Trojan.Encoder.45337

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Shell Experience' = '"%APPDATA%\Microsoft\Windows\UpdateOrchestrator\WudfRd.exe" "%TEMP%\onefile_1764_134265760621676117\coffin_fle...
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Windows Shell Experience' = '"%APPDATA%\Microsoft\Windows\UpdateOrchestrator\WudfRd.exe" "%TEMP%\onefile_1764_134265760621676117\coffin...
[HKCU\Software\Classes\CoffinFleet.encrypted\shell\open\command] '' = '"%APPDATA%\Microsoft\Windows\UpdateOrchestrator\WudfRd.exe" "%TEMP%\onefile_1764_134265760621676117\coffin_fleet_ransom.py...

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\winupdate_svc.bat
<SYSTEM32>\tasks\microsoftwindowsupdatesvc

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\trivial-merge.htm
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\about.htm
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\about.html
<Drive name for removable media>:\ituneshelpunavailable.html
<Drive name for removable media>:\iisstart.html
<Drive name for removable media>:\adadsi.html
<Drive name for removable media>:\4f0bf7ff71f28.jpeg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\pushkin.jpeg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\168.jpeg
<Drive name for removable media>:\13.jpg
<Drive name for removable media>:\4f0bf7ff71f28.jpg
<Drive name for removable media>:\2.jpg
<Drive name for removable media>:\1189.jpg
<Drive name for removable media>:\firefly1.mov
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4
<Drive name for removable media>:\spanner.mov
<Drive name for removable media>:\video_1.mp4
<Drive name for removable media>:\video.mp4
<Drive name for removable media>:\51.mp4
<Drive name for removable media>:\lom602.pdf
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf
<Drive name for removable media>:\spib_pima.pdf
<Drive name for removable media>:\ff_ot_user_guide.pdf
<Drive name for removable media>:\ck.pem
<Drive name for removable media>:\cert.pem
<Drive name for removable media>:\cbz.png
<Drive name for removable media>:\bg_search_box.png
<Drive name for removable media>:\background.png
<Drive name for removable media>:\breakpoint.png
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt
<Drive name for removable media>:\proposaltemplates.ppt
<Drive name for removable media>:\ppswamp.ppt
<Drive name for removable media>:\file1.ppt
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\metac.ppt
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\pandp.rtf
<Drive name for removable media>:\babyboymaintoscenesbackground.wmv
<Drive name for removable media>:\fungalnameauthors.rtf
<Drive name for removable media>:\babyboymaintoscenesbackground_pal.wmv
<Drive name for removable media>:\testwmv.wmv
<Drive name for removable media>:\flower_trans_matte.wmv
<Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv
<Drive name for removable media>:\passport_pal.wmv
<Drive name for removable media>:\subjectclassification.xls
<Drive name for removable media>:\price030215.xls
<Drive name for removable media>:\1sm_price.xls
<Drive name for removable media>:\2013_finalsummaryforweb.xlsx
<Drive name for removable media>:\national_autism_preparation_programs.xlsx
<Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx
<Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx
<Drive name for removable media>:\applicant.xlsx
<Drive name for removable media>:\1sm_price.zip
<Drive name for removable media>:\removedtitles_records.zip
<Drive name for removable media>:\system volume information\wpsettings.dat
<Drive name for removable media>:\contractualdeadlines.zip

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM Taskmgr.exe
'<SYSTEM32>\taskkill.exe' /F /IM procexp.exe
'<SYSTEM32>\taskkill.exe' /F /IM procexp64.exe
'<SYSTEM32>\taskkill.exe' /F /IM ProcessHacker.exe

Launches a large number of processes

Patches code

in NTDLL dll

wseryiz.exe process, ntdll.dll module

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\schtasks.exe
<SYSTEM32>\windowspowershell\v1.0\powershell.exe
<SYSTEM32>\taskkill.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\coffin_768662.jpeg
%HOMEPATH%\desktop\coffin_230820.avi
%HOMEPATH%\desktop\coffin_133433.jpg
%HOMEPATH%\desktop\coffin_259279.jpg
%HOMEPATH%\desktop\coffin_961224.jpeg
%HOMEPATH%\desktop\coffin_283110.doc
%HOMEPATH%\desktop\coffin_727729.jpeg
%HOMEPATH%\desktop\coffin_716602.jpeg
%HOMEPATH%\desktop\coffin_628997.jpg
%HOMEPATH%\desktop\coffin_381789.htm
%HOMEPATH%\desktop\coffin_241303.htm
%HOMEPATH%\desktop\coffin_896141.jpg
%HOMEPATH%\desktop\coffin_919373.docx
%HOMEPATH%\desktop\coffin_801049.htm
%HOMEPATH%\desktop\coffin_693218.html
%HOMEPATH%\desktop\coffin_969663.cer
%HOMEPATH%\desktop\coffin_693052.avi
%HOMEPATH%\desktop\coffin_542875.cer
%HOMEPATH%\desktop\coffin_432612.cer
%HOMEPATH%\desktop\coffin_599460.bmp
%HOMEPATH%\desktop\coffin_718771.html
%HOMEPATH%\desktop\coffin_128184.docx
%HOMEPATH%\desktop\coffin_369674.doc
%HOMEPATH%\desktop\coffin_960687.doc
%HOMEPATH%\desktop\coffin_320954.cer
%HOMEPATH%\desktop\coffin_829253.cer
%HOMEPATH%\desktop\coffin_279381.doc
%HOMEPATH%\desktop\coffin_735058.htm
%HOMEPATH%\desktop\coffin_974222.jpg
%HOMEPATH%\desktop\coffin_663260.cer

Modifies file system

Creates the following files

%APPDATA%\microsoft\windows\updateorchestrator\wudfrd.exe
%TEMP%\onefile_1764_134265760621676117\coffin_fleet_ransom.dll
%TEMP%\onefile_1764_134265760621676117\_bz2.pyd
%TEMP%\onefile_1764_134265760621676117\_cffi_backend.pyd
%TEMP%\onefile_1764_134265760621676117\_ctypes.pyd
%TEMP%\onefile_1764_134265760621676117\_decimal.pyd
%TEMP%\onefile_1764_134265760621676117\_elementtree.pyd
%TEMP%\onefile_1764_134265760621676117\_hashlib.pyd
%TEMP%\onefile_1764_134265760621676117\_lzma.pyd
%TEMP%\onefile_1764_134265760621676117\_multiprocessing.pyd
%TEMP%\onefile_1764_134265760621676117\_queue.pyd
%TEMP%\onefile_1764_134265760621676117\_socket.pyd
%TEMP%\onefile_1764_134265760621676117\_ssl.pyd
%TEMP%\onefile_1764_134265760621676117\_wmi.pyd
%TEMP%\onefile_1764_134265760621676117\concrt140.dll
%TEMP%\onefile_1764_134265760621676117\libcrypto-3.dll
%TEMP%\onefile_1764_134265760621676117\libeay32.dll
%TEMP%\onefile_1764_134265760621676117\libffi-8.dll
%TEMP%\onefile_1764_134265760621676117\libssl-3.dll
%TEMP%\onefile_1764_134265760621676117\msvcp140.dll
%TEMP%\onefile_1764_134265760621676117\msvcp140_1.dll
%TEMP%\onefile_1764_134265760621676117\pyexpat.pyd
%TEMP%\onefile_1764_134265760621676117\python3.dll
%TEMP%\onefile_1764_134265760621676117\python313.dll
%TEMP%\onefile_1764_134265760621676117\qt5core.dll
%TEMP%\onefile_1764_134265760621676117\qt5dbus.dll
%TEMP%\onefile_1764_134265760621676117\qt5gui.dll
%TEMP%\onefile_1764_134265760621676117\qt5multimedia.dll
%TEMP%\onefile_1764_134265760621676117\qt5network.dll
%TEMP%\onefile_1764_134265760621676117\qt5printsupport.dll
%TEMP%\onefile_1764_134265760621676117\qt5qml.dll
%TEMP%\onefile_1764_134265760621676117\qt5qmlmodels.dll
%TEMP%\onefile_1764_134265760621676117\qt5quick.dll
%TEMP%\onefile_1764_134265760621676117\qt5svg.dll
%TEMP%\onefile_1764_134265760621676117\qt5websockets.dll
%TEMP%\onefile_1764_134265760621676117\qt5widgets.dll
%TEMP%\onefile_1764_134265760621676117\select.pyd
%TEMP%\onefile_1764_134265760621676117\ssleay32.dll
%TEMP%\onefile_1764_134265760621676117\unicodedata.pyd
%TEMP%\onefile_1764_134265760621676117\vcruntime140.dll
%TEMP%\onefile_1764_134265760621676117\vcruntime140_1.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qtcore.pyd
%TEMP%\onefile_1764_134265760621676117\pyqt5\qtgui.pyd
%TEMP%\onefile_1764_134265760621676117\pyqt5\qtwidgets.pyd
%TEMP%\onefile_1764_134265760621676117\pyqt5\sip.pyd
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\iconengines\qsvgicon.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\imageformats\qgif.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\imageformats\qicns.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\imageformats\qico.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\imageformats\qjpeg.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\imageformats\qsvg.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\imageformats\qtga.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\imageformats\qtiff.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\imageformats\qwbmp.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\imageformats\qwebp.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\mediaservice\dsengine.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\mediaservice\qtmedia_audioengine.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\mediaservice\wmfengine.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\platforms\qminimal.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\platforms\qoffscreen.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\platforms\qwebgl.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\platforms\qwindows.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\platformthemes\qxdgdesktopportal.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\printsupport\windowsprintersupport.dll
%TEMP%\onefile_1764_134265760621676117\pyqt5\qt-plugins\styles\qwindowsvistastyle.dll
%TEMP%\onefile_1764_134265760621676117\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\onefile_1764_134265760621676117\jaraco\text\lorem ipsum.txt
%TEMP%\onefile_1764_134265760621676117\numpy\_core\_multiarray_tests.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\_core\_multiarray_umath.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\fft\_pocketfft_umath.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\linalg\_umath_linalg.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\random\_bounded_integers.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\random\_common.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\random\_generator.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\random\_mt19937.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\random\_pcg64.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\random\_philox.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\random\_sfc64.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\random\bit_generator.pyd
%TEMP%\onefile_1764_134265760621676117\numpy\random\mtrand.pyd
%TEMP%\onefile_1764_134265760621676117\numpy.libs\libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
%TEMP%\onefile_1764_134265760621676117\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
%TEMP%\onefile_1764_134265760621676117\pygame\sdl2.dll
%TEMP%\onefile_1764_134265760621676117\pygame\sdl2_image.dll
%TEMP%\onefile_1764_134265760621676117\pygame\sdl2_mixer.dll
%TEMP%\onefile_1764_134265760621676117\pygame\sdl2_ttf.dll
%TEMP%\onefile_1764_134265760621676117\pygame\_camera.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\_freetype.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\_sprite.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\base.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\bufferproxy.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\color.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\constants.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\display.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\draw.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\event.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\font.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\freesansbold.ttf
%TEMP%\onefile_1764_134265760621676117\pygame\freetype.dll
%TEMP%\onefile_1764_134265760621676117\pygame\gfxdraw.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\image.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\imageext.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\joystick.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\key.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\libjpeg-9.dll
%TEMP%\onefile_1764_134265760621676117\pygame\libmodplug-1.dll
%TEMP%\onefile_1764_134265760621676117\pygame\libogg-0.dll
%TEMP%\onefile_1764_134265760621676117\pygame\libopus-0.dll
%TEMP%\onefile_1764_134265760621676117\pygame\libopusfile-0.dll
%TEMP%\onefile_1764_134265760621676117\pygame\libpng16-16.dll
%TEMP%\onefile_1764_134265760621676117\pygame\libtiff-5.dll
%TEMP%\onefile_1764_134265760621676117\pygame\libwebp-7.dll
%TEMP%\onefile_1764_134265760621676117\pygame\mask.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\math.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\mixer.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\mixer_music.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\mouse.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\newbuffer.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\pixelarray.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\pixelcopy.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\portmidi.dll
%TEMP%\onefile_1764_134265760621676117\pygame\pygame_icon.bmp
%TEMP%\onefile_1764_134265760621676117\pygame\pypm.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\rect.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\rwobject.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\scrap.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\surface.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\surflock.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\time.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\transform.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\zlib1.dll
%TEMP%\onefile_1764_134265760621676117\pygame\_sdl2\audio.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\_sdl2\sdl2.pyd
%TEMP%\onefile_1764_134265760621676117\pygame\_sdl2\video.pyd
%LOCALAPPDATA%\microsoft\windows\coffin_fleet_wp.jpg
%LOCALAPPDATA%\microsoft\windows\coffin_fleet_deadline.json
%HOMEPATH%\desktop\coffin_768662.jpeg.fleet
%HOMEPATH%\desktop\coffin_230820.avi.fleet
%HOMEPATH%\desktop\coffin_133433.jpg.fleet
%HOMEPATH%\desktop\coffin_961224.jpeg.fleet
%HOMEPATH%\desktop\coffin_259279.jpg.fleet
%HOMEPATH%\desktop\coffin_727729.jpeg.fleet
%HOMEPATH%\desktop\coffin_716602.jpeg.fleet
%HOMEPATH%\desktop\coffin_628997.jpg.fleet
%HOMEPATH%\desktop\coffin_161111.ini.fleet
%HOMEPATH%\documents\coffin_128437.ini.fleet
%HOMEPATH%\videos\coffin_789861.ini.fleet
%HOMEPATH%\3d objects\coffin_146112.ini.fleet
%HOMEPATH%\music\coffin_141899.ini.fleet
%HOMEPATH%\pictures\camera roll\coffin_362415.ini.fleet
%HOMEPATH%\contacts\coffin_295314.ini.fleet
%HOMEPATH%\downloads\coffin_173580.ini.fleet
%HOMEPATH%\pictures\coffin_551398.ini.fleet
%HOMEPATH%\links\coffin_453960.ini.fleet
%HOMEPATH%\favorites\coffin_863659.ini.fleet
%HOMEPATH%\favorites\links\coffin_564845.ini.fleet
%HOMEPATH%\saved games\coffin_529016.ini.fleet
%LOCALAPPDATA%\google\chrome\application\coffin_269579.log.fleet
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\extensions\coffin_284635.json.fleet
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\coffin_464509.json.fleet
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\pepperflash\coffin_983163.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\coffin_218406.ico.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extension rules\coffin_268303.log.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\coffin_942762.js.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\coffin_738410.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extension state\coffin_489657.log.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\coffin_471407.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\coffin_470356.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\coffin_228944.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\coffin_405659.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\coffin_212589.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_us\coffin_733076.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\coffin_562968.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\coffin_481386.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_gb\coffin_607025.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\coffin_409485.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\coffin_787064.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\coffin_100419.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\coffin_453658.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\coffin_723578.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\coffin_422409.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\coffin_189679.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\coffin_511740.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\coffin_847682.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\coffin_215302.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\coffin_881305.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\coffin_844217.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\coffin_489210.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\coffin_549910.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\coffin_836584.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\coffin_980891.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\coffin_648226.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\coffin_817678.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\coffin_107769.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\coffin_322095.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\coffin_452111.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_pt\coffin_834512.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\coffin_641707.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_br\coffin_225805.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\coffin_709005.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\coffin_558012.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\coffin_861200.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\coffin_513967.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\coffin_957180.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\coffin_788439.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\coffin_864282.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\coffin_276889.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\coffin_792747.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\coffin_525599.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_cn\coffin_650351.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_tw\coffin_603758.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\coffin_565233.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\coffin_479434.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\coffin_291289.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\coffin_269903.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\coffin_944375.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\coffin_608046.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\coffin_391111.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\coffin_710821.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\coffin_177010.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\coffin_647384.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\coffin_744006.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\coffin_318446.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\coffin_968699.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\coffin_558235.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\coffin_862335.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\coffin_244604.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\coffin_385717.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\coffin_614206.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\coffin_646121.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\coffin_891936.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\coffin_733404.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\coffin_308188.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\coffin_438692.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\coffin_419399.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\coffin_799033.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\coffin_648548.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\coffin_262707.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_br\coffin_552402.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\coffin_730893.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\coffin_209432.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\coffin_313305.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\coffin_201173.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\coffin_292169.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\coffin_772034.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\coffin_187166.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\coffin_809799.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_pt\coffin_963826.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_cn\coffin_914790.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_tw\coffin_175709.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\coffin_153344.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\coffin_795706.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\coffin_452440.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\coffin_573667.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\coffin_364569.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\coffin_814716.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\coffin_381275.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\coffin_316672.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_gb\coffin_955034.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_us\coffin_703814.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\coffin_714845.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\coffin_119006.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\coffin_288777.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\coffin_235620.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\coffin_489141.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\coffin_586675.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\coffin_153122.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\coffin_421441.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\coffin_100581.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\coffin_231009.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\coffin_149587.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\coffin_431988.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\coffin_355553.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\coffin_591058.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\coffin_956966.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\coffin_872145.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\coffin_404098.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\coffin_871128.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\coffin_203874.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_pt\coffin_221645.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\coffin_344727.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\coffin_262784.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\coffin_274646.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\coffin_748154.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_br\coffin_795482.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\coffin_341623.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\coffin_641658.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\coffin_696493.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\coffin_835813.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\coffin_353211.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\coffin_389930.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\coffin_314941.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\coffin_162022.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_cn\coffin_973473.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_tw\coffin_785926.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\coffin_506803.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\coffin_625032.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\coffin_706984.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\coffin_537904.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\coffin_213269.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\coffin_871690.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\coffin_442814.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\coffin_708837.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\coffin_239113.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\coffin_630512.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\coffin_805670.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\coffin_544113.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\coffin_357994.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\coffin_332896.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\coffin_305336.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\coffin_452288.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\coffin_213532.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\coffin_899248.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\coffin_158562.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\coffin_369618.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\coffin_821684.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\coffin_122962.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\coffin_462234.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\coffin_734752.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\coffin_749057.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_br\coffin_833289.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_pt\coffin_896908.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\coffin_335665.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\coffin_100958.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\coffin_260240.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\coffin_604842.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\coffin_529634.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\coffin_460246.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\coffin_105944.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\coffin_447863.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_cn\coffin_326815.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\coffin_313944.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\coffin_534252.json.fleet
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_tw\coffin_278333.json.fleet
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\coffin_102508.log.fleet
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\coffin_323225.log.fleet
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\coffin_353188.log.fleet
%LOCALAPPDATA%\microsoft\internet explorer\coffin_750084.log.fleet
%LOCALAPPDATA%\microsoft\edge\user data\default\coffin_594625.ico.fleet
%LOCALAPPDATA%\microsoft\internet explorer\coffin_174750.txt.fleet
%LOCALAPPDATA%\microsoft\internet explorer\cachestorage\coffin_339047.log.fleet
%LOCALAPPDATA%\microsoft\internet explorer\cachestorage\coffin_625489.log.fleet
%LOCALAPPDATA%\microsoft\windows sidebar\coffin_899134.ini.fleet
%LOCALAPPDATA%\microsoft\internet explorer\coffin_989736.log.fleet
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\ac\microsoft\clr_v4.0\usagelogs\coffin_447864.log.fleet
%LOCALAPPDATA%\packages\microsoft.microsoftofficehub_8wekyb3d8bbwe\localcache\local\microsoft\clr_v4.0\usagelogs\coffin_976970.log.fleet
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\coffin_150410.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.photos_8wekyb3d8bbwe\localstate\coffin_170901.sqlite.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_220934.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_740084.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_209885.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_174923.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_296344.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_728470.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_259225.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_309575.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_835108.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_914251.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_664318.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_990547.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_427719.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_986520.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_683576.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_890743.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_558275.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_654773.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_847540.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_704341.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_910996.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_110670.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_122075.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_893709.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_281611.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_515489.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_497930.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\appdata\indexed db\coffin_918630.log.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\coffin_514117.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\coffin_542707.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\appdata\indexed db\coffin_882643.log.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\coffin_290932.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\coffin_814520.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\coffin_309560.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\coffin_774136.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\coffin_626549.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_321391.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_138257.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_312978.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_411849.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_577807.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\coffin_390790.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\coffin_116275.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\coffin_900486.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\coffin_847332.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\coffin_361511.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_977289.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\coffin_520130.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_815532.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_642903.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_269013.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_548313.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_846978.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_648191.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_455972.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_150777.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\coffin_945365.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_455838.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_528546.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_928620.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_561705.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_984916.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_758321.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_875348.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_104698.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_306861.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_868340.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_403967.txt.fleet
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\coffin_885609.txt.fleet
%LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\coffin_352624.txt.fleet
%TEMP%\onefile_1764_134265760621676117\jaraco\text\coffin_190178.txt.fleet
%APPDATA%\microsoft\internet explorer\quick launch\coffin_439702.ini.fleet
%APPDATA%\mozilla\firefox\coffin_389001.ini.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_361047.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_462629.json.fleet
%APPDATA%\mozilla\firefox\coffin_779901.ini.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_584418.ini.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_980909.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_441284.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_149620.json.fleet
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\coffin_578086.ini.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_793793.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_442560.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_618548.txt.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_224317.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_648943.txt.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_671047.js.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_282726.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_805939.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_323411.js.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_175819.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_820545.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\coffin_576473.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_894372.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\coffin_620255.json.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_802130.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\coffin_767671.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_917930.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\coffin_310917.json.fleet
%APPDATA%\opera software\opera stable\coffin_248191.log.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_742565.sqlite.fleet
%APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\coffin_171530.js.fleet
%APPDATA%\opera software\opera stable\coffin_395539.json.fleet
%APPDATA%\opera software\opera stable\coffin_511106.json.fleet
%APPDATA%\thunderbird\coffin_375522.ini.fleet
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_423193.sqlite.fleet
%APPDATA%\opera software\opera stable\extension state\coffin_278496.log.fleet
%APPDATA%\thunderbird\coffin_458446.ini.fleet
%APPDATA%\thunderbird\profiles\b376zl1q.default\coffin_125191.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_607442.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_388620.ini.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_834124.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_410368.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_528579.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_836589.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_961337.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_739091.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_910668.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_314891.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_848629.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_667778.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_883149.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_764672.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_226548.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_686413.txt.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_323438.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_415777.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_381594.sqlite.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_619262.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_414610.js.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_546645.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\coffin_190285.json.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\coffin_941902.json.fleet
%HOMEPATH%\searches\coffin_882044.ini.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_686094.sqlite.fleet
%HOMEPATH%\coffin_868369.ini.fleet
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\coffin_523353.sqlite.fleet
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\coffin_375289.7z.fleet

Sets the 'hidden' attribute to the following files

%APPDATA%\microsoft\windows\updateorchestrator\wudfrd.exe
%APPDATA%\microsoft\windows\start menu\programs\startup\winupdate_svc.bat

Deletes following files that it created itself

%TEMP%\onefile_1764_134265760621676117\jaraco\text\coffin_190178.txt
%TEMP%\onefile_1764_134265760621676117\pygame\coffin_459353.bmp
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_671047.js

Moves the following files

from %TEMP%\onefile_1764_134265760621676117\jaraco\text\lorem ipsum.txt to %TEMP%\onefile_1764_134265760621676117\jaraco\text\coffin_190178.txt
from %TEMP%\onefile_1764_134265760621676117\pygame\pygame_icon.bmp to %TEMP%\onefile_1764_134265760621676117\pygame\coffin_459353.bmp
from %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\coffin_439702.ini
from %APPDATA%\microsoft\office\recent\index.dat to %APPDATA%\microsoft\office\recent\coffin_341298.dat
from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\coffin_578086.ini
from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\coffin_779901.ini
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_361047.json
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\coffin_389001.ini
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_462629.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_584418.ini
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_980909.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_441284.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_149620.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_793793.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_442560.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_618548.txt
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_224317.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_671047.js
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_282726.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_648943.txt
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_805939.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_323411.js
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\coffin_175819.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\coffin_576473.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_802130.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\datareporting\coffin_620255.json
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\default\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\coffin_767671.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_820545.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_894372.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_742565.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_917930.sqlite
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\storage\permanent\chrome\idb\coffin_423193.sqlite
from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\times.json to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\coffin_310917.json
from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\coffin_171530.js
from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\coffin_248191.log
from %APPDATA%\opera software\opera stable\default_partner_content.json to %APPDATA%\opera software\opera stable\coffin_395539.json
from %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml to %APPDATA%\opera software\opera stable\dictionaries\coffin_658167.xml
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\coffin_375522.ini
from %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip to %APPDATA%\opera software\opera stable\themes_backup\coffin_776176.zip
from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\coffin_511106.json
from %APPDATA%\opera software\opera stable\extension state\000003.log to %APPDATA%\opera software\opera stable\extension state\coffin_278496.log
from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\coffin_667164.dat
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\coffin_458446.ini
from %APPDATA%\thunderbird\profiles\b376zl1q.default\times.json to %APPDATA%\thunderbird\profiles\b376zl1q.default\coffin_125191.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\addons.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_607442.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_410368.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_388620.ini
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cert9.db to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_236369.db
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_834124.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_910668.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_528579.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\extensions.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_836589.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_739091.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_883149.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_961337.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_314891.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_667778.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\key4.db to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_548701.db
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_848629.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\mailviews.dat to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_461723.dat
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_764672.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_226548.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_415777.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_686413.txt
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_414610.js
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_323438.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_381594.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\times.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_619262.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_546645.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\coffin_686094.sqlite
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\coffin_190285.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\datareporting\coffin_941902.json
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\coffin_523353.sqlite

Modifies the following files

%APPDATA%\microsoft\windows\themes\transcodedwallpaper
%APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%APPDATA%\microsoft\windows\updateorchestrator\wudfrd.exe'

Executes the following

'<SYSTEM32>\icacls.exe' %TEMP%\onefile_1764_134265760621676117\coffin_fleet_ransom.py /deny Everyone:(D,WDAC,WO)
'<SYSTEM32>\icacls.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\winupdate_svc.bat" /deny Everyone:(D,WDAC)
'<SYSTEM32>\schtasks.exe' /Create /F /SC ONLOGON /TN MicrosoftWindowsUpdateSvc /TR "\"%APPDATA%\Microsoft\Windows\UpdateOrchestrator\WudfRd.exe\" \"%TEMP%\onefile_1764_134265760621676117\coffin_fleet_ransom.py\"" /RL HI...
'<SYSTEM32>\schtasks.exe' /Change /TN MicrosoftWindowsUpdateSvc /DISABLE
'<SYSTEM32>\schtasks.exe' /Change /TN MicrosoftWindowsUpdateSvc /ENABLE
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -NonInteractive -Command "$acl = Get-Acl 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'; $deny = New-Object System.Security.AccessControl.RegistryAccessRule([System.S...
'<SYSTEM32>\icacls.exe' <SYSTEM32>\Tasks\MicrosoftWindowsUpdateSvc /deny Everyone:(D,W,WDAC)
'%APPDATA%\microsoft\windows\updateorchestrator\wudfrd.exe' ' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial