Защити созданное

Другие наши ресурсы

  • free.drweb.kz — бесплатные утилиты, плагины, информеры
  • av-desk.com — интернет-сервис для поставщиков услуг Dr.Web AV-Desk
  • curenet.drweb.kz — сетевая лечащая утилита Dr.Web CureNet!
Закрыть

Библиотека
Моя библиотека

Чтобы добавить ресурс в библиотеку, войдите в аккаунт.

+ Добавить в библиотеку

Ресурсов: -

Последний: -

Моя библиотека

Поиск
Поиск

Поиск

Поддержка
Круглосуточная поддержка | Правила обращения

Напишите

Запрос через форму

Позвоните

Глобальная поддержка:
+7 (495) 789-45-86

ЧаВо | Форум

Ваши запросы

  • Все: -
  • Незакрытые: -
  • Последний: -
Создать новый запрос Частые вопросы

Позвоните

Глобальная поддержка:
+7 (495) 789-45-86

Свяжитесь с нами Незакрытые запросы: 

Профиль

Профиль

KZ

RU CN EN ES FR IT JP KZ UZ BY ID
Закрыть
Сервисы
Сканеры
Dr.Web vxCube
Демо
Вирусная библиотека
База знаний

Технологии

Термины

Обучение и просвещение

Мифы

Новости

Trojan.Encoder.45039

Добавлен в вирусную базу Dr.Web: 2026-05-09

Описание добавлено:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurity' = '<Full path to file>'
Sets the following service settings
  • [HKLM\SYSTEM\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
  • [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
  • [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
  • Windows Defender
deletes volume shadow copies.
adds antivirus exclusion:
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -DisableIOAVProtection $true"
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath "<Current directory>"
Executes the following
  • '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
Reads files which store third party applications passwords
  • %HOMEPATH%\desktop\13.jpg
  • %HOMEPATH%\desktop\2.jpeg
  • %HOMEPATH%\desktop\210252809.jpg
  • %HOMEPATH%\desktop\3.jpg
  • %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
  • %HOMEPATH%\desktop\64bit_notes.htm
  • %HOMEPATH%\desktop\about.html
  • %HOMEPATH%\desktop\adhd_and_obesity.docx
  • %HOMEPATH%\desktop\advice_process.htm
  • %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
  • %HOMEPATH%\desktop\archer.avi
  • %HOMEPATH%\desktop\contosoroot.cer
  • %HOMEPATH%\desktop\cveuropeo.doc
  • %HOMEPATH%\desktop\default.bmp
  • %HOMEPATH%\desktop\delete.avi
  • %HOMEPATH%\desktop\dialmap.bmp
  • %HOMEPATH%\desktop\february_catalogue__2015.doc
  • %HOMEPATH%\desktop\fi51.doc
  • %HOMEPATH%\desktop\glidescope_review_rev_010.docx
  • %HOMEPATH%\desktop\ituneshelpunavailable.htm
  • %HOMEPATH%\desktop\ituneshelpunavailable.html
  • %HOMEPATH%\desktop\parnas_01.jpeg
  • %HOMEPATH%\desktop\region-north-karelia.jpeg
  • %HOMEPATH%\desktop\sdkfailsafeemulator.cer
  • %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
  • %HOMEPATH%\desktop\sdszfo.docx
  • %HOMEPATH%\desktop\split.avi
  • %HOMEPATH%\desktop\testee.cer
  • %HOMEPATH%\desktop\tileimage.bmp
  • %HOMEPATH%\desktop\tree_view.htm
Modifies file system
Creates the following files
  • C:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\desktop.ini.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.msi.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\ose.exe.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\osetup.dll.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\owow64ww.cab.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pidgenx.dll.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.msi.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.dll.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.exe.encrypted
  • C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excellr.cab.encrypted
  • C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.msi.encrypted
  • C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml.encrypted
  • C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.msi.encrypted
  • C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml.encrypted
  • C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\pptlr.cab.encrypted
  • C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.msi.encrypted
  • C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml.encrypted
  • C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publr.cab.encrypted
  • C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlklr.cab.encrypted
  • C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.msi.encrypted
  • C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml.encrypted
  • C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordlr.cab.encrypted
  • C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.msi.encrypted
  • C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.msi.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.xml.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.cab.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.msi.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.cab.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.msi.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.cab.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.msi.encrypted
  • C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml.encrypted
  • C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\inflr.cab.encrypted
  • C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.msi.encrypted
  • C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml.encrypted
  • C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.cab.encrypted
  • C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.msi.encrypted
  • C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.xml.encrypted
  • C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.msi.encrypted
  • C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml.encrypted
  • C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onotelr.cab.encrypted
  • C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovelr.cab.encrypted
  • C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.msi.encrypted
  • C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml.encrypted
  • C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.cab.encrypted
  • C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.msi.encrypted
  • C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.xml.encrypted
  • C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.cab.encrypted
  • C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.msi.encrypted
  • C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.xml.encrypted
  • C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\branding.xml.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officelr.cab.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemui.msi.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemui.xml.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemuiset.msi.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemuiset.xml.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\offsetlr.cab.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\osetupui.dll.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\pss10r.chm.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.chm.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\shellui.mst.encrypted
  • C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64mui.msi.encrypted
  • C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64mui.xml.encrypted
  • C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64muiset.msi.encrypted
  • C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64muiset.xml.encrypted
  • C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\owow64lr.cab.encrypted
  • C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.msi.encrypted
  • C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.xml.encrypted
  • C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.msi.encrypted
  • C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.xml.encrypted
  • C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\acclr.cab.encrypted
  • C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\branding.xml.encrypted
  • C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.cab.encrypted
  • C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.msi.encrypted
  • C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.xml.encrypted
  • C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\setup.xml.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020060.msp.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.encrypted
  • %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.encrypted
  • %ALLUSERSPROFILE%\microsoft\crypto\systemkeys\d3c41fa3acf8a2df1a3b10b0caaa8cff_8cf7b530-613e-439b-a8c5-ccfc0e745400.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\resource.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\resource.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\eventstore.db.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\parse.dat.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\telemetry.asm-windowsdefault.json.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.allow.json.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.app.json.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.privacy.json.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.tracing.json.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\eventstore.db.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\eventstore.db.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_45_22.etl.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_5_7.etl.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_6_21.etl.encrypted
  • %ALLUSERSPROFILE%\microsoft\identitycrl\int\wlidsvcconfig.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\identitycrl\production\wlidsvcconfig.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\mf\active.grl.encrypted
  • %ALLUSERSPROFILE%\microsoft\mf\pending.grl.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edb.chk.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edb.log.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edbres00001.jrs.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edbres00002.jrs.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edbtmp.log.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.db.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.jfm.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\mysite.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.chk.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.log.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb00002.log.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00001.jrs.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00002.jrs.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbtmp.log.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.db.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.jfm.encrypted
  • %ALLUSERSPROFILE%\microsoft\storage health\storagehealthmodel.dat.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\desktopsettings2013.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\easeofaccesssettings2013.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013backup.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2010.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftnotepad.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2010win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2010win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013backupwin32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013backupwin64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013office365win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013office365win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2013cawin32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2013cawin64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2016cawin32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2016cawin64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftskypeforbusiness2016win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftskypeforbusiness2016win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftwordpad.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\networkprinters.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\roamingcredentialsettings.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\themesettings2013.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\vdistate.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate.xsd.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013.xsd.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013a.xsd.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.databasecompare.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.excel.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.graph.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.lync.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.lync_basic.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.lync_online.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.msaccess.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.msouc.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.mspub.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.onenote.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.outlook.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.powerpnt.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.setlang.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb_basic.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb_online.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb_onlineg.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.spreadsheetcompare.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.winword.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\nslist.hxl.encrypted
  • %ALLUSERSPROFILE%\mozilla\profile_count_308046b0af4a39cb.json.encrypted
  • %ALLUSERSPROFILE%\mozilla\uninstall_ping_308046b0af4a39cb_2e7ebf48-2503-4ffa-a4d1-c79a82df0a6b.json.encrypted
  • %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json.encrypted
  • %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json.encrypted
  • %ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.encrypted
  • %ALLUSERSPROFILE%\oracle\java\javapath\java.exe.encrypted
  • %ALLUSERSPROFILE%\oracle\java\javapath\javaw.exe.encrypted
  • %ALLUSERSPROFILE%\oracle\java\javapath\javaws.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\vc_redist.x64.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\vc_redist.x86.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.encrypted
  • %ALLUSERSPROFILE%\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft microsoft office professional plus 2016.swidtag.encrypted
  • %ALLUSERSPROFILE%\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_windows-10-pro.swidtag.encrypted
  • <Full path to file>.encrypted
  • C:\users\desktop.ini.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.encrypted.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020060.msp.encrypted.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe.encrypted.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\crypto\systemkeys\d3c41fa3acf8a2df1a3b10b0caaa8cff_8cf7b530-613e-439b-a8c5-ccfc0e745400.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\resource.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\resource.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\eventstore.db.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\parse.dat.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\telemetry.asm-windowsdefault.json.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.allow.json.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.app.json.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.privacy.json.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.tracing.json.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\eventstore.db.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\eventstore.db.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_45_22.etl.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_5_7.etl.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_6_21.etl.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\identitycrl\int\wlidsvcconfig.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\identitycrl\production\wlidsvcconfig.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\mf\active.grl.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\mf\pending.grl.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edb.chk.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edb.log.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edbres00001.jrs.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edbres00002.jrs.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edbtmp.log.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.db.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.jfm.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\mysite.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.chk.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.log.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb00002.log.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00001.jrs.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00002.jrs.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbtmp.log.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.db.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.jfm.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\storage health\storagehealthmodel.dat.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\desktopsettings2013.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\easeofaccesssettings2013.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013backup.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2010.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win32.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win64.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftnotepad.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2010win32.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2010win64.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013backupwin32.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013backupwin64.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013office365win32.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013office365win64.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win32.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win64.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin32.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin64.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win32.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win64.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2013cawin32.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2013cawin64.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2016cawin32.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2016cawin64.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftskypeforbusiness2016win32.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftskypeforbusiness2016win64.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftwordpad.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\networkprinters.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\roamingcredentialsettings.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\themesettings2013.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\vdistate.xml.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate.xsd.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013.xsd.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013a.xsd.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\guest.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user-192.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user-32.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user-40.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user-48.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user.dat.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user.png.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.databasecompare.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.excel.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.graph.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.lync.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.lync_basic.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.lync_online.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.msaccess.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.msouc.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.mspub.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.onenote.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.outlook.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.powerpnt.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.setlang.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb_basic.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb_online.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb_onlineg.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.spreadsheetcompare.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.winword.16.1033.hxn.encrypted.encrypted
  • %ALLUSERSPROFILE%\microsoft help\nslist.hxl.encrypted.encrypted
  • %ALLUSERSPROFILE%\mozilla\profile_count_308046b0af4a39cb.json.encrypted.encrypted
  • %ALLUSERSPROFILE%\mozilla\uninstall_ping_308046b0af4a39cb_2e7ebf48-2503-4ffa-a4d1-c79a82df0a6b.json.encrypted.encrypted
  • %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json.encrypted.encrypted
  • %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json.encrypted.encrypted
  • %ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.encrypted.encrypted
  • %ALLUSERSPROFILE%\oracle\java\javapath\java.exe.encrypted.encrypted
  • %ALLUSERSPROFILE%\oracle\java\javapath\javaw.exe.encrypted.encrypted
  • %ALLUSERSPROFILE%\oracle\java\javapath\javaws.exe.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\vc_redist.x64.exe.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\state.rsm.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\vc_redist.x86.exe.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\cab1.cab.encrypted.encrypted
  • %ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.encrypted.encrypted
  • %ALLUSERSPROFILE%\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft microsoft office professional plus 2016.swidtag.encrypted.encrypted
  • %ALLUSERSPROFILE%\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_windows-10-pro.swidtag.encrypted.encrypted
  • C:\users\default\ntuser.dat.log1.encrypted
  • C:\users\default\ntuser.dat.log2.encrypted
  • C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tm.blf.encrypted
  • C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000001.regtrans-ms.encrypted
  • C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000002.regtrans-ms.encrypted
  • C:\users\public\desktop.ini.encrypted
  • C:\users\public\accountpictures\desktop.ini.encrypted
  • C:\users\public\desktop\acrobat reader dc.lnk.encrypted
  • C:\users\public\desktop\desktop.ini.encrypted
  • C:\users\public\desktop\firefox.lnk.encrypted
  • C:\users\public\desktop\microsoft edge.lnk.encrypted
  • C:\users\public\desktop\mozilla thunderbird.lnk.encrypted
  • C:\users\public\desktop\opera.lnk.encrypted
  • C:\users\public\desktop\steam.lnk.encrypted
  • C:\users\public\documents\desktop.ini.encrypted
  • C:\users\public\downloads\desktop.ini.encrypted
  • C:\users\public\libraries\desktop.ini.encrypted
  • C:\users\public\libraries\recordedtv.library-ms.encrypted
  • C:\users\public\music\desktop.ini.encrypted
  • C:\users\public\pictures\desktop.ini.encrypted
  • C:\users\public\videos\desktop.ini.encrypted
  • %HOMEPATH%\ntuser.ini.encrypted
  • %HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp.encrypted
  • %HOMEPATH%\3d objects\desktop.ini.encrypted
  • %HOMEPATH%\contacts\desktop.ini.encrypted
  • %HOMEPATH%\desktop\chromesetup.exe.encrypted
  • %HOMEPATH%\desktop\desktop.ini.encrypted
  • %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.encrypted
  • %HOMEPATH%\desktop\google chrome.lnk.encrypted
  • %HOMEPATH%\desktop\skypesetup.exe.encrypted
  • %HOMEPATH%\desktop\tcm851ax32.exe.encrypted
  • %HOMEPATH%\desktop\telegram.lnk.encrypted
  • %HOMEPATH%\desktop\utorrent.exe.encrypted
  • %HOMEPATH%\desktop\winmine.exe.encrypted
  • %HOMEPATH%\documents\desktop.ini.encrypted
  • %HOMEPATH%\downloads\desktop.ini.encrypted
  • %HOMEPATH%\favorites\bing.url.encrypted
  • %HOMEPATH%\favorites\desktop.ini.encrypted
  • %HOMEPATH%\favorites\links\desktop.ini.encrypted
  • %HOMEPATH%\links\desktop.ini.encrypted
  • %HOMEPATH%\links\desktop.lnk.encrypted
  • %HOMEPATH%\links\downloads.lnk.encrypted
  • %HOMEPATH%\music\desktop.ini.encrypted
  • %HOMEPATH%\pictures\desktop.ini.encrypted
  • %HOMEPATH%\pictures\camera roll\desktop.ini.encrypted
  • %HOMEPATH%\saved games\desktop.ini.encrypted
  • %HOMEPATH%\searches\desktop.ini.encrypted
  • %HOMEPATH%\searches\everywhere.search-ms.encrypted
  • %HOMEPATH%\searches\indexed locations.search-ms.encrypted
  • %HOMEPATH%\searches\winrt--{s-1-5-21-4226853953-3309226944-3078887307-1000}-.searchconnector-ms.encrypted
  • %HOMEPATH%\videos\desktop.ini.encrypted
  • D:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\desktop.ini.encrypted
  • %TEMP%\ransom_wall.jpg
Deletes following files that it created itself
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020060.msp.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe.encrypted
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.encrypted
  • %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.encrypted
  • %ALLUSERSPROFILE%\microsoft\crypto\systemkeys\d3c41fa3acf8a2df1a3b10b0caaa8cff_8cf7b530-613e-439b-a8c5-ccfc0e745400.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\resource.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\resource.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\eventstore.db.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\parse.dat.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\telemetry.asm-windowsdefault.json.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.allow.json.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.app.json.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.privacy.json.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.tracing.json.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\eventstore.db.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\eventstore.db.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_45_22.etl.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_5_7.etl.encrypted
  • %ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_6_21.etl.encrypted
  • %ALLUSERSPROFILE%\microsoft\identitycrl\int\wlidsvcconfig.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\identitycrl\production\wlidsvcconfig.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\mf\active.grl.encrypted
  • %ALLUSERSPROFILE%\microsoft\mf\pending.grl.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edb.chk.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edb.log.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edbres00001.jrs.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edbres00002.jrs.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\edbtmp.log.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.db.encrypted
  • %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.jfm.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\mysite.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.chk.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.log.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb00002.log.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00001.jrs.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00002.jrs.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbtmp.log.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.db.encrypted
  • %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.jfm.encrypted
  • %ALLUSERSPROFILE%\microsoft\storage health\storagehealthmodel.dat.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\desktopsettings2013.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\easeofaccesssettings2013.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013backup.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2010.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftnotepad.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2010win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2010win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013backupwin32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013backupwin64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013office365win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013office365win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2013cawin32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2013cawin64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2016cawin32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2016cawin64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftskypeforbusiness2016win32.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftskypeforbusiness2016win64.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftwordpad.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\networkprinters.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\roamingcredentialsettings.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\themesettings2013.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\vdistate.xml.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate.xsd.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013.xsd.encrypted
  • %ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013a.xsd.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\guest.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user-192.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user-32.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user-40.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user-48.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user.dat.encrypted
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user.png.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.encrypted
  • %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.databasecompare.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.excel.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.graph.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.lync.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.lync_basic.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.lync_online.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.msaccess.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.msouc.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.mspub.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.onenote.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.outlook.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.powerpnt.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.setlang.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb_basic.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb_online.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.skypefb_onlineg.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.spreadsheetcompare.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\ms.winword.16.1033.hxn.encrypted
  • %ALLUSERSPROFILE%\microsoft help\nslist.hxl.encrypted
  • %ALLUSERSPROFILE%\mozilla\profile_count_308046b0af4a39cb.json.encrypted
  • %ALLUSERSPROFILE%\mozilla\uninstall_ping_308046b0af4a39cb_2e7ebf48-2503-4ffa-a4d1-c79a82df0a6b.json.encrypted
  • %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json.encrypted
  • %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json.encrypted
  • %ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.encrypted
  • %ALLUSERSPROFILE%\oracle\java\javapath\java.exe.encrypted
  • %ALLUSERSPROFILE%\oracle\java\javapath\javaw.exe.encrypted
  • %ALLUSERSPROFILE%\oracle\java\javapath\javaws.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\vc_redist.x64.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\vc_redist.x86.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.encrypted
  • %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.encrypted
  • %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe.encrypted
  • %ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\cab1.cab.encrypted
  • %ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.encrypted
  • %ALLUSERSPROFILE%\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft microsoft office professional plus 2016.swidtag.encrypted
  • %ALLUSERSPROFILE%\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_windows-10-pro.swidtag.encrypted
Modifies the following files
  • %APPDATA%\microsoft\windows\themes\transcodedwallpaper
Substitutes the following files
  • C:\$Recycle.Bin\S-1-5-21-4226853953-3309226944-3078887307-1000\desktop.ini
Deletes itself.
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -DisableBlockAtFirstSeek $true"
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -DisablePrivacyMode $true"

Рекомендации по лечению

  1. В случае если операционная система способна загрузиться (в штатном режиме или режиме защиты от сбоев), скачайте лечащую утилиту Dr.Web CureIt! и выполните с ее помощью полную проверку вашего компьютера, а также используемых вами переносных носителей информации.
  2. Если загрузка операционной системы невозможна, измените настройки BIOS вашего компьютера, чтобы обеспечить возможность загрузки ПК с компакт-диска или USB-накопителя. Скачайте образ аварийного диска восстановления системы Dr.Web® LiveDisk или утилиту записи Dr.Web® LiveDisk на USB-накопитель, подготовьте соответствующий носитель. Загрузив компьютер с использованием данного носителя, выполните его полную проверку и лечение обнаруженных угроз.
Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

Выполните полную проверку системы с использованием Антивируса Dr.Web Light для macOS. Данный продукт можно загрузить с официального сайта Apple App Store.

Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

Скачать Dr.Web с Apple Store

На загруженной ОС выполните полную проверку всех дисковых разделов с использованием продукта Антивирус Dr.Web для Linux.

Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

  1. Если мобильное устройство функционирует в штатном режиме, загрузите и установите на него бесплатный антивирусный продукт Dr.Web для Android Light. Выполните полную проверку системы и используйте рекомендации по нейтрализации обнаруженных угроз.
  2. Если мобильное устройство заблокировано троянцем-вымогателем семейства Android.Locker (на экране отображается обвинение в нарушении закона, требование выплаты определенной денежной суммы или иное сообщение, мешающее нормальной работе с устройством), выполните следующие действия:
    • загрузите свой смартфон или планшет в безопасном режиме (в зависимости от версии операционной системы и особенностей конкретного мобильного устройства эта процедура может быть выполнена различными способами; обратитесь за уточнением к инструкции, поставляемой вместе с приобретенным аппаратом, или напрямую к его производителю);
    • после активации безопасного режима установите на зараженное устройство бесплатный антивирусный продукт Dr.Web для Android Light и произведите полную проверку системы, выполнив рекомендации по нейтрализации обнаруженных угроз;
    • выключите устройство и включите его в обычном режиме.

Подробнее о Dr.Web для Android

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта
Скачать с Google Play