Trojan.Encoder.44498

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует главную загрузочную запись (MBR).

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%LOCALAPPDATA%\microsoft\edge\user data\default\web data

Изменения в файловой системе

Создает следующие файлы

%TEMP%\133e7223-398c-48d9-be27-471596380b94.png
%TEMP%\54ec9710-4cd2-4b5d-a770-27e7e40f80c1_devices.txt
%TEMP%\b6bc244d-acb6-44f4-9641-7f5a45da8f84_pc.txt
C:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\desktop.ini.lsd
<Полный путь к файлу>.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.msi.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\ose.exe.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\osetup.dll.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\owow64ww.cab.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pidgenx.dll.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.msi.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.dll.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.exe.lsd
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excellr.cab.lsd
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.msi.lsd
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml.lsd
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.msi.lsd
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml.lsd
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\pptlr.cab.lsd
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.msi.lsd
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml.lsd
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publr.cab.lsd
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlklr.cab.lsd
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.msi.lsd
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml.lsd
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordlr.cab.lsd
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.msi.lsd
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.msi.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.xml.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.cab.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.msi.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.cab.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.msi.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.cab.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.msi.lsd
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml.lsd
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\inflr.cab.lsd
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.msi.lsd
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml.lsd
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.cab.lsd
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.msi.lsd
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.xml.lsd
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.msi.lsd
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml.lsd
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onotelr.cab.lsd
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovelr.cab.lsd
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.msi.lsd
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml.lsd
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.cab.lsd
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.msi.lsd
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\osmmui.xml.lsd
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.cab.lsd
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.msi.lsd
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.xml.lsd
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\branding.xml.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officelr.cab.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemui.msi.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemui.xml.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemuiset.msi.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\officemuiset.xml.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\offsetlr.cab.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\osetupui.dll.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\pss10r.chm.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.chm.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\shellui.mst.lsd
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64mui.msi.lsd
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64mui.xml.lsd
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64muiset.msi.lsd
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\office64muiset.xml.lsd
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\owow64lr.cab.lsd
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.msi.lsd
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.xml.lsd
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\setup.xml.lsd
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.msi.lsd
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.xml.lsd
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\acclr.cab.lsd
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\branding.xml.lsd
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.cab.lsd
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.msi.lsd
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\lyncmui.xml.lsd
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\setup.xml.lsd
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.lsd
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020060.msp.lsd
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.lsd
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.lsd
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe.lsd
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.lsd
%ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.lsd
%ALLUSERSPROFILE%\microsoft\crypto\systemkeys\d3c41fa3acf8a2df1a3b10b0caaa8cff_8cf7b530-613e-439b-a8c5-ccfc0e745400.lsd
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.lsd
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.lsd
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.lsd
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.lsd
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.lsd
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.lsd
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.lsd
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\resource.xml.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.lsd
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\resource.xml.lsd
%ALLUSERSPROFILE%\microsoft\diagnosis\eventstore.db.lsd
%ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.lsd
%ALLUSERSPROFILE%\microsoft\diagnosis\parse.dat.lsd
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.allow.json.lsd
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.app.json.lsd
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.privacy.json.lsd
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\utc.tracing.json.lsd
%ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\eventstore.db.lsd
%ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\eventstore.db.lsd
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_45_22.etl.lsd
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_5_7.etl.lsd
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_collector_deviceprovisioning_2024_8_11_18_6_21.etl.lsd
%ALLUSERSPROFILE%\microsoft\identitycrl\int\wlidsvcconfig.xml.lsd
%ALLUSERSPROFILE%\microsoft\identitycrl\production\wlidsvcconfig.xml.lsd
%ALLUSERSPROFILE%\microsoft\mf\active.grl.lsd
%ALLUSERSPROFILE%\microsoft\mf\pending.grl.lsd
%ALLUSERSPROFILE%\microsoft\network\downloader\edb.chk.lsd
%ALLUSERSPROFILE%\microsoft\network\downloader\edb.log.lsd
%ALLUSERSPROFILE%\microsoft\network\downloader\edbres00001.jrs.lsd
%ALLUSERSPROFILE%\microsoft\network\downloader\edbres00002.jrs.lsd
%ALLUSERSPROFILE%\microsoft\network\downloader\edbtmp.log.lsd
%ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.db.lsd
%ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.jfm.lsd
%ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.lsd
%ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.lsd
%ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.lsd
%ALLUSERSPROFILE%\microsoft\office\mysite.ico.lsd
%ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.lsd
%ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.lsd
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.chk.lsd
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb.log.lsd
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edb00002.log.lsd
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00001.jrs.lsd
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbres00002.jrs.lsd
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\edbtmp.log.lsd
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.db.lsd
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.jfm.lsd
%ALLUSERSPROFILE%\microsoft\storage health\storagehealthmodel.dat.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\desktopsettings2013.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\easeofaccesssettings2013.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013backup.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2010.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win32.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win64.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftnotepad.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2010win32.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2010win64.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013backupwin32.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013backupwin64.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013office365win32.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013office365win64.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win32.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win64.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin32.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin64.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win32.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win64.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2013cawin32.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2013cawin64.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2016cawin32.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2016cawin64.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftskypeforbusiness2016win32.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftskypeforbusiness2016win64.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftwordpad.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\networkprinters.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\roamingcredentialsettings.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\themesettings2013.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\vdistate.xml.lsd
%ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.lsd
%ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate.xsd.lsd
%ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013.xsd.lsd
%ALLUSERSPROFILE%\microsoft\uev\templates\settingslocationtemplate2013a.xsd.lsd
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.lsd
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.lsd
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.lsd
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol.lsd
%ALLUSERSPROFILE%\microsoft help\ms.databasecompare.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.excel.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.graph.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.lync.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.lync_basic.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.lync_online.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.msaccess.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.msouc.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.mspub.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.onenote.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.outlook.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.powerpnt.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.setlang.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.skypefb.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.skypefb_basic.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.skypefb_online.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.skypefb_onlineg.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.spreadsheetcompare.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\ms.winword.16.1033.hxn.lsd
%ALLUSERSPROFILE%\microsoft help\nslist.hxl.lsd
%ALLUSERSPROFILE%\mozilla\profile_count_308046b0af4a39cb.json.lsd
%ALLUSERSPROFILE%\mozilla\uninstall_ping_308046b0af4a39cb_2e7ebf48-2503-4ffa-a4d1-c79a82df0a6b.json.lsd
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json.lsd
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json.lsd
%ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.lsd
%ALLUSERSPROFILE%\oracle\java\javapath\java.exe.lsd
%ALLUSERSPROFILE%\oracle\java\javapath\javaw.exe.lsd
%ALLUSERSPROFILE%\oracle\java\javapath\javaws.exe.lsd
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm.lsd
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe.lsd
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.lsd
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm.lsd
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\vc_redist.x64.exe.lsd
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.lsd
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.lsd
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.lsd
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\state.rsm.lsd
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\vc_redist.x86.exe.lsd
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.lsd
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.lsd
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.lsd
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.lsd
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.lsd
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.lsd
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.lsd
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe.lsd
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.lsd
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.lsd
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.lsd
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.lsd
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe.lsd
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\cab1.cab.lsd
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.lsd
%ALLUSERSPROFILE%\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft microsoft office professional plus 2016.swidtag.lsd
C:\users\desktop.ini.lsd
C:\users\default\ntuser.dat.log1.lsd
C:\users\default\ntuser.dat.log2.lsd
C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tm.blf.lsd
C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000001.regtrans-ms.lsd
C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000002.regtrans-ms.lsd
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini.lsd
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk.lsd
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk.lsd
C:\users\public\desktop.ini.lsd
C:\users\public\accountpictures\desktop.ini.lsd
C:\users\public\desktop\acrobat reader dc.lnk.lsd
C:\users\public\desktop\desktop.ini.lsd
C:\users\public\desktop\firefox.lnk.lsd
C:\users\public\desktop\microsoft edge.lnk.lsd
C:\users\public\desktop\mozilla thunderbird.lnk.lsd
C:\users\public\desktop\opera.lnk.lsd
C:\users\public\desktop\steam.lnk.lsd
C:\users\public\documents\desktop.ini.lsd
C:\users\public\downloads\desktop.ini.lsd
C:\users\public\libraries\desktop.ini.lsd
C:\users\public\libraries\recordedtv.library-ms.lsd
C:\users\public\music\desktop.ini.lsd
C:\users\public\pictures\desktop.ini.lsd
C:\users\public\videos\desktop.ini.lsd
%HOMEPATH%\ntuser.ini.lsd
%HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp.lsd
%HOMEPATH%\3d objects\desktop.ini.lsd
%LOCALAPPDATA%\comms\unistore\data\aggregatecache.uca.lsd
%LOCALAPPDATA%\comms\unistoredb\store.jfm.lsd
%LOCALAPPDATA%\comms\unistoredb\store.vol.lsd
%LOCALAPPDATA%\comms\unistoredb\uss.jcp.lsd
%LOCALAPPDATA%\comms\unistoredb\uss.jtx.lsd
%LOCALAPPDATA%\comms\unistoredb\ussres00001.jrs.lsd
%LOCALAPPDATA%\comms\unistoredb\ussres00002.jrs.lsd
%LOCALAPPDATA%\comms\unistoredb\usstmp.jtx.lsd
%LOCALAPPDATA%\connecteddevicesplatform\cdpglobalsettings.cdp.lsd
%LOCALAPPDATA%\connecteddevicesplatform\connected devices platform certificates.sst.lsd
%LOCALAPPDATA%\connecteddevicesplatform\l.user.cdp.lsd
%LOCALAPPDATA%\connecteddevicesplatform\l.user.cdpresource.lsd
%LOCALAPPDATA%\connecteddevicesplatform\l.user\activitiescache.db-shm.lsd
%LOCALAPPDATA%\connecteddevicesplatform\l.user\activitiescache.db-wal.lsd
%LOCALAPPDATA%\google\chrome\application\chrome.exe.lsd
%LOCALAPPDATA%\google\chrome\application\debug.log.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\47.0.2526.106.manifest.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_100_percent.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_200_percent.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_child.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_elf.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_watcher.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\d3dcompiler_47.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\delegate_execute.exe.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\libegl.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\libexif.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\libglesv2.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\metro_driver.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\nacl64.exe.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\nacl_irt_x86_32.nexe.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\nacl_irt_x86_64.nexe.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\natives_blob.bin.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\resources.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\snapshot_blob.bin.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\widevinecdmadapter.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\xinput1_3.dll.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\docs.crx.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\drive.crx.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\external_extensions.json.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\gmail.crx.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\search.crx.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\youtube.crx.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\extensions\external_extensions.json.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\setup.exe.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\am.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ar.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\bg.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\bn.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ca.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\cs.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\da.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\de.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\el.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\en-gb.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\en-us.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\es-419.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\es.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\et.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fa.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fi.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fil.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fr.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\gu.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\he.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\hi.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\hr.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\hu.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\id.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\it.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ja.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\kn.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ko.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\lt.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\lv.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ml.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\mr.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ms.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\nb.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\nl.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\pl.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\pt-br.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\pt-pt.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ro.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ru.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sk.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sl.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sr.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sv.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sw.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ta.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\te.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\th.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\tr.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\uk.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\vi.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\zh-cn.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\zh-tw.pak.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\pepperflash\manifest.json.lsd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\pepperflash\pepflashplayer.dll.lsd
%LOCALAPPDATA%\google\chrome\user data\first run.lsd
%LOCALAPPDATA%\google\chrome\user data\local state.lsd
%LOCALAPPDATA%\google\chrome\user data\safe browsing cookies.lsd
%LOCALAPPDATA%\google\chrome\user data\safe browsing cookies-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\chromedwritefontcache.lsd
%LOCALAPPDATA%\google\chrome\user data\default\cookies.lsd
%LOCALAPPDATA%\google\chrome\user data\default\cookies-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\current session.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension cookies.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension cookies-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\favicons.lsd
%LOCALAPPDATA%\google\chrome\user data\default\favicons-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\google profile.ico.lsd
%LOCALAPPDATA%\google\chrome\user data\default\history.lsd
%LOCALAPPDATA%\google\chrome\user data\default\history provider cache.lsd
%LOCALAPPDATA%\google\chrome\user data\default\history-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\login data.lsd
%LOCALAPPDATA%\google\chrome\user data\default\login data-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\network action predictor.lsd
%LOCALAPPDATA%\google\chrome\user data\default\network action predictor-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\preferences.lsd
%LOCALAPPDATA%\google\chrome\user data\default\quotamanager.lsd
%LOCALAPPDATA%\google\chrome\user data\default\quotamanager-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\readme.lsd
%LOCALAPPDATA%\google\chrome\user data\default\secure preferences.lsd
%LOCALAPPDATA%\google\chrome\user data\default\shortcuts.lsd
%LOCALAPPDATA%\google\chrome\user data\default\shortcuts-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\top sites.lsd
%LOCALAPPDATA%\google\chrome\user data\default\top sites-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\visited links.lsd
%LOCALAPPDATA%\google\chrome\user data\default\web data.lsd
%LOCALAPPDATA%\google\chrome\user data\default\web data-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_0.lsd
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_1.lsd
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_2.lsd
%LOCALAPPDATA%\google\chrome\user data\default\cache\data_3.lsd
%LOCALAPPDATA%\google\chrome\user data\default\cache\index.lsd
%LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db-journal.lsd
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\000003.log.lsd
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\current.lsd
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\lock.lsd
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\log.lsd
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\manifest-000001.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\000003.log.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\current.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\lock.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\log.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\manifest-000001.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension state\000003.log.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension state\current.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension state\lock.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension state\log.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extension state\manifest-000001.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\manifest.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\manifest.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\manifest.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\manifest.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\manifest.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\messages.json.lsd
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\7fd9.tmp.lsd
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\7fda.tmp.lsd
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\b22.tmp.lsd
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\b23.tmp.lsd
%LOCALAPPDATA%\google\chrome\user data\default\session storage\000003.log.lsd
%LOCALAPPDATA%\google\chrome\user data\default\session storage\current.lsd
%LOCALAPPDATA%\google\chrome\user data\default\session storage\lock.lsd
%LOCALAPPDATA%\google\chrome\user data\default\session storage\log.lsd
%LOCALAPPDATA%\google\chrome\user data\default\session storage\manifest-000001.lsd
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\powershell.exe.log.lsd
%LOCALAPPDATA%\microsoft\edge\user data\crashpadmetrics-active.pma.lsd
%LOCALAPPDATA%\microsoft\edge\user data\crashpadmetrics.pma.lsd
%LOCALAPPDATA%\microsoft\edge\user data\first run.lsd
%LOCALAPPDATA%\microsoft\edge\user data\firstlaunchafterinstallation.lsd
%LOCALAPPDATA%\microsoft\edge\user data\functional data.lsd
%LOCALAPPDATA%\microsoft\edge\user data\functional san data.lsd
%LOCALAPPDATA%\microsoft\edge\user data\last version.lsd
%LOCALAPPDATA%\microsoft\edge\user data\local state.lsd
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-66b96068-2f8.pma.lsd
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69786329-1118.pma.lsd
%LOCALAPPDATA%\microsoft\edge\user data\crashpad\metadata.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\edge profile.ico.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\history.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\login data.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\login data-journal.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\media history.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\media history-journal.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\network persistent state.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\preferences.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\readme.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\secure preferences.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\top sites.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\top sites-journal.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\web data.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\the-real-index.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\wasm\index.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\wasm\index-dir\the-real-index.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\current.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\lock.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\log.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\manifest-000001.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\platform notifications\000003.log.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\platform notifications\current.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\platform notifications\lock.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\platform notifications\log.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\platform notifications\manifest-000001.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\000003.log.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\current.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\lock.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log.old.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\manifest-000001.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\current.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\lock.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log.old.lsd
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\manifest-000001.lsd
%LOCALAPPDATA%\microsoft\edge\user data\grshadercache\gpucache\data_0.lsd
%LOCALAPPDATA%\microsoft\edge\user data\grshadercache\gpucache\data_1.lsd
%LOCALAPPDATA%\microsoft\edge\user data\grshadercache\gpucache\data_2.lsd
%LOCALAPPDATA%\microsoft\edge\user data\grshadercache\gpucache\data_3.lsd
%LOCALAPPDATA%\microsoft\edge\user data\grshadercache\gpucache\index.lsd
%LOCALAPPDATA%\microsoft\edge\user data\shadercache\gpucache\data_0.lsd
%LOCALAPPDATA%\microsoft\edge\user data\shadercache\gpucache\data_1.lsd
%LOCALAPPDATA%\microsoft\edge\user data\shadercache\gpucache\data_2.lsd
%LOCALAPPDATA%\microsoft\edge\user data\shadercache\gpucache\data_3.lsd
%LOCALAPPDATA%\microsoft\edge\user data\shadercache\gpucache\index.lsd
%LOCALAPPDATA%\microsoft\edge\user data\smartscreen\local\cache.lsd
%LOCALAPPDATA%\microsoft\edge\user data\smartscreen\local\download_cache.lsd
%LOCALAPPDATA%\microsoft\edge\user data\smartscreen\local\warnstatecache.lsd
%LOCALAPPDATA%\microsoft\gamedvr\knowngamelist.bin.lsd
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.lsd
%LOCALAPPDATA%\microsoft\internet explorer\ie4uinit-cleariconcache.log.lsd
%LOCALAPPDATA%\microsoft\internet explorer\ie4uinit-userconfig.log.lsd
%LOCALAPPDATA%\microsoft\internet explorer\cachestorage\.inuse.lsd
%LOCALAPPDATA%\microsoft\internet explorer\cachestorage\edb.chk.lsd
%LOCALAPPDATA%\microsoft\internet explorer\cachestorage\edb.log.lsd
%LOCALAPPDATA%\microsoft\internet explorer\cachestorage\edbres00001.jrs.lsd
%LOCALAPPDATA%\microsoft\internet explorer\cachestorage\edbres00002.jrs.lsd
%LOCALAPPDATA%\microsoft\internet explorer\cachestorage\edbtmp.log.lsd
%LOCALAPPDATA%\microsoft\internet explorer\domainsuggestions\en-us.1.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\01_music_auto_rated_at_5_stars.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\02_music_added_in_the_last_month.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\03_music_rated_at_4_or_5_stars.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\04_music_played_in_the_last_month.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\05_pictures_taken_in_the_last_month.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\06_pictures_rated_4_or_5_stars.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\07_tv_recorded_in_the_last_week.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\08_video_rated_at_4_or_5_stars.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\09_music_played_the_most.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\10_all_music.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\11_all_pictures.wpl.lsd
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\00018047\12_all_video.wpl.lsd
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres.lsd
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\0378bba2a12f7703e4238f6201dce8dbd46a867a.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\192f64839342ebee36eec37666dd11a9e37297fd.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\22914084a5d64db047ed122362f901e86268812e.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\2cb84dd9abb4e1485d83397c59b193094e1abfc7.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\35082c01c397d803bb2c7c6f619e7df4b1e728da.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\38ff788a718c79ddc3d1e23eaa975517d9ba3bb0.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\39a3cb6b48053e1c5c33cf497e62ce93bfbe8160.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\39d80535a21e286b3c662765c5f09aceb927e77d.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\3fc6f43984b3ad7dbaecf35b16e702a2a4c9faac.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\535362d505e47b0f250e84b8972968e16ef0b9b4.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\54e0ba3f96a1c83fa5c93e20aefb40ca46674abf.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\606b8f565718b076f7f0a603dea9a9b455a0a2be.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\656880559790fe4b926371cc3c026d9b3c516a2f.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\76577c137f0c7676b6d17117d736b2e52f70f052.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\7943793ad6ef12ca229a1df7a721b44c210bbc82.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\82c47fa9f5f29d08908329a836215460fd85b37b.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\89c9b59023c6004c5fca8e641b2bd533baa7f06e.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\89f2f7b5ac6c606ca6223b1c39fb4ed3a611b5c0.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\8af5d98ea49bfc5f75dbbb8cbe9cadf11b63e0f4.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\90e321ee94230dcdbdcd2ec0b77c695a4fc21f78.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\9648808b6c63cd1aad97a7b68f84f35c95682143.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\97d99666d820694fe8e1184bc341fd3ff5c3b6d2.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\9deeff51b75006e683d382d3fcad88123cbc6a3c.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\9e24f2fbe436912f5fe46520277cc7d886375eb3.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\a463ab67f04ca93850eef869c404c62674ab387d.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\a816a4917a437c2c50a1e80ffb8dcc9e921bf4f6.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\b6f3ce4c2ae7120330ba1b1d0708da88f53ffcdb.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\be13857faf251cca8c4ae07311778b6623ef86dc.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\c240554ac07403cdfb5eab709d9c0ad576560153.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\c53fff027948b9d0c07e3c92c8b6a2e017f25aca.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\cda62003b1b987a64f1fac75d1484dbff94f08fb.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\d395239c6c600503c9cef2d913be946b55976a23.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\d4a00010c8860f0d4bab3d844b9ecad77a59a9a2.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\d6b0add0daea00708cbb4290b85cca0e0fa79061.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\f7d0ce5f67bbf807647cadca3476fb65823ade6c.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cache2\entries\ff63a96cb0ee05c4e8600cafada617eba0bab35d.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\startupcache\scriptcache-child-current.bin.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\startupcache\scriptcache-child.bin.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\startupcache\scriptcache-current.bin.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\startupcache\scriptcache.bin.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\startupcache\startupcache.8.little.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\startupcache\urlcache-current.bin.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\startupcache\urlcache.bin.lsd
%LOCALAPPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\startupcache\webext.sc.lz4.lsd
%LOCALAPPDATA%\opera software\opera stable\cache\data_0.lsd
%LOCALAPPDATA%\opera software\opera stable\cache\data_1.lsd
%LOCALAPPDATA%\opera software\opera stable\cache\data_2.lsd
%LOCALAPPDATA%\opera software\opera stable\cache\data_3.lsd
%LOCALAPPDATA%\opera software\opera stable\cache\index.lsd
%LOCALAPPDATA%\packages\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\f46d4000-fd22-4db4-ac8e-4e1ddde828fe_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.549981c3f5f10_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.549981c3f5f10_8wekyb3d8bbwe\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.549981c3f5f10_8wekyb3d8bbwe\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.aad.brokerplugin_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.aad.brokerplugin_cw5n1h2txyewy\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.aad.brokerplugin_cw5n1h2txyewy\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.accountscontrol_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.asynctextservice_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.bingweather_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.bingweather_8wekyb3d8bbwe\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.bingweather_8wekyb3d8bbwe\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.bioenrollment_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.bioenrollment_cw5n1h2txyewy\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.bioenrollment_cw5n1h2txyewy\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.creddialoghost_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.ecapp_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.gethelp_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.getstarted_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.heifimageextension_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.lockapp_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.lockapp_cw5n1h2txyewy\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.lockapp_cw5n1h2txyewy\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.microsoft3dviewer_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftedgedevtoolsclient_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\ac\microsoft\clr_v4.0\usagelogs\backgroundtaskhost.exe.log.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\localcache\local\microsoft\clr_v4.0\usagelogs\localbridge.exe.log.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\systemappdata\helium\user.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\systemappdata\helium\user.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\systemappdata\helium\userclasses.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\systemappdata\helium\userclasses.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.microsoftstickynotes_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.mixedreality.portal_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.mspaint_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.office.onenote_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.people_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.screensketch_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\slimcore-aria-cache.data.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\slimcore-aria-cache.data-shm.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\slimcore-aria-cache.data-wal.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\asyncstorage\firsttimesignin.data.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\asyncstorage\saveullog.data.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\cs_localstate\cs_shared.conf.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\skypert\persistent.conf.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.storepurchaseapp_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.vp9videoextensions_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.wallet_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.webmediaextensions_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.webpimageextension_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.win32webviewhost_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\localstate\hxcommalwaysonlog.etl.lsd
%LOCALAPPDATA%\packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\localstate\hxstore.hxd.lsd
%LOCALAPPDATA%\packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.xbox.tcui_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.xboxapp_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.xboxapp_8wekyb3d8bbwe\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.xboxapp_8wekyb3d8bbwe\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.xboxgamecallableui_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.lsd
%LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.xboxgamingoverlay_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.xboxidentityprovider_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.xboxidentityprovider_8wekyb3d8bbwe\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\microsoft.xboxidentityprovider_8wekyb3d8bbwe\settings\settings.dat.log2.lsd
%LOCALAPPDATA%\packages\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.yourphone_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.zunemusic_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\ncsiuwpapp_8wekyb3d8bbwe\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\windows.immersivecontrolpanel_cw5n1h2txyewy\settings\roaming.lock.lsd
%LOCALAPPDATA%\packages\windows.immersivecontrolpanel_cw5n1h2txyewy\settings\settings.dat.log1.lsd
%LOCALAPPDATA%\packages\windows.immersivecontrolpanel_cw5n1h2txyewy\settings\settings.dat.log2.lsd
%TEMP%\.ses.lsd
%TEMP%\content\1808-1272-powershell.exe-22-57-18-170.dump.lsd
%TEMP%\content\1808-1272-powershell.exe-22-57-18-310.dump.lsd
%TEMP%\content\1928-2040-powershell.exe-23-15-30-381.dump.lsd
%TEMP%\content\1928-2040-powershell.exe-23-15-30-619.dump.lsd
%TEMP%\content\1928-2040-powershell.exe-23-15-30-720.dump.lsd
%TEMP%\content\1928-2040-powershell.exe-23-15-30-867.dump.lsd
%TEMP%\content\1928-2040-powershell.exe-23-15-31-703.dump.lsd
%TEMP%\content\2684-1980-cscript.exe-22-58-23-013.dump.lsd
%TEMP%\content\2684-1980-cscript.exe-22-58-23-029.dump.lsd
%TEMP%\content\2684-1980-cscript.exe-22-58-23-045.dump.lsd
%TEMP%\content\2684-1980-cscript.exe-22-58-24-420.dump.lsd
%TEMP%\content\2808-1548-powershell.exe-22-56-49-732.dump.lsd
%TEMP%\content\2808-1548-powershell.exe-22-56-49-982.dump.lsd
%TEMP%\content\2808-1548-powershell.exe-22-56-50-092.dump.lsd
%TEMP%\content\2808-1548-powershell.exe-22-56-50-232.dump.lsd
%TEMP%\content\2808-1548-powershell.exe-22-56-50-810.dump.lsd
%TEMP%\content\2964-980-powershell.exe-22-57-13-186.dump.lsd
%TEMP%\content\2964-980-powershell.exe-22-57-13-482.dump.lsd
%TEMP%\content\2964-980-powershell.exe-22-57-13-623.dump.lsd
%TEMP%\content\2964-980-powershell.exe-22-57-13-810.dump.lsd
%TEMP%\content\2964-980-powershell.exe-22-57-14-654.dump.lsd
%TEMP%\content\4568-5676-powershell.exe-23-15-37-577.dump.lsd
%TEMP%\content\4568-5676-powershell.exe-23-15-37-848.dump.lsd
%TEMP%\content\4568-5676-powershell.exe-23-15-37-936.dump.lsd
%TEMP%\content\4568-5676-powershell.exe-23-15-38-082.dump.lsd
%TEMP%\content\4568-5676-powershell.exe-23-15-38-889.dump.lsd
%TEMP%\content\5116-4140-powershell.exe-23-04-16-361.dump.lsd
%TEMP%\content\5116-4140-powershell.exe-23-04-16-609.dump.lsd
%TEMP%\content\5116-4140-powershell.exe-23-04-16-694.dump.lsd
%TEMP%\content\5116-4140-powershell.exe-23-04-16-841.dump.lsd
%TEMP%\content\5116-4140-powershell.exe-23-04-16-995.dump.lsd
%TEMP%\content\5116-4140-powershell.exe-23-04-17-513.dump.lsd
%TEMP%\content\5116-4140-powershell.exe-23-04-17-945.dump.lsd
%TEMP%\content\5768-5904-powershell.exe-23-04-12-979.dump.lsd
%TEMP%\content\5768-5904-powershell.exe-23-04-13-312.dump.lsd
%TEMP%\content\5768-5904-powershell.exe-23-04-13-466.dump.lsd
%TEMP%\content\5768-5904-powershell.exe-23-04-13-667.dump.lsd
%TEMP%\content\5768-5904-powershell.exe-23-04-14-464.dump.lsd
%LOCALAPPDATA%\thunderbird\profiles\gbmwccb6.default-release\.startup-incomplete.lsd
%LOCALAPPDATA%\thunderbird\profiles\gbmwccb6.default-release\cache2\entries\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f.lsd
%LOCALAPPDATA%\thunderbird\profiles\gbmwccb6.default-release\startupcache\startupcache.8.little.lsd
%LOCALAPPDATA%\thunderbird\profiles\gbmwccb6.default-release\startupcache\webext.sc.lz4.lsd

Удаляет файлы, которые сам же создал

%TEMP%\133e7223-398c-48d9-be27-471596380b94.png
%TEMP%\54ec9710-4cd2-4b5d-a770-27e7e40f80c1_devices.txt
%TEMP%\b6bc244d-acb6-44f4-9641-7f5a45da8f84_pc.txt
%TEMP%\content\1928-2040-powershell.exe-23-15-30-381.dump
%TEMP%\content\1928-2040-powershell.exe-23-15-30-619.dump
%TEMP%\content\1928-2040-powershell.exe-23-15-30-720.dump
%TEMP%\content\1928-2040-powershell.exe-23-15-30-867.dump
%TEMP%\content\1928-2040-powershell.exe-23-15-31-703.dump
%TEMP%\content\4568-5676-powershell.exe-23-15-37-577.dump
%TEMP%\content\4568-5676-powershell.exe-23-15-37-848.dump
%TEMP%\content\4568-5676-powershell.exe-23-15-37-936.dump
%TEMP%\content\4568-5676-powershell.exe-23-15-38-082.dump
%TEMP%\content\4568-5676-powershell.exe-23-15-38-889.dump

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db

Самоудаляется.

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Сетевая активность

UDP

DNS ASK di##ord.com

Другое

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c reagentc /disable
'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet
'%WINDIR%\syswow64\cmd.exe' /c sc config VSS start= disabled
'%WINDIR%\syswow64\cmd.exe' /c sc stop VSS
'%WINDIR%\syswow64\notepad.exe' %HOMEPATH%\Desktop\LSD_README.txt
'%WINDIR%\syswow64\reagentc.exe' /disable
'%WINDIR%\syswow64\sc.exe' config VSS start= disabled
'%WINDIR%\syswow64\sc.exe' stop VSS

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней