Trojan.Encoder.24261

Technical Information

Modifies file system:

Creates the following files:

%HOMEPATH%\Desktop\!READ ME!.txt
%HOMEPATH%\My Documents\!READ ME!.txt
%APPDATA%\Microsoft\Protect\CREDHIST
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7c19ac6101a4dd5db93399830e2304a0_23ef5514-3059-436f-a4a7-4cefaab20eb1

Deletes the following files:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7c19ac6101a4dd5db93399830e2304a0_23ef5514-3059-436f-a4a7-4cefaab20eb1

Moves the following system files:

from <SYSTEM32>\DirectX\Dinput\gr4005.png to <SYSTEM32>\DirectX\Dinput\gr4005_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ia3002_1.png to <SYSTEM32>\DirectX\Dinput\ia3002_1_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\gr4003.png to <SYSTEM32>\DirectX\Dinput\gr4003_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\gr4001.png to <SYSTEM32>\DirectX\Dinput\gr4001_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\gr4001_g.png to <SYSTEM32>\DirectX\Dinput\gr4001_g_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\lgc209.png to <SYSTEM32>\DirectX\Dinput\lgc209_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\lgc20a.png to <SYSTEM32>\DirectX\Dinput\lgc20a_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\lgc207.png to <SYSTEM32>\DirectX\Dinput\lgc207_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ia3002_2.png to <SYSTEM32>\DirectX\Dinput\ia3002_2_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\lgc202.png to <SYSTEM32>\DirectX\Dinput\lgc202_pna30bd112u11d.png
from <SYSTEM32>\config\systemprofile\Templates\excel.xls to <SYSTEM32>\config\systemprofile\Templates\excel_pna30bd112u11d.xls
from <SYSTEM32>\config\systemprofile\Templates\powerpnt.ppt to <SYSTEM32>\config\systemprofile\Templates\powerpnt_pna30bd112u11d.ppt
from <SYSTEM32>\wpa.dbl to <SYSTEM32>\wpa_pna30bd112u11d.dbl
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Remote_Assistance_Graphic.png to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Remote_Assistance_Graphic_pna30bd112u11d.png
from <SYSTEM32>\setup.bmp to <SYSTEM32>\setup_pna30bd112u11d.bmp
from <SYSTEM32>\DirectX\Dinput\glmdiggp.png to <SYSTEM32>\DirectX\Dinput\glmdiggp_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\gr3001.png to <SYSTEM32>\DirectX\Dinput\gr3001_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\glmda.png to <SYSTEM32>\DirectX\Dinput\glmda_pna30bd112u11d.png
from <SYSTEM32>\config\systemprofile\Templates\winword.doc to <SYSTEM32>\config\systemprofile\Templates\winword_pna30bd112u11d.doc
from <SYSTEM32>\DirectX\Dinput\act_rs.png to <SYSTEM32>\DirectX\Dinput\act_rs_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\lgc291.png to <SYSTEM32>\DirectX\Dinput\lgc291_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms3b_2.png to <SYSTEM32>\DirectX\Dinput\ms3b_2_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms3b_3.png to <SYSTEM32>\DirectX\Dinput\ms3b_3_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms3b_1.png to <SYSTEM32>\DirectX\Dinput\ms3b_1_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms34_02.png to <SYSTEM32>\DirectX\Dinput\ms34_02_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms3b.png to <SYSTEM32>\DirectX\Dinput\ms3b_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms3b_m.png to <SYSTEM32>\DirectX\Dinput\ms3b_m_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms3b_t.png to <SYSTEM32>\DirectX\Dinput\ms3b_t_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms3b_c.png to <SYSTEM32>\DirectX\Dinput\ms3b_c_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms3b_4.png to <SYSTEM32>\DirectX\Dinput\ms3b_4_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms3b_a.png to <SYSTEM32>\DirectX\Dinput\ms3b_a_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms26_01.png to <SYSTEM32>\DirectX\Dinput\ms26_01_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms27.png to <SYSTEM32>\DirectX\Dinput\ms27_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms26.png to <SYSTEM32>\DirectX\Dinput\ms26_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms1b.png to <SYSTEM32>\DirectX\Dinput\ms1b_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms1b_01.png to <SYSTEM32>\DirectX\Dinput\ms1b_01_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms34.png to <SYSTEM32>\DirectX\Dinput\ms34_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms34_01.png to <SYSTEM32>\DirectX\Dinput\ms34_01_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms28_8.png to <SYSTEM32>\DirectX\Dinput\ms28_8_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms27_1.png to <SYSTEM32>\DirectX\Dinput\ms27_1_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms28.png to <SYSTEM32>\DirectX\Dinput\ms28_pna30bd112u11d.png
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl_pna30bd112u11d.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula_pna30bd112u11d.rtf
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_04.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_04_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_02.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_02_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg to %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe_pna30bd112u11d.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula_pna30bd112u11d.rtf
from %WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp to %WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\images\32x32\logo.bmp to %WINDIR%\pchealth\helpctr\System\images\32x32\logo_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown_pna30bd112u11d.bmp
from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover_pna30bd112u11d.bmp
from <SYSTEM32>\DirectX\Dinput\ms56.png to <SYSTEM32>\DirectX\Dinput\ms56_pna30bd112u11d.png
from <SYSTEM32>\oobe\images\skipup.jpg to <SYSTEM32>\oobe\images\skipup_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\thanks10.png to <SYSTEM32>\oobe\images\thanks10_pna30bd112u11d.png
from <SYSTEM32>\oobe\images\skipover.jpg to <SYSTEM32>\oobe\images\skipover_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\skipdown.jpg to <SYSTEM32>\oobe\images\skipdown_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\skipoff.jpg to <SYSTEM32>\oobe\images\skipoff_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\wpaflag.jpg to <SYSTEM32>\oobe\images\wpaflag_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\wpakey.jpg to <SYSTEM32>\oobe\images\wpakey_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\wpabtm.jpg to <SYSTEM32>\oobe\images\wpabtm_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\thanks8.png to <SYSTEM32>\oobe\images\thanks8_pna30bd112u11d.png
from <SYSTEM32>\oobe\images\wpaback.jpg to <SYSTEM32>\oobe\images\wpaback_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\newtop1.jpg to <SYSTEM32>\oobe\images\newtop1_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\newtop8.jpg to <SYSTEM32>\oobe\images\newtop8_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\newmark8.jpg to <SYSTEM32>\oobe\images\newmark8_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\newbtm8.jpg to <SYSTEM32>\oobe\images\newbtm8_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\newmark1.jpg to <SYSTEM32>\oobe\images\newmark1_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\nextup.jpg to <SYSTEM32>\oobe\images\nextup_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\oemcoa.jpg to <SYSTEM32>\oobe\images\oemcoa_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\nextover.jpg to <SYSTEM32>\oobe\images\nextover_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\nextdown.jpg to <SYSTEM32>\oobe\images\nextdown_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\nextoff.jpg to <SYSTEM32>\oobe\images\nextoff_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\wpatop.jpg to <SYSTEM32>\oobe\images\wpatop_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Red moon desert.jpg to %WINDIR%\Web\Wallpaper\Red moon desert_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Ripple.jpg to %WINDIR%\Web\Wallpaper\Ripple_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Radiance.jpg to %WINDIR%\Web\Wallpaper\Radiance_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Power.jpg to %WINDIR%\Web\Wallpaper\Power_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Purple flower.jpg to %WINDIR%\Web\Wallpaper\Purple flower_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Wind.jpg to %WINDIR%\Web\Wallpaper\Wind_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Windows XP.jpg to %WINDIR%\Web\Wallpaper\Windows XP_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Vortec space.jpg to %WINDIR%\Web\Wallpaper\Vortec space_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Stonehenge.jpg to %WINDIR%\Web\Wallpaper\Stonehenge_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Tulips.jpg to %WINDIR%\Web\Wallpaper\Tulips_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Bliss.bmp to %WINDIR%\Web\Wallpaper\Bliss_pna30bd112u11d.bmp
from %WINDIR%\Web\Wallpaper\Crystal.jpg to %WINDIR%\Web\Wallpaper\Crystal_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Azul.jpg to %WINDIR%\Web\Wallpaper\Azul_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Ascent.jpg to %WINDIR%\Web\Wallpaper\Ascent_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Autumn.jpg to %WINDIR%\Web\Wallpaper\Autumn_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Moon flower.jpg to %WINDIR%\Web\Wallpaper\Moon flower_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Peace.jpg to %WINDIR%\Web\Wallpaper\Peace_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Home.jpg to %WINDIR%\Web\Wallpaper\Home_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Follow.jpg to %WINDIR%\Web\Wallpaper\Follow_pna30bd112u11d.jpg
from %WINDIR%\Web\Wallpaper\Friend.jpg to %WINDIR%\Web\Wallpaper\Friend_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\newbtm1.jpg to <SYSTEM32>\oobe\images\newbtm1_pna30bd112u11d.jpg
from <SYSTEM32>\DirectX\Dinput\SV-262e1.png to <SYSTEM32>\DirectX\Dinput\SV-262e1_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\SV-262e3.png to <SYSTEM32>\DirectX\Dinput\SV-262e3_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\msprw_2.png to <SYSTEM32>\DirectX\Dinput\msprw_2_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\msprw.png to <SYSTEM32>\DirectX\Dinput\msprw_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\msprw_1.png to <SYSTEM32>\DirectX\Dinput\msprw_1_pna30bd112u11d.png
from <SYSTEM32>\ias\dnary.mdb to <SYSTEM32>\ias\dnary_pna30bd112u11d.mdb
from <SYSTEM32>\ias\ias.mdb to <SYSTEM32>\ias\ias_pna30bd112u11d.mdb
from <SYSTEM32>\DirectX\Dinput\sv2512.png to <SYSTEM32>\DirectX\Dinput\sv2512_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\SV-262e4.png to <SYSTEM32>\DirectX\Dinput\SV-262e4_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\sv2511.png to <SYSTEM32>\DirectX\Dinput\sv2511_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms7.png to <SYSTEM32>\DirectX\Dinput\ms7_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms7_1.png to <SYSTEM32>\DirectX\Dinput\ms7_1_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms6_9.png to <SYSTEM32>\DirectX\Dinput\ms6_9_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms56_1.png to <SYSTEM32>\DirectX\Dinput\ms56_1_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms6.png to <SYSTEM32>\DirectX\Dinput\ms6_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\mse_1.png to <SYSTEM32>\DirectX\Dinput\mse_1_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\msf1f.png to <SYSTEM32>\DirectX\Dinput\msf1f_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\mse.png to <SYSTEM32>\DirectX\Dinput\mse_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms8.png to <SYSTEM32>\DirectX\Dinput\ms8_pna30bd112u11d.png
from <SYSTEM32>\DirectX\Dinput\ms8_1.png to <SYSTEM32>\DirectX\Dinput\ms8_1_pna30bd112u11d.png
from <SYSTEM32>\oobe\html\mouse\images\bulzano.jpg to <SYSTEM32>\oobe\html\mouse\images\bulzano_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\verona.jpg to <SYSTEM32>\oobe\html\mouse\images\verona_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\veronam.jpg to <SYSTEM32>\oobe\html\mouse\images\veronam_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\venicem.jpg to <SYSTEM32>\oobe\html\mouse\images\venicem_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg to <SYSTEM32>\oobe\html\mouse\images\tyrolm_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\venice.jpg to <SYSTEM32>\oobe\html\mouse\images\venice_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\backup.jpg to <SYSTEM32>\oobe\images\backup_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\mslogo.jpg to <SYSTEM32>\oobe\images\mslogo_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\backover.jpg to <SYSTEM32>\oobe\images\backover_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\backdown.jpg to <SYSTEM32>\oobe\images\backdown_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\images\backoff.jpg to <SYSTEM32>\oobe\images\backoff_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\paris.jpg to <SYSTEM32>\oobe\html\mouse\images\paris_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\parism.jpg to <SYSTEM32>\oobe\html\mouse\images\parism_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg to <SYSTEM32>\oobe\html\mouse\images\heidelbm_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg to <SYSTEM32>\oobe\html\mouse\images\bulzanom_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\heidelb.jpg to <SYSTEM32>\oobe\html\mouse\images\heidelb_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\praguem.jpg to <SYSTEM32>\oobe\html\mouse\images\praguem_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\tyrol.jpg to <SYSTEM32>\oobe\html\mouse\images\tyrol_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\prague.jpg to <SYSTEM32>\oobe\html\mouse\images\prague_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\pisa.jpg to <SYSTEM32>\oobe\html\mouse\images\pisa_pna30bd112u11d.jpg
from <SYSTEM32>\oobe\html\mouse\images\pisam.jpg to <SYSTEM32>\oobe\html\mouse\images\pisam_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img123.jpg to %WINDIR%\Help\Tours\htmlTour\img123_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img126.jpg to %WINDIR%\Help\Tours\htmlTour\img126_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img121.jpg to %WINDIR%\Help\Tours\htmlTour\img121_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img110.jpg to %WINDIR%\Help\Tours\htmlTour\img110_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img116.jpg to %WINDIR%\Help\Tours\htmlTour\img116_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\logo.jpg to %WINDIR%\Help\Tours\htmlTour\logo_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg to %WINDIR%\Help\Tours\htmlTour\pen_icon_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg to %WINDIR%\Help\Tours\htmlTour\intro_logo_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img136.jpg to %WINDIR%\Help\Tours\htmlTour\img136_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img149.jpg to %WINDIR%\Help\Tours\htmlTour\img149_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img068.jpg to %WINDIR%\Help\Tours\htmlTour\img068_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img072.jpg to %WINDIR%\Help\Tours\htmlTour\img072_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img060.jpg to %WINDIR%\Help\Tours\htmlTour\img060_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img040.jpg to %WINDIR%\Help\Tours\htmlTour\img040_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img046.jpg to %WINDIR%\Help\Tours\htmlTour\img046_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img103.jpg to %WINDIR%\Help\Tours\htmlTour\img103_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img109.jpg to %WINDIR%\Help\Tours\htmlTour\img109_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img100.jpg to %WINDIR%\Help\Tours\htmlTour\img100_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img074a.jpg to %WINDIR%\Help\Tours\htmlTour\img074a_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img089.jpg to %WINDIR%\Help\Tours\htmlTour\img089_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\question_icon.jpg to %WINDIR%\Help\Tours\htmlTour\question_icon_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg to %WINDIR%\Help\Tours\htmlTour\taskbar_up_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg to %WINDIR%\Help\Tours\htmlTour\ul_logo_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\start_up.jpg to %WINDIR%\Help\Tours\htmlTour\start_up_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img034.jpg to %WINDIR%\Help\Tours\htmlTour\img034_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\best_robust.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\best_road.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_data.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\best_secure.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_pna30bd112u11d.jpg
from %WINDIR%\Greenstone.bmp to %WINDIR%\Greenstone_pna30bd112u11d.bmp
from %WINDIR%\Prairie Wind.bmp to %WINDIR%\Prairie Wind_pna30bd112u11d.bmp
from %WINDIR%\Gone Fishing.bmp to %WINDIR%\Gone Fishing_pna30bd112u11d.bmp
from %WINDIR%\Coffee Bean.bmp to %WINDIR%\Coffee Bean_pna30bd112u11d.bmp
from %WINDIR%\FeatherTexture.bmp to %WINDIR%\FeatherTexture_pna30bd112u11d.bmp
from %WINDIR%\Soap Bubbles.bmp to %WINDIR%\Soap Bubbles_pna30bd112u11d.bmp
from %WINDIR%\Zapotec.bmp to %WINDIR%\Zapotec_pna30bd112u11d.bmp
from %WINDIR%\Santa Fe Stucco.bmp to %WINDIR%\Santa Fe Stucco_pna30bd112u11d.bmp
from %WINDIR%\Rhododendron.bmp to %WINDIR%\Rhododendron_pna30bd112u11d.bmp
from %WINDIR%\River Sumida.bmp to %WINDIR%\River Sumida_pna30bd112u11d.bmp
from %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\end_up.jpg to %WINDIR%\Help\Tours\htmlTour\end_up_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\folder_up.jpg to %WINDIR%\Help\Tours\htmlTour\folder_up_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg to %WINDIR%\Help\Tours\htmlTour\desktop_up_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\control_up.jpg to %WINDIR%\Help\Tours\htmlTour\control_up_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg to %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img033.jpg to %WINDIR%\Help\Tours\htmlTour\img033_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img033a.jpg to %WINDIR%\Help\Tours\htmlTour\img033a_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img014.jpg to %WINDIR%\Help\Tours\htmlTour\img014_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\icon_up.jpg to %WINDIR%\Help\Tours\htmlTour\icon_up_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\img004b.jpg to %WINDIR%\Help\Tours\htmlTour\img004b_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_big_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost_pna30bd112u11d.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost_pna30bd112u11d.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Xaml.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Xaml_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo_pna30bd112u11d.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.WinFx.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.WinFx_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.NETFramework.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.NETFramework_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen_pna30bd112u11d.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark_pna30bd112u11d.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header_pna30bd112u11d.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD_pna30bd112u11d.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat_pna30bd112u11d.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header_pna30bd112u11d.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen_pna30bd112u11d.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark_pna30bd112u11d.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\SqlServer.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\SqlServer_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.WinFx.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.WinFx_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.CSharp_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.VisualBasic_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common_pna30bd112u11d.targets
from %WINDIR%\Help\Tours\htmlTour\window_up.jpg to %WINDIR%\Help\Tours\htmlTour\window_up_pna30bd112u11d.jpg
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat_pna30bd112u11d.jpg
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.Common_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD_pna30bd112u11d.jpg
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.WinFX.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.WinFX_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo_pna30bd112u11d.jpg
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.CSharp_pna30bd112u11d.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo_pna30bd112u11d.bmp
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041_pna30bd112u11d.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042_pna30bd112u11d.rtf

Moves the following files:

from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\key-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\key-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\themeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\themeGeneric_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\Filepicker.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\Filepicker_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\downloadButtons_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-error_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\localeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\localeGeneric_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-warning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-warning_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-info-negative.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-info-negative_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-48_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-48_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\find.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\find_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\autoscroll.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\autoscroll_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-toolbar.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-toolbar_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\close.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\close_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\blacklist_large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\blacklist_large_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\media\throbber.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\media\throbber_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\windowControls.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\windowControls_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\alerticon-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\alerticon-error_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\downloadButtons_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\sslWarning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\sslWarning_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Question.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Question_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-large_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-themes.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-themes_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-searchengines.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-searchengines_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\heart.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\heart_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\discover-logo.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\discover-logo_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-languages.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-languages_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-available.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-available_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-search.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-search_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-recent.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-recent_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\themeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\themeGeneric_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-warning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-warning_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\update\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\update\downloadButtons_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\key-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\key-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\localeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\localeGeneric_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\heart.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\heart_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-info-negative.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-info-negative_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-error_pna30bd112u11d.png
from %ProgramFiles%\Movie Maker\Shared\Sample2.jpg to %ProgramFiles%\Movie Maker\Shared\Sample2_pna30bd112u11d.jpg
from %ProgramFiles%\Movie Maker\Shared\Sample1.jpg to %ProgramFiles%\Movie Maker\Shared\Sample1_pna30bd112u11d.jpg
from %ProgramFiles%\Windows NT\Pinball\table.bmp to %ProgramFiles%\Windows NT\Pinball\table_pna30bd112u11d.bmp
from %ProgramFiles%\Windows Media Player\npds.zip to %ProgramFiles%\Windows Media Player\npds_pna30bd112u11d.zip
from %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\preview.png to %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\preview_pna30bd112u11d.png
from %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png to %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon_pna30bd112u11d.png
from %ProgramFiles%\Movie Maker\Shared\paint.png to %ProgramFiles%\Movie Maker\Shared\paint_pna30bd112u11d.png
from %ProgramFiles%\Movie Maker\Shared\news.png to %ProgramFiles%\Movie Maker\Shared\news_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\sslWarning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\sslWarning_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\windowControls.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\windowControls_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-large_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\loading_16.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\loading_16_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-48_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-searchengines.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-searchengines_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-search.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-search_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\discover-logo.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\discover-logo_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-themes.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-themes_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\downloadButtons_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\media\throbber.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\media\throbber_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-languages.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-languages_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\alerticon-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\alerticon-error_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-bg.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-bg_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-32.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-32_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Toolbar.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Toolbar_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-throbber.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-throbber_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor_16-10.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor_16-10_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Privacy-48.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Privacy-48_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\pageInfo.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\pageInfo_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\loading.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\loading_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\connecting.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\connecting_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\appmenu-icons.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\appmenu-icons_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\tabDragIndicator.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\tabDragIndicator_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\searching_16.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\searching_16_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\libraryNavigation.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\libraryNavigation_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options-sync.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options-sync_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\about.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\about_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\about-wordmark.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\about-wordmark_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\icon48.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\icon48_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\icon128.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\icon128_pna30bd112u11d.png
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3_pna30bd112u11d.db
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8_pna30bd112u11d.db
from %ProgramFiles%\FireFox\chrome\browser\content\branding\about-logo.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\about-logo_pna30bd112u11d.png
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod_pna30bd112u11d.db
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\appmenu-icons.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\appmenu-icons_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-widget-left.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-widget-left_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\identity.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\identity_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Geolocation-64.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Geolocation-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon-small.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon-small_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\icon64.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\icon64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-icon.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-icon_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\blacklist_large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\blacklist_large_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\autoscroll.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\autoscroll_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-48_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\close.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\close_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\tabDragIndicator.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\tabDragIndicator_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\loading.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\loading_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-toolbar.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-toolbar_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\Filepicker.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\Filepicker_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\loading_16.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\loading_16_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-48_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Error_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-48_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-32.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-32_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Privacy-48.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Privacy-48_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\pageInfo.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\pageInfo_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-bg.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-bg_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-32.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-32_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\identity.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\identity_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Geolocation-64.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Geolocation-64_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor_16-10.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor_16-10_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options-sync.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options-sync_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\searching_16.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\searching_16_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\connecting.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\connecting_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Toolbar.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Toolbar_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-throbber.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-throbber_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryToolbar.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryToolbar_pna30bd112u11d.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryNavigation.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryNavigation_pna30bd112u11d.png

Modifies user data files (Trojan.Encoder).

Miscellaneous:

Executes the following:

'<SYSTEM32>\net.exe' view
'<SYSTEM32>\cmd.exe' /C net view

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial