Trojan.Encoder.37690

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\mtb0agluz3njb25kb21zlnbkzg==.gehenna
<Drive name for removable media>:\aw5kb2dlcm1hbjiwmtauchb0ea==.gehenna
<Drive name for removable media>:\bwfwcgluz2nvbmnlchrodwjizxjsaw4uchb0.gehenna
<Drive name for removable media>:\bg9tnjaylnbkzg==.gehenna
<Drive name for removable media>:\am9pbi5hdmk=.gehenna
<Drive name for removable media>:\axnzatiwmtnfdgvtcgxhdgvfzm9yx3bvc3rlcnmuzg9jea==.gehenna
<Drive name for removable media>:\awlzc3rhcnquahrtba==.gehenna
<Drive name for removable media>:\ag9sewnyb3nzy2h1cmnoaw5zdhj1y3rpb25zlmrvy3g=.gehenna
<Drive name for removable media>:\avr1bmvzsgvscfvuyxzhawxhymxllmh0bq==.gehenna
<Drive name for removable media>:\z3j1zw5zcgvjahrfmdixnziwmtyuchb0ea==.gehenna
<Drive name for removable media>:\zgfzaejvcmrlcl8xmjauym1w.gehenna
<Drive name for removable media>:\aghobgnlcnqucgvt.gehenna
<Drive name for removable media>:\z2xpzgvzy29wzv9yzxzpzxdfcmv2xzaxmc5kb2n4.gehenna
<Drive name for removable media>:\znvuz2fsbmftzwf1dghvcnmucnrm.gehenna
<Drive name for removable media>:\zmxvd2vyx3ryyw5zx21hdhrllndtdg==.gehenna
<Drive name for removable media>:\zmlszv9wxzawmdawmdawxzeznze1otc1otiuzg9jea==.gehenna
<Drive name for removable media>:\zmljagvfaw5zy3jpchrpb25fmjaxns56axa=.gehenna
<Drive name for removable media>:\zmljagvfaw5zy3jpchrpb25fmjaxns54bhm=.gehenna
<Drive name for removable media>:\zmvicnvhcnlfy2f0ywxvz3vlx18ymde1lmrvyw==.gehenna
<Drive name for removable media>:\zgvmyxvsdc5ibxa=.gehenna
<Drive name for removable media>:\zgfzaejvcmrlcl8xndquym1w.gehenna
<Drive name for removable media>:\zmk1ms5kb2m=.gehenna
<Drive name for removable media>:\zgfzaejvcmrlcl8xotiuym1w.gehenna
<Drive name for removable media>:\b3zwmjuwmtiwmtuuzg9j.gehenna
<Drive name for removable media>:\c2rzemzvlmrvy3g=.gehenna
<Drive name for removable media>:\dhj0zl9tyxryaxgymdeyx29jdc54bhn4.gehenna
<Drive name for removable media>:\dhjpdmlhbc1tzxjnzs5odg1s.gehenna
<Drive name for removable media>:\dhjlzv92awv3lmh0bq==.gehenna
<Drive name for removable media>:\dg9vbgjhci5ibxa=.gehenna
<Drive name for removable media>:\c3vzcgvuzgvky29tcgfuawvzlnhsc3g=.gehenna
<Drive name for removable media>:\c3viamvjdgnsyxnzawzpy2f0aw9ulnppca==.gehenna
<Drive name for removable media>:\c3viamvjdgnsyxnzawzpy2f0aw9ulnhscw==.gehenna
<Drive name for removable media>:\c3bsaxquyxzp.gehenna
<Drive name for removable media>:\c2ftawvlzv9vymllzv9wcmvzzw50yxrpb24uchb0ea==.gehenna
<Drive name for removable media>:\chjpy2uuemlw.gehenna
<Drive name for removable media>:\cgfybmfzxzaxlmpwzwc=.gehenna
<Drive name for removable media>:\c2fjc19wcmvzzw50yxrpb25fc2fjc19xzxbfaw1wcm92aw5nx3j0x2vkdwnhdglvbl9maw5hbc5wchq=.gehenna
<Drive name for removable media>:\cmvtb3zlzhrpdgxlc19yzwnvcmrzlnppca==.gehenna
<Drive name for removable media>:\chvzagtpbi5qcgc=.gehenna
<Drive name for removable media>:\cmvtb3zlzhrpdgxlc19yzwnvcmrzlnhscw==.gehenna
<Drive name for removable media>:\chjvcg9zywx0zw1wbgf0zxmuchb0.gehenna
<Drive name for removable media>:\chjvzhvjdg9zlnppca==.gehenna
<Drive name for removable media>:\chjvzhvjdg9zlnhscw==.gehenna
<Drive name for removable media>:\chjpy2uwmzaymtuuemlw.gehenna
<Drive name for removable media>:\cgfuzhaucnrm.gehenna
<Drive name for removable media>:\c2vydmvylnblbq==.gehenna
<Drive name for removable media>:\zgfnml9wyw5lbdffmziwx3jlzi5tb3y=.gehenna
<Drive name for removable media>:\zdawnjgxotdiyjvhndfmzwexnmeymjbjnduzota2mdyubxa0.gehenna
<Drive name for removable media>:\y3zldxjvcgvvlmrvyw==.gehenna
<Drive name for removable media>:\sw52zxn0bwvudejhbmtdqv9dqtgucgvt.gehenna
<Drive name for removable media>:\svnpmjdrx0lttvnfaw1wbgvtzw50yxrpb25fyw5kx2nlcnrpzmljyxrpb25fchjvy2vzc19vdmvydmlld192mi5wchr4.gehenna
<Drive name for removable media>:\svjhzwvrlnblbq==.gehenna
<Drive name for removable media>:\q2xpcf8xmdgwxzvzzwnfmtbtynbzx2gynjqubxa0.gehenna
<Drive name for removable media>:\qnjlywtwb2ludc5wbmc=.gehenna
<Drive name for removable media>:\qmfieujveu1haw5ub1njzw5lc0jhy2tncm91bmqud212.gehenna
<Drive name for removable media>:\qvnbuhjvamvjdenvbxbldgl0aw9ulnbwdhg=.gehenna
<Drive name for removable media>:\njriaxrfbm90zxmuahrt.gehenna
<Drive name for removable media>:\txlocnzvbgriyw5zc2vuqmloyxjgyw1pbmuucnrm.gehenna
<Drive name for removable media>:\nta4c29mdhdhcmvhbmrvcy5kb2m=.gehenna
<Drive name for removable media>:\my5qcgc=.gehenna
<Drive name for removable media>:\mjewmjuyoda5lmpwzw==.gehenna
<Drive name for removable media>:\mjaxns0wmi13b3jtcy1uyw5vcgfydgljbgutdg94awnpdhkucgrm.gehenna
<Drive name for removable media>:\mjaxns0wmi1wyxrpzw50cy10b3bpyy13b3jrlxjlbgf0zwqtyxn0ag1hlwpvynmucgrm.gehenna
<Drive name for removable media>:\mi5qcgvn.gehenna
<Drive name for removable media>:\mxntx3byawnllnppca==.gehenna
<Drive name for removable media>:\mty4lmpwzw==.gehenna
<Drive name for removable media>:\mtmuanbn.gehenna
<Drive name for removable media>:\mtmuanblzw==.gehenna
<Drive name for removable media>:\ngywymy3zmy3mwyyoc5qcgc=.gehenna
<Drive name for removable media>:\ufbtd2ftcc5wchq=.gehenna
<Drive name for removable media>:\twlsaxrhcnlfq2fsbhnpz25zxzazmteucnrm.gehenna
<Drive name for removable media>:\ugfzc3bvcnrfuefmlndtdg==.gehenna
<Drive name for removable media>:\ymmwms5wzgy=.gehenna
<Drive name for removable media>:\ymfja2dyb3vuzc5wbmc=.gehenna
<Drive name for removable media>:\y29ycmvjdc5hdmk=.gehenna
<Drive name for removable media>:\y29udhjhy3r1ywxkzwfkbgluzxmuegxz.gehenna
<Drive name for removable media>:\y29mzmvllmjtca==.gehenna
<Drive name for removable media>:\y2tfdwdvlnblbq==.gehenna
<Drive name for removable media>:\y2vlx21tc3byb2dyyw1fc3vtbwfyev9wdwjsawmuegxzea==.gehenna
<Drive name for removable media>:\y2j6lnbuzw==.gehenna
<Drive name for removable media>:\y2fsy3vsyxrvcndvcmtzagvldc56axa=.gehenna
<Drive name for removable media>:\y2fsy3vsyxrvcndvcmtzagvldc54bhm=.gehenna
<Drive name for removable media>:\yxjjagvylmf2aq==.gehenna
<Drive name for removable media>:\ywwuegxzea==.gehenna
<Drive name for removable media>:\u3bhbm5lci5tb3y=.gehenna
<Drive name for removable media>:\yxbwbgljyw50lnhsc3g=.gehenna
<Drive name for removable media>:\ywxlcnquahrtba==.gehenna
<Drive name for removable media>:\ywnjb3vudhnyzwnlaxzhymxllnbwda==.gehenna
<Drive name for removable media>:\ywrozf9hbmrfb2jlc2l0es5kb2n4.gehenna
<Drive name for removable media>:\ywrhzhnplmh0bww=.gehenna
<Drive name for removable media>:\v2f0zxjszxnvdxjjzxnbzy5wchr4.gehenna
<Drive name for removable media>:\v2f0zxjmyw5ksgvhbhros2fuby5ydgy=.gehenna
<Drive name for removable media>:\vhvuugvyc29uywxdqteucgvt.gehenna
<Drive name for removable media>:\u3rhdgljx0vszwn0cmljaxr5x0vhc3lfyw5kx1f1awnrx0fjdgl2axrpzxmucnrm.gehenna
<Drive name for removable media>:\d3jpdgluz2nvbxbszxrlc2fybmfycmf0axzlxzexmdmuchb0.gehenna
<Drive name for removable media>:\c3rvyzezx21sx3f1b2nfbguuchb0ea==.gehenna

Malicious functions

Reads files which store third party applications passwords

%APPDATA%\mozilla\firefox\profiles.ini
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\2.jpeg
%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\trivial-merge.htm

Modifies file system

Creates the following files

%TEMP%\desktop.ini
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\q29sbgvjdfn5bmnmb2dzlmjhda==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\rwxldmf0zwrbchbcbhvllnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\rwxldmf0zwrbchbxagl0zs5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\rxjyb3iucg5n.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\rxjyb3jqywdllmh0bww=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\s0znsgvyb1rvyxn0lnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\s0zntg9ja2vkrmlszvrvyxn0lnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\s0znu2nhbkv4y2x1c2lvblrvyxn0lnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\y2fuy2vsswnvbi5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\tg9hzgluz1bhz2uuahrtba==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\uxvvdgfdcml0awnhbc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\uxvvdgffcnjvci5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\uxvvdgfozwfyaw5nlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\u2nyzwvuc2hvde9wdelulmdpzg==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\vgvzdfnoyxjlugfnzs5odg1s.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\vghpcmrqyxj0eu5vdgljzxmudhh0.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\v2fybmluzy5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\ywxlcnrjy29ulnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\ywntrglzbwlzc0ljb24uc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qxbwv2hpdguucg5n.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\t25lrhjpdmvmb2dvlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qxv0b1bsyxlpchrjbi5wbmc=.gehenna
C:\users\public\desktop\qwnyb2jhdcbszwfkzxigremubg5r.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qxv0b1bsyxlpchrjbi5nawy=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qxbwrxjyb3jxagl0zs5wbmc=.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\databases\rgf0ywjhc2vzlmri.gehenna
%LOCALAPPDATA%\swnvbknhy2hllmri.gehenna
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\cg93zxjzagvsbc5leguubg9n.gehenna
%LOCALAPPDATA%\microsoft\internet explorer\iecompatdata\awvjb21wyxrkyxrhlnhtba==.gehenna
%LOCALAPPDATA%\microsoft\internet explorer\ynjuzgxvzy50ehq=.gehenna
%LOCALAPPDATA%\microsoft\internet explorer\awu0dwluaxqtq2xlyxjjy29uq2fjaguubg9n.gehenna
%LOCALAPPDATA%\microsoft\internet explorer\awu0dwluaxqtvxnlcknvbmzpzy5sb2c=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtd2hpdgvfc2nhbgutmtawlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtd2hpdgvfc2nhbgutmti1lnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtd2hpdgvfc2nhbgutmtuwlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtd2hpdgvfc2nhbgutmjawlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\uxvvdgfozwfyaw5nlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\u2nyzwvuc2hvde9wdelulmdpzg==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\ywxlcnrjy29ulnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\zm9szgvyswnvbi5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\zm9szgvyx2ltywdlx2rlc2t0b3auc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\zm9szgvyx2ltywdlx2rvy3vtzw50cy5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\zm9szgvyx2ltywdlx3bpy3r1cmvzlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qxbwrxjyb3jcbhvllnbuzw==.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\rjzcms50bxa=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\qxbwqmx1zs5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\ymx1cnjly3qucg5n.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\y2hly2tib3hdb21wb3npdguuc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\chjlbwl1buljb24uc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\y2hly2ttyxjrx3nlbgvjdgvklnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\c2hpzwxkx2ljb24uc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\c2lnbklulnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\c3rhy2tlzeljzun1ymvzlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\d2fybmluzy1zew1ib2xfz3jles5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\d2f0zxjhbgfzcy5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\ywntrglzbwlzc0ljb24uc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\ymx1cnjly3qucg5n.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\y2fuy2vsswnvbi5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\y2hly2ttyxjrx2zpbmlzagvklnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\y2hly2tib3hdb21wb3npdguuc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\y2hly2ttyxjrx2hvdmvyzwquc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\y2hly2ttyxjrx2lux3byb2dyzxnzlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\y2hly2ttyxjrx3nlbgvjdgvklnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\y2hldnjvbi5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\y2hldnjvblvwlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\y2xvdwquc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\zg9uzv9ncmfwagljlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\zxjyb3jjy29ulnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\cgf1c2vklnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\cgfydglhbgx5rnjlzxppbmcuc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\y2hly2ttyxjrx2zpbmlzagvklnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\cmvjewnszujpbi5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\cmvtawdusw4uc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\b3zlcmzsb3djy29utgfyz2uuc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\b3zlcmzsb3djy29ulnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\y2hldnjvbi5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\y2hldnjvblvwlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\y2xvdwquc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\zg9uzv9ncmfwagljlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\zxjyb3jjy29ulnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\zmluzgvyrxh0zw5zaw9uuhjvbxb0lnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\zm9szgvyswnvbi5zdmc=.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticonsold\rjzbms50bxa=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\zm9szgvyx2ltywdlx2rlc2t0b3auc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\zm9szgvyx2ltywdlx3bpy3r1cmvzlnn2zw==.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\data_reduction_proxy_leveldb\mdawmdazlmxvzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\z2xvymvjy29ulnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\aw5mb0ljb24uc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\a2ztx2zvbgrlcnnfaw1hz2uuc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\bg9hzgluzy5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\bg9hzgluz19zcglubmvylnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\b25ezw1hbmrgawxlcy5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\b25ezw1hbmrgawxlc0rlahlkcmf0zs5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\b25ezw1hbmrtzwxly3rpdmvtew5jlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\zm9szgvyx2ltywdlx2rvy3vtzw50cy5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\y2hly2ttyxjrx2lux3byb2dyzxnzlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\y2hly2ttyxjrx2hvdmvyzwquc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\awnlqnvja2v0lnn2zw==.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\session storage\mdawmdazlmxvzw==.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\nkmwns50bxa=.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\jumplisticons\nkmwnc50bxa=.gehenna
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\ywjjchkuaw5p.gehenna
%ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\rxzlbnrtdg9yzs5kyg==.gehenna
%ALLUSERSPROFILE%\microsoft\diagnosis\rxzlbnrtdg9yzs5kyg==.gehenna
%ALLUSERSPROFILE%\microsoft\diagnosis\b3n2zxiudhh0.gehenna
%ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\rxzlbnrtdg9yzs5kyg==.gehenna
%ALLUSERSPROFILE%\microsoft\identitycrl\production\d2xpzhn2y2nvbmzpzy54bww=.gehenna
%ALLUSERSPROFILE%\microsoft\identitycrl\int\d2xpzhn2y2nvbmzpzy54bww=.gehenna
%ALLUSERSPROFILE%\microsoft\network\downloader\zwrilmxvzw==.gehenna
%ALLUSERSPROFILE%\microsoft\network\downloader\zwridg1wlmxvzw==.gehenna
%ALLUSERSPROFILE%\microsoft\office\qxnzzxrmawjyyxj5lmljbw==.gehenna
%ALLUSERSPROFILE%\microsoft\office\rg9jdw1lbnrszxbvc2l0b3j5lmljbw==.gehenna
%ALLUSERSPROFILE%\microsoft\office\txltagfyzvbvaw50cy5py28=.gehenna
%ALLUSERSPROFILE%\microsoft\network\downloader\cw1nci5kyg==.gehenna
%ALLUSERSPROFILE%\microsoft\office\txltaxrllmljbw==.gehenna
%ALLUSERSPROFILE%\microsoft\office\u2hhcmvqb2ludfbvcnrhbfnpdguuawnv.gehenna
%ALLUSERSPROFILE%\microsoft\office\u2hhcmvqb2ludfrlyw1taxrllmljbw==.gehenna
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\zwrilmxvzw==.gehenna
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\u21zsw50zxjjzxb0u3rvcmuuzgi=.gehenna
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\thluy01vss54bww=.gehenna
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\qwnjzxnztvvju2v0lnhtba==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\zmluzgvyrxh0zw5zaw9uuhjvbxb0lnn2zw==.gehenna
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\c2v0dxauaw5p.gehenna
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\qwnjzxnztvvjlnhtba==.gehenna
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\uhjvb2zpbmcueg1s.gehenna
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\sw5mb1bhdghnvukueg1s.gehenna
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\rengtvvjlnhtba==.gehenna
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\t25ltm90zu1vss54bww=.gehenna
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\r3jvb3zltvvjlnhtba==.gehenna
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\zwrimdawmdeubg9n.gehenna
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\zwridg1wlmxvzw==.gehenna
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\t1nnvvhnvukueg1s.gehenna
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\t2zmawnltvvjlnhtba==.gehenna
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\t2zmawnltvvju2v0lnhtba==.gehenna
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\t2zmawnlnjrnvukueg1s.gehenna
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\ynjhbmrpbmcueg1s.gehenna
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\t2zmawnlnjrnvultzxqueg1s.gehenna
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\uhjvb2yueg1s.gehenna
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\t1nntvvjlnhtba==.gehenna
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\v29yze1vss54bww=.gehenna
%ALLUSERSPROFILE%\microsoft\user account pictures\dxnlci0xotiucg5n.gehenna
%ALLUSERSPROFILE%\microsoft\user account pictures\dxnlci00oc5wbmc=.gehenna
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\bmf0axzlc19ibg9ilmjpbg==.gehenna
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\c2vjb25kyxj5dglszs5wbmc=.gehenna
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\c25hchnob3rfymxvyi5iaw4=.gehenna
%LOCALAPPDATA%\google\chrome\application\y2hyb21lllzpc3vhbevszw1lbnrztwfuawzlc3queg1s.gehenna
%LOCALAPPDATA%\google\chrome\application\zgvidwcubg9n.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\mdawmdazlmxvzw==.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extension state\mdawmdazlmxvzw==.gehenna
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\ynjhbmrpbmcueg1s.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\awnvbl8xmjgucg5n.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\bwfpbi5odg1s.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\bwfpbi5qcw==.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\mti4lnbuzw==.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\mti4lnbuzw==.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\mti4lnbuzw==.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\mtyucg5n.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\mziucg5n.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ndgucg5n.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\mti4lnbuzw==.gehenna
%HOMEPATH%\3d objects\zgvza3rvcc5pbmk=.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\awnvbl8xni5wbmc=.gehenna
%LOCALAPPDATA%\google\chrome\user data\default\r29vz2xlifbyb2zpbguuawnv.gehenna
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\visualelements\c21hbgxsb2dvlnbuzw==.gehenna
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\visualelements\bg9nby5wbmc=.gehenna
%LOCALAPPDATA%\connecteddevicesplatform\l.user\qwn0axzpdgllc0nhy2hllmri.gehenna
C:\users\zgvza3rvcc5pbmk=.gehenna
%ALLUSERSPROFILE%\microsoft\user account pictures\z3vlc3quym1w.gehenna
%ALLUSERSPROFILE%\microsoft\user account pictures\dxnlci5wbmc=.gehenna
%ALLUSERSPROFILE%\microsoft\user account pictures\dxnlci5ibxa=.gehenna
%ALLUSERSPROFILE%\microsoft onedrive\setup\cmvmy291bnquaw5p.gehenna
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\v2luzg93ifn3axrjagvylmxuaw==.gehenna
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\zgvza3rvcc5pbmk=.gehenna
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\u2hvd3mgrgvza3rvcc5sbms=.gehenna
%ALLUSERSPROFILE%\microsoft\user account pictures\z3vlc3qucg5n.gehenna
C:\users\public\accountpictures\zgvza3rvcc5pbmk=.gehenna
C:\users\public\desktop\rmlyzwzvec5sbms=.gehenna
%ALLUSERSPROFILE%\microsoft\user account pictures\dxnlci00mc5wbmc=.gehenna
C:\users\public\desktop\tw96awxsysbuahvuzgvyymlyzc5sbms=.gehenna
C:\users\public\desktop\zgvza3rvcc5pbmk=.gehenna
C:\users\public\desktop\t3blcmeubg5r.gehenna
C:\users\public\documents\zgvza3rvcc5pbmk=.gehenna
C:\users\public\downloads\zgvza3rvcc5pbmk=.gehenna
C:\users\public\libraries\zgvza3rvcc5pbmk=.gehenna
C:\users\public\music\zgvza3rvcc5pbmk=.gehenna
C:\users\public\pictures\zgvza3rvcc5pbmk=.gehenna
%ALLUSERSPROFILE%\microsoft\user account pictures\dxnlci0zmi5wbmc=.gehenna
C:\users\public\zgvza3rvcc5pbmk=.gehenna
C:\users\public\videos\zgvza3rvcc5pbmk=.gehenna
C:\users\public\desktop\u3rlyw0ubg5r.gehenna
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\uhjvb2yueg1s.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\zm9szgvyswnvbi5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\awnlqnvja2v0lnn2zw==.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\u2l0zvnly3vyaxr5u2vydmljzvn0yxrllnr4da==.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\ywjvb2suc3fsaxrl.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\ymxpc3quc3fsaxrl.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\y2vyddkuzgi=.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\y29tcgf0awjpbgl0es5pbmk=.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\y29va2llcy5zcwxpdgu=.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\zw5pz21hawwuc3fsaxrl.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\zmf2awnvbnmuc3fsaxrl.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\zm9ybwhpc3rvcnkuc3fsaxrl.gehenna
%APPDATA%\thunderbird\chjvzmlszxmuaw5p.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\z2xvymfslw1lc3nhz2vzlwrilnnxbgl0zq==.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\a2v5nc5kyg==.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\b3blbnbncc5zcwxpdgu=.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\cgvybwlzc2lvbnmuc3fsaxrl.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\cgtjczexlnr4da==.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\cgxhy2vzlnnxbgl0zq==.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\chjlznmuanm=.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\storage\permanent\chrome\idb\mzg3mdexmjcynhjzzwdtbm9pdhrldc1lcy5zcwxpdgu=.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\c3rvcmfnzs5zcwxpdgu=.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\d2viyxbwc3n0b3jllnnxbgl0zq==.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\qwx0zxjuyxrlu2vydmljzxmudhh0.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\u2vjdxjpdhlqcmvsb2fku3rhdguudhh0.gehenna
%APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\aglzdg9yes5zcwxpdgu=.gehenna
%APPDATA%\thunderbird\aw5zdgfsbhmuaw5p.gehenna
%APPDATA%\opera software\opera stable\dictionaries\zgljdglvbmfyawvzlnhtba==.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\mty1nzexndu5nufty2f0zwlydnrpu3r5lnnxbgl0zq==.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\mjgymzmxodc3n250b3vyb21sywxub2ryes0tbmfvzc5zcwxpdgu=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\mjkxoda2mzm2nxbpdxbzywguc3fsaxrl.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\mzu2mti4odg0oxnkagxpzs5zcwxpdgu=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\mzg3mdexmjcynhjzzwdtbm9pdhrldc1lcy5zcwxpdgu=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\c3rvcmfnzs5zcwxpdgu=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\dxnlci5qcw==.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\d2viyxbwc3n0b3jllnnxbgl0zq==.gehenna
%APPDATA%\mozilla\firefox\aw5zdgfsbhmuaw5p.gehenna
%APPDATA%\mozilla\firefox\chjvzmlszxmuaw5p.gehenna
%APPDATA%\opera software\opera stable\rdqzoc50bxa=.gehenna
%APPDATA%\opera software\opera stable\extension state\mdawmdazlmxvzw==.gehenna
%APPDATA%\opera software\opera stable\jump list icons\nkyznc50bxa=.gehenna
%APPDATA%\opera software\opera stable\jump list icons\nkyzns50bxa=.gehenna
%APPDATA%\opera software\opera stable\jump list icons\nkyzni50bxa=.gehenna
%APPDATA%\opera software\opera stable\jump list icons\nkyzny50bxa=.gehenna
%APPDATA%\opera software\opera stable\jump list icons\nkyzoc50bxa=.gehenna
%APPDATA%\opera software\opera stable\jump list icons\nky1oc50bxa=.gehenna
%APPDATA%\opera software\opera stable\jump list icons\nky1os50bxa=.gehenna
%APPDATA%\opera software\opera stable\b3blcmffyxv0b3vwzgf0zs5sb2c=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\default\moz-extension+++b45758a1-2bc4-443d-b762-cce509c46b5c^usercontextid=4294967295\idb\mzy0nziymjkymxdszwfiy0vvegx0lwvlbmd...
%APPDATA%\opera software\opera stable\themes_backup\bgfuzhnjyxblx3bob3rvlnppca==.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cgxhy2vzlnnxbgl0zq==.gehenna
%HOMEPATH%\contacts\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\links\rg93bmxvywrzlmxuaw==.gehenna
%HOMEPATH%\music\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\onedrive\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\pictures\camera roll\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\pictures\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\saved games\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\searches\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\videos\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\bnr1c2vylmluaq==.gehenna
C:\kms\s01tx1zmx0fmtf9bsu8uy21k.gehenna
%HOMEPATH%\desktop\mi5qcgvn.gehenna
C:\kms\s01tx1zmx0fmtf9bsu9frgvidwcubg9n.gehenna
D:\aw5zdgfsbc5sb2c=.gehenna
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\y2hyb21lljd6.gehenna
%HOMEPATH%\desktop\gehenna-readme-warning.html
C:\users\gehenna-readme-warning.html
C:\gehenna-readme-warning.html
C:\users\public\gehenna-readme-warning.html
%HOMEPATH%\desktop\gehenna-key-readme.txt
C:\users\gehenna-key-readme.txt
%HOMEPATH%\links\rgvza3rvcc5sbms=.gehenna
%HOMEPATH%\favorites\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\links\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\favorites\links\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\downloads\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\desktop\my5qcgvn.gehenna
%HOMEPATH%\desktop\njriaxrfbm90zxmuahrt.gehenna
%HOMEPATH%\desktop\r2fyzgvulmh0bq==.gehenna
%HOMEPATH%\desktop\r29vz2xlienocm9tzs5sbms=.gehenna
%HOMEPATH%\desktop\twljcm9zb2z0ievkz2uubg5r.gehenna
%HOMEPATH%\desktop\vgvszwdyyw0ubg5r.gehenna
%HOMEPATH%\desktop\yxbplwhhc2htyxauahrtba==.gehenna
%HOMEPATH%\desktop\yxjjagvylmf2aq==.gehenna
%HOMEPATH%\desktop\zgfzaejvcmrlcl8xmjauym1w.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\security_state\zgf0ys5zywzllmjpbg==.gehenna
%HOMEPATH%\desktop\zgfzaejvcmrlcl8xotiuym1w.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\storage\permanent\chrome\idb\mtq1mtmxodg2og50b3vyb21sywxub2ryes0tzxbjci5zcwxpdgu=.gehenna
%HOMEPATH%\desktop\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\desktop\zmk1ms5kb2m=.gehenna
%HOMEPATH%\desktop\ag93dg8taw5kzxguahrtba==.gehenna
%HOMEPATH%\desktop\am9pbi5hdmk=.gehenna
%HOMEPATH%\desktop\bglzcf9zdwnjzxnzlmrvyw==.gehenna
%HOMEPATH%\desktop\dghschnfa2vlcgvyx21hewvyxze5njuuzg9jea==.gehenna
%HOMEPATH%\desktop\dhjlzv92awv3lmh0bq==.gehenna
%HOMEPATH%\desktop\dhjpdmlhbc1tzxjnzs5odg0=.gehenna
%HOMEPATH%\documents\zgvza3rvcc5pbmk=.gehenna
%HOMEPATH%\desktop\zgfzaejvcmrlcl85ni5ibxa=.gehenna
%HOMEPATH%\desktop\ngywymy3zmy3mwyyoc5qcgvn.gehenna
%HOMEPATH%\desktop\zglhbc5ibxa=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\chjlznmuanm=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cgtjczexlnr4da==.gehenna
%TEMP%\6f38.tmp
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllmnvbnryyxn0lxdoaxrlx3njywxllte1mc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllmnvbnryyxn0lxdoaxrlx3njywxlltiwmc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllmnvbnryyxn0lxdoaxrlx3njywxlltqwmc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllnnjywxlltewmc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllnnjywxllteyns5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllnnjywxllte1mc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllnnjywxlltiwmc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllnnjywxlltqwmc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\zm9szgvyx2ltywdlx2rlc2t0b3auc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtymxhy2tfc2nhbgutmtawlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtymxhy2tfc2nhbgutmtuwlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtymxhy2tfc2nhbgutmjawlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtymxhy2tfc2nhbgutndawlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtd2hpdgvfc2nhbgutmtawlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtd2hpdgvfc2nhbgutmti1lnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtd2hpdgvfc2nhbgutmtuwlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtd2hpdgvfc2nhbgutmjawlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtd2hpdgvfc2nhbgutndawlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllmnvbnryyxn0lwjsywnrx3njywxlltiwmc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllmnvbnryyxn0lwjsywnrx3njywxllte1mc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuy29udhjhc3qtymxhy2tfc2nhbgutmti1lnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllmnvbnryyxn0lxdoaxrlx3njywxllteyns5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllmnvbnryyxn0lxdoaxrlx3njywxlltewmc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllmnvbnryyxn0lwjsywnrx3njywxllteyns5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllmnvbnryyxn0lwjsywnrx3njywxlltewmc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\aw5mb0ljb24uc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\a2ztx2zvbgrlcnnfaw1hz2uuc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\bg9hzgluzy5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\bg9hzgluz19zcglubmvylnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\b25ezw1hbmrgawxlcy5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\b25ezw1hbmrgawxlc0rlahlkcmf0zs5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\b25ezw1hbmrtzwxly3rpdmvtew5jlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuc2nhbgutmtawlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\b3zlcmzsb3djy29ulnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\cgfydglhbgx5rnjlzxppbmcuc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvnzwruawxllmnvbnryyxn0lwjsywnrx3njywxlltqwmc5wbmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\cgf1c2vklnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\cmvtawdusw4uc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\cmvjewnszujpbi5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\c2hpzwxkx2ljb24uc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\c2lnbklulnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\c3rhy2tlzeljzun1ymvzlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\d2fybmluzy1zew1ib2xfz3jles5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\d2f0zxjhbgfzcy5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\b3zlcmzsb3djy29utgfyz2uuc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\z2xvymvjy29ulnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\zm9szgvyx2ltywdlx3bpy3r1cmvzlnn2zw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\chjlbwl1buljb24uc3zn.gehenna
%LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\zm9szgvyx2ltywdlx2rvy3vtzw50cy5zdmc=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuc2nhbgutmti1lnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\settings\personal\yxnzzxj0sw5mb3jtyxrpb24uaw5p.gehenna
%APPDATA%\microsoft\internet explorer\quick launch\r29vz2xlienocm9tzs5sbms=.gehenna
%APPDATA%\microsoft\internet explorer\quick launch\u2hvd3mgrgvza3rvcc5sbms=.gehenna
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\rmlszsbfehbsb3jlci5sbms=.gehenna
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\zgvza3rvcc5pbmk=.gehenna
%APPDATA%\microsoft\internet explorer\quick launch\v2luzg93ifn3axrjagvylmxuaw==.gehenna
%APPDATA%\microsoft\internet explorer\quick launch\zgvza3rvcc5pbmk=.gehenna
%APPDATA%\mozilla\firefox\profiles\jkail15y.default\dxnlci5qcw==.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\u2l0zvnly3vyaxr5u2vydmljzvn0yxrllnr4da==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuc2nhbgutmjawlnbuzw==.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\y2vyddkuzgi=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\y29udgvudc1wcmvmcy5zcwxpdgu=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\y29va2llcy5zcwxpdgu=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\datareporting\glean\db\zgf0ys5zywzllmjpbg==.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\zmf2awnvbnmuc3fsaxrl.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\zm9ybwhpc3rvcnkuc3fsaxrl.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\gmp-widevinecdm\4.10.2557.0\teldru5trs50ehq=.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\a2v5nc5kyg==.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\cgvybwlzc2lvbnmuc3fsaxrl.gehenna
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\skypert\cgvyc2lzdgvudc5jb25m.gehenna
%LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\t25lq29ubmvjdc5qb3n0sw5zdgfsbgf0aw9uvgfzaza5xzi4xze5xzi3xze0xzk3ndmudhh0.gehenna
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\y29tcgf0awjpbgl0es5pbmk=.gehenna
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\c2hhcmvklnhtba==.gehenna
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\zhrsc2tles5kzxi=.gehenna
%LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\t25lq29ubmvjdc5eaxnjb3zlcnlob3rpzmljyxrpb25uyxnrmdlfmjhfmtlfnddfmjhfmje1ns50ehq=.gehenna
%LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\t25lq29ubmvjdc5eaxnjb3zlcnlob3rpzmljyxrpb25uyxnrmdzfmjhfmtlfmzlfmzvfnduzns50ehq=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\settings\personal\z2xvymfslmluaq==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\settings\personal\bg9nvxbsb2fkzxjtzxr0aw5ncy5pbmk=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\settings\personal\bg9nvxbsb2fkzxjtzxr0aw5nc190zw1wlmluaq==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\sw5zdgfsbc1qzxjvc2vyxziwmjitmdktmjlfmdixnte1xzvhoc1lmtaubg9n.gehenna
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\sw5zdgfsbc1qzxjvc2vyxziwmjitmdktmjlfmdixodmxxzezotatmtm5nc5sb2c=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\sw5zdgfsbf8ymdiylta5lti5xzaymtq1nf8xmmm0lteyyzgubg9n.gehenna
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\sw5zdgfsbf8ymdiylta5lti5xzaymtgxml8xmta4ltexmgmubg9n.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuc2nhbgutmtuwlnbuzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\vxbkyxrlxziwmjitmdktmjlfmdizote0xzeyngmtotjjlmxvzw==.gehenna
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\vxbkyxrlxziwmjmtmdytmjlfmdiwmjuwxzezytqtmtnhoc5sb2c=.gehenna
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\zhrsc2nlcnquzgvy.gehenna
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\vxbkyxrlxziwmjmtmdytmjlfmdiwnje2xzexotatmte5nc5sb2c=.gehenna
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\startupcache\c2nyaxb0q2fjaguuymlu.gehenna
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\startupcache\dxjsq2fjaguty3vycmvudc5iaw4=.gehenna
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\startupcache\dxjsq2fjaguuymlu.gehenna
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\zwrilmxvzw==.gehenna
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\zwridg1wlmxvzw==.gehenna
%LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\t25lq29ubmvjdc5eaxnjb3zlcnlob3rpzmljyxrpb25uyxnrmdzfmjhfmtlfmtbfmzjfmtq5ns50ehq=.gehenna
%LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\t25lq29ubmvjdc5eaxnjb3zlcnlob3rpzmljyxrpb25uyxnrmdzfmjhfmtlfmzbfmdvfnje3nc50ehq=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\setup\logs\vxbkyxrlxziwmjmtmdytmjlfmde1odm3xze0yjqtmtrioc5sb2c=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\t25lrhjpdmuuvmlzdwfsrwxlbwvudhnnyw5pzmvzdc54bww=.gehenna
%LOCALAPPDATA%\microsoft\onedrive\logoimages\t25lrhjpdmvtbwfsbfrpbguuc2nhbgutndawlnbuzw==.gehenna
%LOCALAPPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\startupcache\c2nyaxb0q2fjaguty2hpbgquymlu.gehenna
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\uhjvb2yueg1s.gehenna
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\t3v0bg9va01vss54bww=.gehenna
%TEMP%\error.png
%TEMP%\errorpage.html
%TEMP%\kfmherotoast.png
%TEMP%\kfmlockedfiletoast.png
%TEMP%\kfmscanexclusiontoast.png
%TEMP%\loadingpage.html
%TEMP%\onedrivelogo.png
%TEMP%\quotacritical.png
%TEMP%\quotaerror.png
%TEMP%\chevronup.svg
%TEMP%\testsharepage.html
%TEMP%\warning.png
%TEMP%\acmdismissicon.svg
%TEMP%\blurrect.png
%TEMP%\cancelicon.svg
%TEMP%\checkboxcomposite.svg
%TEMP%\checkmark_finished.svg
%TEMP%\checkmark_hovered.svg
%TEMP%\checkmark_in_progress.svg
%TEMP%\collectsynclogs.bat
%TEMP%\checkmark_selected.svg
%TEMP%\elevatedappwhite.png
%TEMP%\thirdpartynotices.txt
%TEMP%\autoplayoptin.png
%TEMP%\iconcache.db
%TEMP%\iecompatdata.xml
%TEMP%\brndlog.txt
%TEMP%\ie4uinit-cleariconcache.log
%TEMP%\ie4uinit-userconfig.log
%TEMP%\onedrivesmalltile.contrast-white_scale-100.png
%TEMP%\onedrivesmalltile.contrast-white_scale-125.png
%TEMP%\onedrivesmalltile.contrast-white_scale-150.png
%TEMP%\onedrivesmalltile.contrast-white_scale-200.png
%TEMP%\quotanearing.png
%TEMP%\screenshotoptin.gif
%TEMP%\alerticon.png
%TEMP%\foldericon.svg
%TEMP%\folder_image_desktop.svg
%TEMP%\folder_image_documents.svg
%TEMP%\folder_image_pictures.svg
%TEMP%\appblue.png
%TEMP%\apperrorblue.png
%TEMP%\apperrorwhite.png
%TEMP%\autoplayoptin.gif
%TEMP%\chevron.svg
%TEMP%\powershell.exe.log
%TEMP%\appwhite.png
%TEMP%\onedrivesmalltile.scale-200.png
%TEMP%\cloud.svg
%TEMP%\onedrivemedtile.contrast-black_scale-200.png
%TEMP%\onedrivemedtile.contrast-white_scale-100.png
%TEMP%\onedrivemedtile.contrast-white_scale-125.png
%TEMP%\onedrivemedtile.contrast-white_scale-150.png
%TEMP%\onedrivemedtile.contrast-white_scale-200.png
%TEMP%\onedrivemedtile.contrast-white_scale-400.png
%TEMP%\onedrivemedtile.scale-100.png
%TEMP%\onedrivemedtile.scale-125.png
%TEMP%\onedrivemedtile.scale-150.png
%TEMP%\onedrivemedtile.scale-200.png
%TEMP%\onedrivemedtile.contrast-black_scale-150.png
%TEMP%\onedrivemedtile.scale-400.png
%TEMP%\onedrivesmalltile.contrast-black_scale-125.png
%TEMP%\onedrivesmalltile.contrast-black_scale-150.png
%TEMP%\onedrivesmalltile.contrast-black_scale-200.png
%TEMP%\onedrivesmalltile.contrast-black_scale-400.png
%TEMP%\onedrivesmalltile.contrast-white_scale-400.png
%TEMP%\onedrivesmalltile.scale-100.png
%TEMP%\onedrivesmalltile.scale-125.png
%TEMP%\onedrivemedtile.contrast-black_scale-125.png
%TEMP%\onedrivemedtile.contrast-black_scale-100.png
%TEMP%\waterglass.svg
%TEMP%\onedrivemedtile.contrast-black_scale-400.png
%TEMP%\warning-symbol_grey.svg
%TEMP%\done_graphic.svg
%TEMP%\erroricon.svg
%TEMP%\globeicon.svg
%TEMP%\icebucket.svg
%TEMP%\infoicon.svg
%TEMP%\kfm_folders_image.svg
%TEMP%\loading.svg
%TEMP%\loading_spinner.svg
%TEMP%\ondemandfiles.svg
%TEMP%\databases.db
%TEMP%\ondemandfilesdehydrate.svg
%TEMP%\overflowicon.svg
%TEMP%\knowngamelist.bin
%TEMP%\overflowiconlarge.svg
%TEMP%\paused.svg
%TEMP%\premiumicon.svg
%TEMP%\resignin.svg
%TEMP%\recyclebin.svg
%TEMP%\shield_icon.svg
%TEMP%\signin.svg
%TEMP%\stackedicecubes.svg
%TEMP%\ondemandselectivesync.svg
%TEMP%\f6b1.tmp
%TEMP%\finderextensionprompt.svg
%TEMP%\partiallyfreezing.svg
%TEMP%\f6a1.tmp
%TEMP%\6c05.tmp
%TEMP%\behavior.xml
%TEMP%\overlay.png
%TEMP%\superbar.png
%TEMP%\watermark.png
%TEMP%\resource.xml
%TEMP%\folder.ico
%TEMP%\netfol.ico
%TEMP%\pictures.ico
%TEMP%\ringtones.ico
%TEMP%\settings.ico
%TEMP%\sync.ico
%TEMP%\tasks.xml
%TEMP%\wmp.ico
%TEMP%\print_pref.ico
%TEMP%\print_property.ico
%TEMP%\print_queue.ico
%TEMP%\scan_.ico
%TEMP%\scan_property.ico
%TEMP%\scan_settings.ico
%TEMP%\abcpy.ini
%TEMP%\setup.ini
%TEMP%\accessmuiset.xml
%TEMP%\device.png
%TEMP%\lyncmui.xml
%TEMP%\office64ww.xml
%TEMP%\onedrivesmalltile.scale-150.png
%TEMP%\setup.xml
%TEMP%\excelmui.xml
%TEMP%\powerpointmui.xml
%TEMP%\publishermui.xml
%TEMP%\outlookmui.xml
%TEMP%\wordmui.xml
%TEMP%\proof.xml
%TEMP%\proofing.xml
%TEMP%\eventstore.db
%TEMP%\infopathmui.xml
%TEMP%\osver.txt
%TEMP%\onenotemui.xml
%TEMP%\osmmui.xml
%TEMP%\osmuxmui.xml
%TEMP%\officemui.xml
%TEMP%\officemuiset.xml
%TEMP%\branding.xml
%TEMP%\office64mui.xml
%TEMP%\office64muiset.xml
%TEMP%\accessmui.xml
%TEMP%\dcfmui.xml
%TEMP%\proplusww.xml
%TEMP%\groovemui.xml
%TEMP%\onedrivesmalltile.contrast-black_scale-100.png
%TEMP%\edbtmp.log
%TEMP%\assetlibrary.ico
%TEMP%\logo.png
%TEMP%\smalllogo.png
%TEMP%\natives_blob.bin
%TEMP%\secondarytile.png
%TEMP%\snapshot_blob.bin
%TEMP%\chrome.visualelementsmanifest.xml
%TEMP%\debug.log
%TEMP%\000003.log
%TEMP%\background.png
%TEMP%\icon_128.png
%TEMP%\main.html
%TEMP%\main.js
%TEMP%\128.png
%TEMP%\16.png
%TEMP%\32.png
%TEMP%\48.png
%TEMP%\google profile.ico
%TEMP%\6c04.tmp
%TEMP%\steam.lnk
%TEMP%\mozilla thunderbird.lnk
%TEMP%\icon_16.png
%TEMP%\chrome.7z
%TEMP%\activitiescache.db
%TEMP%\firefox.lnk
%TEMP%\acrobat reader dc.lnk
%TEMP%\documentrepository.ico
%TEMP%\mysharepoints.ico
%TEMP%\mysite.ico
%TEMP%\sharepointportalsite.ico
%TEMP%\sharepointteamsite.ico
%TEMP%\smsinterceptstore.db
%TEMP%\edb00001.log
%TEMP%\wlidsvcconfig.xml
%TEMP%\guest.bmp
%TEMP%\user-192.png
%TEMP%\opera.lnk
%TEMP%\user-32.png
%TEMP%\user-48.png
%TEMP%\user.bmp
%TEMP%\user.png
%TEMP%\refcount.ini
%TEMP%\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml
%TEMP%\window switcher.lnk
%TEMP%\shows desktop.lnk
%TEMP%\guest.png
%TEMP%\qmgr.db
%TEMP%\edb.log
%TEMP%\user-40.png
%TEMP%\elevatedappblue.png
%TEMP%\onedrivesmalltile.scale-400.png
%TEMP%\waterresourcesag.pptx
%TEMP%\adhd_and_obesity.docx
%TEMP%\al.xlsx
%TEMP%\alert.html
%TEMP%\applicant.xlsx
%TEMP%\bc01.pdf
%TEMP%\calculatorworksheet.xls
%TEMP%\calculatorworksheet.zip
%TEMP%\cbz.png
%TEMP%\install.log
%TEMP%\cee_mmsprogram_summary_public.xlsx
%TEMP%\coffee.bmp
%TEMP%\contractualdeadlines.xls
%TEMP%\correct.avi
%TEMP%\cveuropeo.doc
%TEMP%\d0068197bb5a41fea16a220c45390606.mp4
%TEMP%\dag2_panel1_320_ref.mov
%TEMP%\dashborder_144.bmp
%TEMP%\default.bmp
%TEMP%\waterlandhealthkano.rtf
%TEMP%\tunpersonalca1.pem
%TEMP%\ck_ugo.pem
%TEMP%\adadsi.html
%TEMP%\accountsreceivable.ppt
%TEMP%\static_electricity_easy_and_quick_activities.rtf
%TEMP%\spanner.mov
%TEMP%\168.jpg
%TEMP%\1sm_price.zip
%TEMP%\2015-02-patients-topic-work-related-asthma-jobs.pdf
%TEMP%\2015-02-worms-nanoparticle-toxicity.pdf
%TEMP%\210252809.jpg
%TEMP%\3.jpg
%TEMP%\4f0bf7ff71f28.jpg
%TEMP%\february_catalogue__2015.doc
%TEMP%\508softwareandos.doc
%TEMP%\babyboymaintoscenesbackground.wmv
%TEMP%\onedrive.visualelementsmanifest.xml
%TEMP%\breakpoint.png
%TEMP%\irgeek.pem
%TEMP%\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
%TEMP%\investmentbankca_ca8.pem
%TEMP%\military_callsigns_0311.rtf
%TEMP%\myhrvoldhanssenbiharfamine.rtf
%TEMP%\ppswamp.ppt
%TEMP%\passport_pal.wmv
%TEMP%\asaprojectcompetition.pptx
%TEMP%\13.jpeg
%TEMP%\10thingscondoms.pdf
%TEMP%\clip_1080_5sec_10mbps_h264.mp4
%TEMP%\13.jpg
%TEMP%\fiche_inscription_2015.xls
%TEMP%\glidescope_review_rev_010.docx
%TEMP%\subjectclassification.xls
%TEMP%\subjectclassification.zip
%TEMP%\suspendedcompanies.xlsx
%TEMP%\toolbar.bmp
%TEMP%\trivial-merge.html
%TEMP%\trtf_matrix2012_oct.xlsx
%TEMP%\writingcompletesarnarrative_1103.ppt
C:\$recycle.bin\s-1-5-21-2377844457-1847597103-2569463324-1000\zgvza3rvcc5pbmk=.gehenna
%TEMP%\file_p_00000000_1371597592.docx
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\t2zmawnlnjrxvy54bww=.gehenna
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\rxhjzwxnvukueg1s.gehenna
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\ug93zxjqb2lude1vss54bww=.gehenna
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\uhvibglzagvytvvjlnhtba==.gehenna
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\u2v0dxaueg1s.gehenna
%TEMP%\sdszfo.docx
%TEMP%\samieee_obiee_presentation.pptx
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\uhjvugx1c1dxlnhtba==.gehenna
%TEMP%\stoc13_ml_quoc_le.pptx
%TEMP%\split.avi
%TEMP%\sacs_presentation_sacs_qep_improving_rt_education_final.ppt
%TEMP%\removedtitles_records.zip
%TEMP%\gruenspecht_02172016.pptx
%TEMP%\hhhlcert.pem
%TEMP%\holycrosschurchinstructions.docx
%TEMP%\ituneshelpunavailable.htm
%TEMP%\iisstart.html
%TEMP%\indogerman2010.pptx
%TEMP%\issi2013_template_for_posters.docx
%TEMP%\fiche_inscription_2015.zip
%TEMP%\lom602.pdf
%TEMP%\ovp25012015.doc
%TEMP%\server.pem
%TEMP%\pandp.rtf
%TEMP%\price.zip
%TEMP%\price030215.zip
%TEMP%\productos.xls
%TEMP%\productos.zip
%TEMP%\proposaltemplates.ppt
%TEMP%\pushkin.jpg
%TEMP%\removedtitles_records.xls
%TEMP%\mappingconcepthubberlin.ppt
%TEMP%\fungalnameauthors.rtf
%TEMP%\flower_trans_matte.wmv
%TEMP%\parnas_01.jpeg
D:\$recycle.bin\s-1-5-21-2377844457-1847597103-2569463324-1000\zgvza3rvcc5pbmk=.gehenna
C:\gehenna-key-readme.txt
%TEMP%\ntuser.ini
%TEMP%\google chrome.lnk
%TEMP%\file explorer.lnk
%TEMP%\user.js
%TEMP%\sitesecurityservicestate.txt
%TEMP%\cert9.db
%TEMP%\compatibility.ini
%TEMP%\content-prefs.sqlite
%TEMP%\cookies.sqlite
%TEMP%\data.safe.bin
%TEMP%\favicons.sqlite
%TEMP%\formhistory.sqlite
%TEMP%\license.txt
%TEMP%\key4.db
%TEMP%\permissions.sqlite
%TEMP%\pkcs11.txt
%TEMP%\places.sqlite
%TEMP%\prefs.js
%APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\prefs.js
%TEMP%\3647222921wleabceoxlt-eengsairo.sqlite
%TEMP%\dtlscert.der
%TEMP%\skypeapp0.txt
%TEMP%\shared.xml
%TEMP%\persistent.conf
%TEMP%\oneconnect.postinstallationtask09_28_19_27_14_9743.txt
%TEMP%\update_2023-06-29_020616_1190-1194.log
%TEMP%\global.ini
%TEMP%\loguploadersettings.ini
%TEMP%\loguploadersettings_temp.ini
%TEMP%\install-peruser_2022-09-29_021515_5a8-e10.log
%TEMP%\install-peruser_2022-09-29_021831_1390-1394.log
%TEMP%\install_2022-09-29_021454_12c4-12c8.log
%TEMP%\install_2022-09-29_021812_1108-110c.log
%TEMP%\update_2022-09-29_023914_124c-92c.log
%TEMP%\update_2023-06-29_015837_14b4-14b8.log
%TEMP%\1451318868ntouromlalnodry--epcr.sqlite
%TEMP%\kms_vl_all_aio.cmd
%TEMP%\update_2023-06-29_020250_13a4-13a8.log
%TEMP%\scriptcache-child.bin
%TEMP%\scriptcache-current.bin
%TEMP%\scriptcache.bin
%TEMP%\urlcache-current.bin
%TEMP%\urlcache.bin
%TEMP%\oneconnect.discoverynotificationtask06_28_19_10_32_1495.txt
%TEMP%\oneconnect.discoverynotificationtask06_28_19_30_05_6174.txt
%TEMP%\oneconnect.discoverynotificationtask06_28_19_39_35_4535.txt
%TEMP%\oneconnect.discoverynotificationtask09_28_19_47_28_2155.txt
%TEMP%\assertinformation.ini
%TEMP%\scriptcache-child-current.bin
%TEMP%\kms_vl_all_aio_debug.log
%TEMP%\1657114595amcateirvtisty.sqlite
%TEMP%\3870112724rsegmnoittet-es.sqlite
%TEMP%\64bit_notes.htm
%TEMP%\garden.htm
%TEMP%\microsoft edge.lnk
%TEMP%\telegram.lnk
%TEMP%\api-hashmap.html
%TEMP%\archer.avi
%TEMP%\dashborder_120.bmp
%TEMP%\dashborder_192.bmp
%TEMP%\dtlskey.der
%TEMP%\dashborder_96.bmp
%TEMP%\fi51.doc
%TEMP%\howto-index.html
%TEMP%\join.avi
%TEMP%\lisp_success.doc
%TEMP%\thlps_keeper_mayer_1965.docx
%TEMP%\tree_view.htm
%TEMP%\trivial-merge.htm
%TEMP%\desktop.lnk
%TEMP%\downloads.lnk
%TEMP%\2.jpeg
%TEMP%\dial.bmp
%TEMP%\4f0bf7ff71f28.jpeg
%TEMP%\3.jpeg
%TEMP%\openpgp.sqlite
%TEMP%\history.sqlite
%TEMP%\storage.sqlite
%TEMP%\webappsstore.sqlite
%TEMP%\installs.ini
%TEMP%\profiles.ini
%TEMP%\d438.tmp
%TEMP%\6f34.tmp
%TEMP%\6f35.tmp
%TEMP%\6f36.tmp
%TEMP%\2823318777ntouromlalnodry--naod.sqlite
%TEMP%\6f37.tmp
%TEMP%\2918063365piupsah.sqlite
%TEMP%\6f58.tmp
%TEMP%\dictionaries.xml
%TEMP%\opera_autoupdate.log
%TEMP%\landscape_photo.zip
%TEMP%\alternateservices.txt
%TEMP%\securitypreloadstate.txt
%TEMP%\abook.sqlite
%TEMP%\blist.sqlite
%TEMP%\enigmail.sqlite
%TEMP%\3561288849sdhlie.sqlite
%TEMP%\global-messages-db.sqlite
%TEMP%\6f59.tmp
C:\users\public\gehenna-key-readme.txt

Modifies the following files

C:\$recycle.bin\s-1-5-21-2377844457-1847597103-2569463324-1000\desktop.ini
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\dcfmui.xml
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proofing.xml
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\osmuxmui.xml

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /C "vssadmin delete shadows /All /Quiet ; icacls . /grant Everyone:F /T /C /Q ; vssadmin delete shadows /All /Quiet ; bcdedit /set { default } bootstatuspolicy ignoreallfailures ; wbadmin delet...' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C "vssadmin delete shadows /All /Quiet ; icacls . /grant Everyone:F /T /C /Q ; vssadmin delete shadows /All /Quiet ; bcdedit /set { default } bootstatuspolicy ignoreallfailures ; wbadmin delet...
'<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
'<SYSTEM32>\searchfilterhost.exe' 0 768 772 780 8192 776

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial