe process, ntdll.dll module

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\taskkill.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\coffin_735205.doc
%HOMEPATH%\desktop\coffin_891887.avi
%HOMEPATH%\desktop\coffin_619376.avi
%HOMEPATH%\desktop\coffin_841908.bmp
%HOMEPATH%\desktop\coffin_871862.bmp
%HOMEPATH%\desktop\coffin_703162.docx
%HOMEPATH%\desktop\coffin_959094.doc
%HOMEPATH%\desktop\coffin_342369.doc
%HOMEPATH%\desktop\coffin_255460.doc
%HOMEPATH%\desktop\coffin_418233.docx
%HOMEPATH%\desktop\coffin_405299.cer

Modifies file system

Creates the following files

%APPDATA%\microsoft\windows\updateorchestrator\waasmedic.exe
%TEMP%\onefile_2744_134256919100047874\coffin_fleet_ransom.dll
%TEMP%\onefile_2744_134256919100047874\_bz2.pyd
%TEMP%\onefile_2744_134256919100047874\_cffi_backend.pyd
%TEMP%\onefile_2744_134256919100047874\_ctypes.pyd
%TEMP%\onefile_2744_134256919100047874\_decimal.pyd
%TEMP%\onefile_2744_134256919100047874\_elementtree.pyd
%TEMP%\onefile_2744_134256919100047874\_hashlib.pyd
%TEMP%\onefile_2744_134256919100047874\_lzma.pyd
%TEMP%\onefile_2744_134256919100047874\_multiprocessing.pyd
%TEMP%\onefile_2744_134256919100047874\_queue.pyd
%TEMP%\onefile_2744_134256919100047874\_socket.pyd
%TEMP%\onefile_2744_134256919100047874\_ssl.pyd
%TEMP%\onefile_2744_134256919100047874\_wmi.pyd
%TEMP%\onefile_2744_134256919100047874\concrt140.dll
%TEMP%\onefile_2744_134256919100047874\libcrypto-3.dll
%TEMP%\onefile_2744_134256919100047874\libeay32.dll
%TEMP%\onefile_2744_134256919100047874\libffi-8.dll
%TEMP%\onefile_2744_134256919100047874\libssl-3.dll
%TEMP%\onefile_2744_134256919100047874\msvcp140.dll
%TEMP%\onefile_2744_134256919100047874\msvcp140_1.dll
%TEMP%\onefile_2744_134256919100047874\pyexpat.pyd
%TEMP%\onefile_2744_134256919100047874\python3.dll
%TEMP%\onefile_2744_134256919100047874\python313.dll
%TEMP%\onefile_2744_134256919100047874\qt5core.dll
%TEMP%\onefile_2744_134256919100047874\qt5dbus.dll
%TEMP%\onefile_2744_134256919100047874\qt5gui.dll
%TEMP%\onefile_2744_134256919100047874\qt5multimedia.dll
%TEMP%\onefile_2744_134256919100047874\qt5network.dll
%TEMP%\onefile_2744_134256919100047874\qt5printsupport.dll
%TEMP%\onefile_2744_134256919100047874\qt5qml.dll
%TEMP%\onefile_2744_134256919100047874\qt5qmlmodels.dll
%TEMP%\onefile_2744_134256919100047874\qt5quick.dll
%TEMP%\onefile_2744_134256919100047874\qt5svg.dll
%TEMP%\onefile_2744_134256919100047874\qt5websockets.dll
%TEMP%\onefile_2744_134256919100047874\qt5widgets.dll
%TEMP%\onefile_2744_134256919100047874\select.pyd
%TEMP%\onefile_2744_134256919100047874\ssleay32.dll
%TEMP%\onefile_2744_134256919100047874\unicodedata.pyd
%TEMP%\onefile_2744_134256919100047874\vcruntime140.dll
%TEMP%\onefile_2744_134256919100047874\vcruntime140_1.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qtcore.pyd
%TEMP%\onefile_2744_134256919100047874\pyqt5\qtgui.pyd
%TEMP%\onefile_2744_134256919100047874\pyqt5\qtwidgets.pyd
%TEMP%\onefile_2744_134256919100047874\pyqt5\sip.pyd
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\iconengines\qsvgicon.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\imageformats\qgif.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\imageformats\qicns.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\imageformats\qico.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\imageformats\qjpeg.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\imageformats\qsvg.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\imageformats\qtga.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\imageformats\qtiff.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\imageformats\qwbmp.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\imageformats\qwebp.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\mediaservice\dsengine.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\mediaservice\qtmedia_audioengine.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\mediaservice\wmfengine.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\platforms\qminimal.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\platforms\qoffscreen.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\platforms\qwebgl.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\platforms\qwindows.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\platformthemes\qxdgdesktopportal.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\printsupport\windowsprintersupport.dll
%TEMP%\onefile_2744_134256919100047874\pyqt5\qt-plugins\styles\qwindowsvistastyle.dll
%TEMP%\onefile_2744_134256919100047874\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\onefile_2744_134256919100047874\jaraco\text\lorem ipsum.txt
%TEMP%\onefile_2744_134256919100047874\numpy\_core\_multiarray_tests.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\_core\_multiarray_umath.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\fft\_pocketfft_umath.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\linalg\_umath_linalg.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\random\_bounded_integers.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\random\_common.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\random\_generator.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\random\_mt19937.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\random\_pcg64.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\random\_philox.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\random\_sfc64.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\random\bit_generator.pyd
%TEMP%\onefile_2744_134256919100047874\numpy\random\mtrand.pyd
%TEMP%\onefile_2744_134256919100047874\numpy.libs\libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
%TEMP%\onefile_2744_134256919100047874\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
%TEMP%\onefile_2744_134256919100047874\pygame\sdl2.dll
%TEMP%\onefile_2744_134256919100047874\pygame\sdl2_image.dll
%TEMP%\onefile_2744_134256919100047874\pygame\sdl2_mixer.dll
%TEMP%\onefile_2744_134256919100047874\pygame\sdl2_ttf.dll
%TEMP%\onefile_2744_134256919100047874\pygame\_camera.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\_freetype.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\_sprite.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\base.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\bufferproxy.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\color.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\constants.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\display.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\draw.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\event.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\font.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\freesansbold.ttf
%TEMP%\onefile_2744_134256919100047874\pygame\freetype.dll
%TEMP%\onefile_2744_134256919100047874\pygame\gfxdraw.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\image.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\imageext.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\joystick.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\key.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\libjpeg-9.dll
%TEMP%\onefile_2744_134256919100047874\pygame\libmodplug-1.dll
%TEMP%\onefile_2744_134256919100047874\pygame\libogg-0.dll
%TEMP%\onefile_2744_134256919100047874\pygame\libopus-0.dll
%TEMP%\onefile_2744_134256919100047874\pygame\libopusfile-0.dll
%TEMP%\onefile_2744_134256919100047874\pygame\libpng16-16.dll
%TEMP%\onefile_2744_134256919100047874\pygame\libtiff-5.dll
%TEMP%\onefile_2744_134256919100047874\pygame\libwebp-7.dll
%TEMP%\onefile_2744_134256919100047874\pygame\mask.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\math.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\mixer.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\mixer_music.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\mouse.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\newbuffer.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\pixelarray.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\pixelcopy.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\portmidi.dll
%TEMP%\onefile_2744_134256919100047874\pygame\pygame_icon.bmp
%TEMP%\onefile_2744_134256919100047874\pygame\pypm.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\rect.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\rwobject.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\scrap.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\surface.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\surflock.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\time.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\transform.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\zlib1.dll
%TEMP%\onefile_2744_134256919100047874\pygame\_sdl2\audio.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\_sdl2\sdl2.pyd
%TEMP%\onefile_2744_134256919100047874\pygame\_sdl2\video.pyd
%LOCALAPPDATA%\microsoft\windows\coffin_fleet_wp.jpg
%LOCALAPPDATA%\microsoft\windows\coffin_fleet_deadline.json
%HOMEPATH%\desktop\coffin_891887.avi.fleet
%HOMEPATH%\desktop\coffin_735205.doc.fleet
%HOMEPATH%\desktop\coffin_841908.bmp.fleet
%HOMEPATH%\desktop\coffin_871862.bmp.fleet
%HOMEPATH%\desktop\coffin_706082.ini.fleet
%HOMEPATH%\desktop\coffin_619376.avi.fleet
%HOMEPATH%\desktop\coffin_703162.docx.fleet
%HOMEPATH%\desktop\coffin_959094.doc.fleet
%HOMEPATH%\desktop\coffin_255460.doc.fleet
%HOMEPATH%\desktop\coffin_342369.doc.fleet
%HOMEPATH%\downloads\coffin_625073.ini.fleet
%HOMEPATH%\videos\coffin_295423.ini.fleet
%HOMEPATH%\pictures\camera roll\coffin_851374.ini.fleet
%HOMEPATH%\documents\coffin_349116.ini.fleet
%HOMEPATH%\pictures\coffin_975892.ini.fleet
%HOMEPATH%\3d objects\coffin_845507.ini.fleet
%HOMEPATH%\music\coffin_267317.ini.fleet
%HOMEPATH%\contacts\coffin_328373.ini.fleet
%HOMEPATH%\favorites\coffin_412947.ini.fleet
%HOMEPATH%\saved games\coffin_334543.ini.fleet
%HOMEPATH%\links\coffin_161367.ini.fleet
%HOMEPATH%\favorites\links\coffin_276591.ini.fleet
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\extensions\coffin_384649.json.fleet
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\coffin_601710.json.fleet
%LOCALAPPDATA%\google\chrome\application\coffin_548827.log.fleet
%LOCALAPPDATA%\google\chrome\user data\default\coffin_882308.ico.fleet
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\pepperflash\coffin_250243.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\coffin_246661.log.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extension state\coffin_349019.log.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\coffin_684568.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\coffin_829376.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\coffin_544079.js.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\coffin_144070.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\coffin_282889.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\coffin_422646.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\coffin_976169.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\coffin_696945.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\coffin_486620.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\coffin_908119.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\coffin_666092.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\coffin_380979.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\coffin_847823.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\coffin_793577.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\coffin_372361.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\coffin_255083.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\coffin_842652.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\coffin_647875.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\coffin_416624.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\coffin_430909.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\coffin_443580.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\coffin_141872.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\coffin_361457.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\coffin_243780.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\coffin_224580.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\coffin_589630.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\coffin_353541.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\coffin_156526.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\coffin_627108.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\coffin_119162.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\coffin_992118.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\coffin_186754.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\coffin_937984.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\coffin_902915.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\coffin_876678.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\coffin_312175.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\coffin_430746.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\coffin_430160.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\coffin_479954.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\coffin_662236.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\coffin_498296.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\coffin_780603.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\coffin_795869.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\coffin_682407.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\coffin_268916.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\coffin_855416.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\coffin_488839.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\coffin_200162.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\coffin_820581.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\coffin_136904.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\coffin_148606.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\coffin_732340.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\coffin_997926.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\coffin_135834.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\coffin_957610.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\coffin_916905.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\coffin_585072.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\coffin_988510.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\coffin_813529.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\coffin_745939.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\coffin_864282.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\coffin_443537.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\coffin_872766.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\coffin_172943.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\coffin_645223.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\coffin_984760.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\coffin_618259.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\coffin_864992.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\coffin_374733.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\coffin_501940.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\coffin_413599.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\coffin_465666.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\coffin_420885.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\coffin_984466.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\coffin_465548.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\coffin_173263.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\coffin_356775.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\coffin_118941.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\coffin_621166.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\coffin_332138.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\coffin_871403.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\coffin_823696.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\coffin_844203.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\coffin_465654.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\coffin_929350.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\coffin_244487.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\coffin_852475.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\coffin_583651.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\coffin_450871.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\coffin_164829.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\coffin_826133.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\coffin_427468.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\coffin_167141.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\coffin_863136.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\coffin_223252.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\coffin_931922.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\coffin_575127.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\coffin_197317.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\coffin_850797.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\coffin_112213.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\coffin_376508.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\coffin_265308.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\coffin_313060.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\coffin_769723.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\coffin_745761.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\coffin_554573.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\coffin_786577.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\coffin_509989.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\coffin_384563.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\coffin_792885.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\coffin_255000.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\coffin_827442.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\coffin_535179.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\coffin_466809.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\coffin_315517.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\coffin_879775.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\coffin_477778.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\coffin_116592.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\coffin_952265.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\coffin_258223.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\coffin_936743.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\coffin_329611.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\coffin_586512.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\coffin_923121.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\coffin_343064.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\coffin_545419.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\coffin_618386.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\coffin_115292.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\coffin_380120.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\coffin_775082.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\coffin_456879.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\coffin_149645.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\coffin_107633.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\coffin_160254.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\coffin_161629.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\coffin_687244.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\coffin_857496.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\coffin_734385.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\coffin_574955.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\coffin_248922.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\coffin_870976.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\coffin_763412.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\coffin_486828.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\coffin_643525.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\coffin_239550.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\coffin_291326.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\coffin_303463.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\coffin_766615.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\coffin_734718.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\coffin_261346.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\coffin_860142.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\coffin_270198.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\coffin_840894.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\coffin_697467.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\coffin_178657.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\coffin_219445.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\coffin_369222.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\coffin_221958.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\coffin_349631.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\coffin_929702.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\coffin_205424.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\coffin_190386.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\coffin_569071.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\coffin_156881.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\coffin_529391.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\coffin_250283.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\coffin_785199.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\coffin_218260.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\coffin_941887.json.fleet
%LOCALAPPDATA%\microsoft\edge\user data\default\coffin_780081.ico.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\coffin_179248.json.fleet
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\coffin_355891.log.fleet
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\coffin_680919.log.fleet
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\coffin_195825.log.fleet
%LOCALAPPDATA%\microsoft\internet explorer\coffin_291683.log.fleet
%LOCALAPPDATA%\microsoft\internet explorer\coffin_314580.txt.fleet
%LOCALAPPDATA%\microsoft\internet explorer\coffin_648422.log.fleet
%LOCALAPPDATA%\microsoft\internet explorer\cachestorage\coffin_691087.log.fleet
%LOCALAPPDATA%\microsoft\internet explorer\cachestorage\coffin_707773.log.fleet
%LOCALAPPDATA%\microsoft\windows sidebar\coffin_265068.ini.fleet
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\ac\microsoft\clr_v4.0\usagelogs\coffin_601819.log.fleet
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\localcache\local\microsoft\clr_v4.0\usagelogs\coffin_895814.log.fleet
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\coffin_631920.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.photos_8wekyb3d8bbwe\localstate\coffin_624160.sqlite.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_324428.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_986335.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_961317.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_695408.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_834085.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_905072.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_982498.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_891349.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_470286.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_361954.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_791500.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_319470.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_434187.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_296380.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_328165.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_995603.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_360002.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_819549.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_764450.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_556162.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_921616.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_196934.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_888861.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_881826.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_825230.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_761697.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_768189.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\appdata\indexed db\coffin_320095.log.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\coffin_169128.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_373642.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\appdata\indexed db\coffin_133151.log.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\coffin_858849.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\coffin_503426.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\coffin_406457.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\coffin_183404.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\coffin_390556.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_761856.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_460623.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_705027.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_720841.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_617803.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\coffin_386308.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_660973.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\coffin_621638.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\coffin_138821.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\coffin_767573.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\coffin_719240.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\coffin_576681.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_193312.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_534774.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_423605.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_319048.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_106221.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_881107.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_825456.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_282137.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_884354.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_136078.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_878724.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_299983.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_930420.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_170177.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_330019.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_247270.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_471257.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_497867.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_994677.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_187038.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_146565.txt.fleet
%LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\coffin_720607.txt.fleet
%TEMP%\onefile_2744_134256919100047874\jaraco\text\coffin_875463.txt.fleet
%APPDATA%\microsoft\internet explorer\quick launch\coffin_564685.ini.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_411843.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_797873.json.fleet
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\coffin_469080.ini.fleet
%APPDATA%\mozilla\firefox\coffin_392001.ini.fleet
%APPDATA%\mozilla\firefox\coffin_951079.ini.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_639280.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_235491.ini.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_266398.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_457426.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_185272.txt.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_775198.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_111135.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_123113.js.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_784718.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_501746.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_195171.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_395825.txt.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\coffin_225466.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\coffin_964275.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_998863.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_837794.js.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_607623.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_625432.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\coffin_281379.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_643810.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_439530.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_169785.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_388705.sqlite.fleet
%APPDATA%\opera software\opera stable\coffin_309941.log.fleet
%APPDATA%\opera software\opera stable\coffin_980013.json.fleet
%APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\coffin_436220.json.fleet
%APPDATA%\opera software\opera stable\extension state\coffin_588712.log.fleet
%APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\coffin_254703.js.fleet
%APPDATA%\opera software\opera stable\coffin_929452.json.fleet
%APPDATA%\thunderbird\coffin_590101.ini.fleet
%APPDATA%\thunderbird\profiles\b376zl1q.default\coffin_293542.json.fleet
%APPDATA%\thunderbird\coffin_854175.ini.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_335475.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_160449.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_472609.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_371984.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_402362.ini.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_238510.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_359679.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_727245.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_450910.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_932865.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_222755.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_976358.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_794462.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_569237.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_948076.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_429133.txt.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_827398.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_414086.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_779701.js.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_545206.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_490588.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_490345.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_447118.json.fleet
%HOMEPATH%\searches\coffin_811444.ini.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\coffin_945970.json.fleet
%HOMEPATH%\coffin_862233.ini.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\coffin_721775.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\coffin_416833.json.fleet
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\coffin_322990.7z.fleet

Sets the 'hidden' attribute to the following files

%APPDATA%\microsoft\windows\updateorchestrator\waasmedic.exe

Deletes following files that it created itself

%TEMP%\onefile_2744_134256919100047874\pygame\coffin_759839.bmp
%TEMP%\onefile_2744_134256919100047874\jaraco\text\coffin_875463.txt

Moves the following files

from %TEMP%\onefile_2744_134256919100047874\jaraco\text\lorem ipsum.txt to %TEMP%\onefile_2744_134256919100047874\jaraco\text\coffin_875463.txt
from %TEMP%\onefile_2744_134256919100047874\pygame\pygame_icon.bmp to %TEMP%\onefile_2744_134256919100047874\pygame\coffin_759839.bmp
from %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\coffin_564685.ini
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\coffin_469080.ini
from %APPDATA%\microsoft\office\recent\index.dat to %APPDATA%\microsoft\office\recent\coffin_375539.dat
from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\coffin_951079.ini
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\coffin_392001.ini
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_797873.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_411843.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_235491.ini
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_457426.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_266398.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_639280.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_775198.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_111135.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_185272.txt
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_123113.js
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_195171.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_395825.txt
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_784718.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_501746.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_837794.js
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\coffin_225466.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\coffin_964275.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_607623.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_998863.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\coffin_281379.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_625432.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_439530.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_388705.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_643810.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_169785.sqlite
from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\times.json to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\coffin_436220.json
from %APPDATA%\opera software\opera stable\default_partner_content.json to %APPDATA%\opera software\opera stable\coffin_929452.json
from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\coffin_254703.js
from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\coffin_309941.log
from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\coffin_980013.json
from %APPDATA%\opera software\opera stable\extension state\000003.log to %APPDATA%\opera software\opera stable\extension state\coffin_588712.log
from %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml to %APPDATA%\opera software\opera stable\dictionaries\coffin_536866.xml
from %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip to %APPDATA%\opera software\opera stable\themes_backup\coffin_283311.zip
from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\coffin_731054.dat
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\coffin_590101.ini
from %APPDATA%\thunderbird\profiles\b376zl1q.default\times.json to %APPDATA%\thunderbird\profiles\b376zl1q.default\coffin_293542.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_160449.sqlite
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\coffin_854175.ini
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addons.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_335475.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_472609.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cert9.db to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_186870.db
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_371984.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_238510.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_402362.ini
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_359679.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_932865.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_727245.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_450910.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_222755.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_569237.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_976358.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\key4.db to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_633603.db
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\mailviews.dat to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_652428.dat
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_948076.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_794462.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_429133.txt
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_827398.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_414086.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_779701.js
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_545206.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_447118.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_490588.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\times.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_490345.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\coffin_945970.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\coffin_416833.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\coffin_721775.sqlite

Modifies the following files

%APPDATA%\microsoft\windows\themes\transcodedwallpaper
%APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1920_1080_pos2.jpg

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%APPDATA%\microsoft\windows\updateorchestrator\waasmedic.exe'

Executes the following

'%APPDATA%\microsoft\windows\updateorchestrator\waasmedic.exe' ' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial