Trojan.Encoder.24249

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Encrypter_074' = '%APPDATA%\info.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'userinfo' = '%APPDATA%\recovery.txt'

Creates or modifies the following files:

%WINDIR%\win.ini
%HOMEPATH%\Start Menu\Programs\Startup\How Recovery Files.txt
%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
%HOMEPATH%\Start Menu\Programs\Startup\desktop.ini
%WINDIR%\Tasks\How Recovery Files.txt
%WINDIR%\Tasks\SA.DAT

Changes the following executable system files:

%WINDIR%\XXInstall\vminstall.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
%WINDIR%\twunk_32.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
%WINDIR%\vmmreg32.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
%WINDIR%\TASKMAN.EXE
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
%WINDIR%\twain_32\wiatwain.ds
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
%WINDIR%\twain_32.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll
%WINDIR%\XXInstall\devcon.exe
%WINDIR%\XXInstall\events.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll
%WINDIR%\XXInstall\exdir.exe
%WINDIR%\XXInstall\hashdeep.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll
%WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcirt.dll
%WINDIR%\XXInstall\ps.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
%WINDIR%\winhlp32.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
%WINDIR%\XXInstall\screen.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
%WINDIR%\XXInstall\Scripts\antivm.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll
%WINDIR%\XXInstall\cmdow.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll

Infects the following executable files:

<STUBS_DIR>\test.exe
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll
C:\Far2\Plugins\FTP\lib\ftpDirList.fll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll
<ANALYSETOOLS_DIR>\XueTr_Cmd\XueTr.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
<ANALYSETOOLS_DIR>\XueTr_Cmd\XueTrCmd.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll
<ANALYSETOOLS_DIR>\XueTr_Cmd\PCHunter64.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll
<ANALYSE_DIR>\muldrop.sys
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll
<ANALYSE_DIR>\dwshield.sys
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll
<ANALYSE_DIR>\muldrop_dbg.sys
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll
<ANALYSETOOLS_DIR>\XueTr_Cmd\XueTrSDK.sys
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll
C:\Far2\Plugins\FileCase\FileCase.dll
C:\Far2\Plugins\FarCmds\FARCmds.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll
<ANALYSETOOLS_DIR>\XueTr_Cmd\XueTrCmdOrig.exe
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll
C:\Far2\Plugins\FTP\FarFtp.dll
C:\Far2\Plugins\FTP\lib\ftpProgress.fll
%ProgramFiles%\Windows Media Player\setup_wm.exe
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll
C:\Far2\Plugins\Colorer\bin\colorer.dll
C:\Far2\Plugins\Brackets\Brackets.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll
<ANALYSETOOLS_DIR>\STracer\SimplyTracer.exe
%ProgramFiles%\Outlook Express\wabmig.exe
%ProgramFiles%\Outlook Express\wabimp.dll
%ProgramFiles%\Outlook Express\wabfind.dll
%ProgramFiles%\Outlook Express\wab.exe
%ProgramFiles%\Outlook Express\setup50.exe
%ProgramFiles%\Outlook Express\oemiglib.dll
%ProgramFiles%\Outlook Express\oemig50.exe
<ANALYSETOOLS_DIR>\STracer\ollyext.dll
%ProgramFiles%\Outlook Express\oeimport.dll
%ProgramFiles%\Outlook Express\msoeres.dll
%ProgramFiles%\Outlook Express\msoe.dll
%ProgramFiles%\Outlook Express\msimn.exe
%ProgramFiles%\NetMeeting\wb32.exe
%ProgramFiles%\NetMeeting\rrcm.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll
C:\Far2\Plugins\ExtSearch\esearch.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll
C:\Far2\Plugins\EditCase\EditCase.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll
<ANALYSER.EXE>.3
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll
<ANALYSER.EXE>.2
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll
<ANALYSER.EXE>.1
C:\Far2\Plugins\EMenu\EMenu.dll
C:\Far2\Plugins\DrawLine\DrawLine.dll
<ANALYSETOOLS_DIR>\XueTr_Cmd\PCHunter32.exe
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll
C:\Far2\Plugins\Compare\Compare.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll
<ANALYSE_DIR>\_kdump.sys_
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
C:\Far2\FExcept\FExcept.dll
C:\Far2\FExcept\ExcDump.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
C:\Far2\FExcept\demangle32.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
%WINDIR%\XXInstall\Scripts\antivm.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
%ProgramFiles%\Windows NT\Pinball\PINBALL.EXE
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
C:\Far2\Plugins\TmpPanel\TmpPanel.dll
C:\Far2\Far.exe
%ProgramFiles%\Windows NT\hypertrm.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
C:\Far2\Plugins\WinSCP\WinSCP.dll
%ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
%WINDIR%\winhlp32.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll
%WINDIR%\XXInstall\screen.exe
%WINDIR%\XXInstall\ps.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll
%WINDIR%\XXInstall\vminstall.exe
%WINDIR%\XXInstall\hashdeep.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll
%WINDIR%\XXInstall\events.exe
%WINDIR%\XXInstall\devcon.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcirt.dll
%WINDIR%\XXInstall\cmdow.exe
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
%WINDIR%\XXInstall\exdir.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
%WINDIR%\twain_32.dll
%ProgramFiles%\Windows Media Player\npdsplay.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
%WINDIR%\twain_32\wiatwain.ds
%ProgramFiles%\Windows Media Player\npdrmv2.dll
%ProgramFiles%\Windows Media Player\mpvis.dll
C:\Far2\Plugins\Network\Network.dll
%ProgramFiles%\Windows Media Player\mplayer2.exe
C:\Far2\Plugins\MacroView\MacroView.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
%ProgramFiles%\Windows Media Player\migrate.exe
%ProgramFiles%\Windows Media Player\custsat.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll
%WINDIR%\TASKMAN.EXE
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll
C:\Far2\Plugins\HlfViewer\HlfViewer.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll
%ProgramFiles%\Windows NT\htrn_jis.dll
%ProgramFiles%\Windows Media Player\npwmsdrm.dll
%ProgramFiles%\Windows NT\dialer.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
%WINDIR%\vmmreg32.dll
%ProgramFiles%\Windows NT\Accessories\write.wpc
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
%ProgramFiles%\Windows NT\Accessories\wordpad.exe
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
%ProgramFiles%\Windows NT\Accessories\mswrd8.wpc
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
%ProgramFiles%\Windows NT\Accessories\mswrd6.wpc
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
%ProgramFiles%\Windows Media Player\wmpns.dll
%ProgramFiles%\Windows Media Player\wmplayer.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
%ProgramFiles%\Windows Media Player\wmpband.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
%WINDIR%\twunk_32.exe
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
C:\Far2\Plugins\ProcList\Proclist.dll
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
%ProgramFiles%\NetMeeting\nmwb.dll

Malicious functions:

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Modifies file system:

Creates the following files:

%TEMP%\M15XoD
%HOMEPATH%\My Documents\How Recovery Files.txt
<ANALYSE_DIR>\PET-DUMP\0B4C_pet_cmd.exe
<ANALYSETOOLS_DIR>\XueTr_Cmd\How Recovery Files.txt
<ANALYSE_DIR>\PET-DUMP\How Recovery Files.txt
C:\Far2\Addons\SetUp\How Recovery Files.txt
%HOMEPATH%\My Documents\My Music\How Recovery Files.txt
C:\Far2\Plugins\FileCase\How Recovery Files.txt
%HOMEPATH%\My Documents\My Pictures\How Recovery Files.txt
%HOMEPATH%\Favorites\How Recovery Files.txt
C:\Far2\Plugins\FarCmds\How Recovery Files.txt
%HOMEPATH%\How Recovery Files.txt
<ANALYSE_DIR>\How Recovery Files.txt
C:\Far2\Addons\XLat\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\How Recovery Files.txt
C:\Far2\Plugins\FTP\lib\How Recovery Files.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\How Recovery Files.txt
%WINDIR%\Temp\How Recovery Files.txt
C:\Far2\Addons\Shell\How Recovery Files.txt
%HOMEPATH%\Local Settings\<INETFILES>\How Recovery Files.txt
<ANALYSE_DIR>\PET-DUMP\0B44_pet_vssadmin.exe
%HOMEPATH%\Favorites\Links\How Recovery Files.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\How Recovery Files.txt
<LS_APPDATA>\VMware\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\How Recovery Files.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\How Recovery Files.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\How Recovery Files.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\How Recovery Files.txt
%HOMEPATH%\Local Settings\How Recovery Files.txt
%TEMP%\How Recovery Files.txt
<APATH_DUMPS_DIR>\How Recovery Files.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\How Recovery Files.txt
C:\Far2\Plugins\ExtSearch\sources\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\How Recovery Files.txt
%APPDATA%\Mozilla\Firefox\How Recovery Files.txt
%APPDATA%\How Recovery Files.txt
%HOMEPATH%\Cookies\How Recovery Files.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\How Recovery Files.txt
<ANALYSE_DIR>\PET-DUMP\0B14_pet_<File name>.exe
C:\Far2\Addons\Macros\How Recovery Files.txt
C:\Far2\Addons\How Recovery Files.txt
C:\Far2\Addons\XLat\Russian\How Recovery Files.txt
%HOMEPATH%\Local Settings\History\History.IE5\How Recovery Files.txt
%HOMEPATH%\Recent\How Recovery Files.txt
C:\Far2\Plugins\HlfViewer\How Recovery Files.txt
%HOMEPATH%\Start Menu\Programs\How Recovery Files.txt
C:\Far2\FExcept\How Recovery Files.txt
C:\Far2\PluginSDK\Headers.pas\How Recovery Files.txt
C:\Far2\Plugins\WinSCP\How Recovery Files.txt
C:\Far2\How Recovery Files.txt
%HOMEPATH%\Templates\How Recovery Files.txt
C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_0
C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_1
%WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\How Recovery Files.txt
C:\Muldrop\dmp_0x14c_0x10000
C:\Muldrop\dmp_0x14c_0x30000
C:\Muldrop\dmp_0x198_0x10000
C:\Muldrop\dmp_0x198_0x20000
C:\Muldrop\dmp_0x198_0x30000
C:\Muldrop\dmp_0x1a4_0x10000
C:\Muldrop\dmp_0x1a4_0x20000
C:\Muldrop\dmp_0x1a4_0x30000
C:\Muldrop\dmp_0x1a8_0x10000
C:\Muldrop\dmp_0x14c_0x20000
C:\Far2\PluginSDK\Headers.c\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\How Recovery Files.txt
C:\Far2\Plugins\TmpPanel\How Recovery Files.txt
C:\Far2\Plugins\FTP\How Recovery Files.txt
C:\Far2\Plugins\Network\How Recovery Files.txt
%WINDIR%\twain_32\How Recovery Files.txt
%HOMEPATH%\SendTo\How Recovery Files.txt
C:\Far2\Documentation\eng\How Recovery Files.txt
%ProgramFiles%\Windows Media Player\Skins\How Recovery Files.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\How Recovery Files.txt
%HOMEPATH%\Start Menu\How Recovery Files.txt
C:\Far2\Plugins\ProcList\How Recovery Files.txt
%ProgramFiles%\Windows Media Player\How Recovery Files.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\How Recovery Files.txt
%ProgramFiles%\Windows NT\Accessories\How Recovery Files.txt
C:\Far2\Documentation\rus\How Recovery Files.txt
C:\Far2\Encyclopedia\How Recovery Files.txt
%ProgramFiles%\Windows NT\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\How Recovery Files.txt
%HOMEPATH%\Start Menu\Programs\Accessories\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\How Recovery Files.txt
%WINDIR%\Web\printers\images\How Recovery Files.txt
C:\Far2\Plugins\MacroView\How Recovery Files.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\How Recovery Files.txt
<LS_APPDATA>\Microsoft\Media Player\How Recovery Files.txt
C:\Documents and Settings\NetworkService\Local Settings\How Recovery Files.txt
C:\Far2\Addons\Colors\Default Highlighting\How Recovery Files.txt
C:\Far2\Plugins\Colorer\bin\How Recovery Files.txt
C:\Far2\Plugins\Brackets\How Recovery Files.txt
C:\Far2\Plugins\Colorer\hrc\auto\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00630000.alloc
C:\Documents and Settings\NetworkService\Local Settings\History\How Recovery Files.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\How Recovery Files.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00520000.alloc
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00930000.alloc
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\How Recovery Files.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\How Recovery Files.txt
C:\Far2\Plugins\Colorer\hrc\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00990000.alloc
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\How Recovery Files.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\How Recovery Files.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\How Recovery Files.txt
%ProgramFiles%\MSN\MSNCoreFiles\Install\How Recovery Files.txt
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\How Recovery Files.txt
%ProgramFiles%\NetMeeting\How Recovery Files.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00330000.alloc
%ProgramFiles%\Online Services\How Recovery Files.txt
C:\Far2\Plugins\AutoWrap\How Recovery Files.txt
<ANALYSETOOLS_DIR>\THP\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00380000.alloc
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\How Recovery Files.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00390000.alloc
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003A0000.alloc
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\How Recovery Files.txt
%ProgramFiles%\Outlook Express\How Recovery Files.txt
<ANALYSETOOLS_DIR>\THP\www\How Recovery Files.txt
<ANALYSETOOLS_DIR>\STracer\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003B0000.alloc
C:\Documents and Settings\LocalService\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00450000.alloc
C:\Far2\Plugins\Colorer\hrd\How Recovery Files.txt
C:\Far2\Addons\Colors\How Recovery Files.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00A80000.alloc
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00B60000.alloc
C:\Far2\Plugins\ExtSearch\How Recovery Files.txt
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\How Recovery Files.txt
C:\Far2\Plugins\EMenu\How Recovery Files.txt
C:\Far2\Plugins\EditCase\How Recovery Files.txt
C:\Far2\Plugins\ExtSearch\doc\How Recovery Files.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\How Recovery Files.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\How Recovery Files.txt
<ANALYSE_DIR>\DWS-DUMP\0B14_dws_<File name>.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\How Recovery Files.txt
<ANALYSE_DIR>\DWS-DUMP\0B44_dws_vssadmin.exe
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\How Recovery Files.txt
<ANALYSE_DIR>\DWS-DUMP\0B4C_dws_cmd.exe
<LS_APPDATA>\How Recovery Files.txt
<ANALYSE_DIR>\DWS-DUMP\How Recovery Files.txt
C:\Far2\Plugins\ExtSearch\keys\How Recovery Files.txt
%HOMEPATH%\Local Settings\History\How Recovery Files.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\How Recovery Files.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\How Recovery Files.txt
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\How Recovery Files.txt
C:\Far2\Plugins\DrawLine\How Recovery Files.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFE0000.alloc
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\How Recovery Files.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\How Recovery Files.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\How Recovery Files.txt
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\How Recovery Files.txt
%WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\How Recovery Files.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\How Recovery Files.txt
%WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\How Recovery Files.txt
C:\Documents and Settings\NetworkService\How Recovery Files.txt
C:\Far2\Plugins\Colorer\hrd\console\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7F6F0000.alloc
%APPDATA%\Microsoft\Address Book\How Recovery Files.txt
C:\Far2\Plugins\Compare\How Recovery Files.txt
C:\Far2\Plugins\Colorer\How Recovery Files.txt
%APPDATA%\Microsoft\Internet Explorer\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFB0000.alloc
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFD5000.alloc
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFDF000.alloc
%APPDATA%\Microsoft\Media Player\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\How Recovery Files.txt
<ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00510000.alloc
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\How Recovery Files.txt
<STUBS_DIR>\ashAvSrv\How Recovery Files.txt
<STUBS_DIR>\magent\How Recovery Files.txt
<STUBS_DIR>\lotroclient\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\How Recovery Files.txt
<STUBS_DIR>\MCAGENT\How Recovery Files.txt
<STUBS_DIR>\Mir3Game\How Recovery Files.txt
<STUBS_DIR>\msn6\How Recovery Files.txt
<STUBS_DIR>\mpftray\How Recovery Files.txt
<STUBS_DIR>\miranda32\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\How Recovery Files.txt
<STUBS_DIR>\msnmsgr\How Recovery Files.txt
<STUBS_DIR>\NAVAPW32\How Recovery Files.txt
<STUBS_DIR>\netxray\How Recovery Files.txt
<STUBS_DIR>\nod\How Recovery Files.txt
<STUBS_DIR>\nod32\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\How Recovery Files.txt
<STUBS_DIR>\opera\How Recovery Files.txt
<STUBS_DIR>\pidgin\How Recovery Files.txt
<STUBS_DIR>\outpost\How Recovery Files.txt
%WINDIR%\XXInstall\Scripts\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\How Recovery Files.txt
<STUBS_DIR>\maplestory\How Recovery Files.txt
<STUBS_DIR>\loadmain\How Recovery Files.txt
<STUBS_DIR>\GVOnline\How Recovery Files.txt
<STUBS_DIR>\gw\How Recovery Files.txt
C:\Muldrop\unq4.unq_0
<STUBS_DIR>\httplook\How Recovery Files.txt
<STUBS_DIR>\ICQ\How Recovery Files.txt
<STUBS_DIR>\iexplore\How Recovery Files.txt
<STUBS_DIR>\inbank-start-ff\How Recovery Files.txt
%ProgramFiles%\Windows NT\Pinball\How Recovery Files.txt
C:\Muldrop\How Recovery Files.txt
<STUBS_DIR>\InphaseNXD\How Recovery Files.txt
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\How Recovery Files.txt
<STUBS_DIR>\intpro\How Recovery Files.txt
<STUBS_DIR>\iscc\How Recovery Files.txt
<STUBS_DIR>\java\How Recovery Files.txt
<STUBS_DIR>\ISClient\How Recovery Files.txt
<STUBS_DIR>\javaw\How Recovery Files.txt
<STUBS_DIR>\lin\How Recovery Files.txt
<STUBS_DIR>\kb_cli\How Recovery Files.txt
<STUBS_DIR>\l2\How Recovery Files.txt
<STUBS_DIR>\oncbcli\How Recovery Files.txt
%WINDIR%\Web\How Recovery Files.txt
<STUBS_DIR>\ntvdm\How Recovery Files.txt
<STUBS_DIR>\putty\How Recovery Files.txt
%WINDIR%\XXInstall\How Recovery Files.txt
<STUBS_DIR>\winbaram\How Recovery Files.txt
<STUBS_DIR>\zlclient\How Recovery Files.txt
<STUBS_DIR>\wow\How Recovery Files.txt
<STUBS_DIR>\wsm\How Recovery Files.txt
<STUBS_DIR>\YahooMessenger\How Recovery Files.txt
<STUBS_DIR>\ybclient\How Recovery Files.txt
<STUBS_DIR>\zapro\How Recovery Files.txt
<STUBS_DIR>\ZZ__cd75efb816b2cc__\How Recovery Files.txt
<STUBS_DIR>\ZONEALARM\How Recovery Files.txt
%WINDIR%\How Recovery Files.txt
C:\How Recovery Files.txt
%APPDATA%\recovery.txt
%TEMP%\tmp6.tmp
%APPDATA%\info.exe
%TEMP%\tmp5.tmp
%TEMP%\tmp4.tmp
%TEMP%\tmp3.tmp
<STUBS_DIR>\__cd75efb816b2cc__\How Recovery Files.txt
<STUBS_DIR>\webmoney\How Recovery Files.txt
<STUBS_DIR>\woool\How Recovery Files.txt
<STUBS_DIR>\TwelveSky2\How Recovery Files.txt
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\How Recovery Files.txt
<STUBS_DIR>\Ragexe\How Recovery Files.txt
<STUBS_DIR>\rclient\How Recovery Files.txt
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\How Recovery Files.txt
<STUBS_DIR>\RagFree\How Recovery Files.txt
<STUBS_DIR>\safari\How Recovery Files.txt
<STUBS_DIR>\skype\How Recovery Files.txt
<STUBS_DIR>\sgbclient\How Recovery Files.txt
<STUBS_DIR>\smc\How Recovery Files.txt
<STUBS_DIR>\so3d\How Recovery Files.txt
<STUBS_DIR>\sro_client\How Recovery Files.txt
<STUBS_DIR>\startclient7\How Recovery Files.txt
<STUBS_DIR>\spidernt\How Recovery Files.txt
<STUBS_DIR>\translink\How Recovery Files.txt
<STUBS_DIR>\tiny\How Recovery Files.txt
<STUBS_DIR>\How Recovery Files.txt
<STUBS_DIR>\trillian\How Recovery Files.txt
<STUBS_DIR>\wclnt\How Recovery Files.txt
<STUBS_DIR>\UniStream\How Recovery Files.txt
<STUBS_DIR>\qip\How Recovery Files.txt
%WINDIR%\Web\Wallpaper\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\How Recovery Files.txt
<STUBS_DIR>\GUARD\How Recovery Files.txt
<STUBS_DIR>\AVGCTRL\How Recovery Files.txt
<STUBS_DIR>\AVP32\How Recovery Files.txt
<STUBS_DIR>\AVP\How Recovery Files.txt
C:\Muldrop\dmp_0xd8_0x10000
<STUBS_DIR>\AVPM\How Recovery Files.txt
<STUBS_DIR>\AVPCC\How Recovery Files.txt
C:\Muldrop\dmp_0xd8_0x20000
<STUBS_DIR>\bankcl\How Recovery Files.txt
<STUBS_DIR>\AVGCC32\How Recovery Files.txt
C:\Muldrop\dmp_0x88_0x30000
%WINDIR%\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\How Recovery Files.txt
<STUBS_DIR>\bdagent\How Recovery Files.txt
<STUBS_DIR>\bclient\How Recovery Files.txt
C:\Muldrop\jogp.fyf_0
<STUBS_DIR>\bc_loader\How Recovery Files.txt
<STUBS_DIR>\bdsubmit\How Recovery Files.txt
<STUBS_DIR>\bdss\How Recovery Files.txt
<STUBS_DIR>\bk\How Recovery Files.txt
<STUBS_DIR>\AVSYNMGR\How Recovery Files.txt
C:\Muldrop\dmp_0x1a8_0x30000
C:\Muldrop\dmp_0x88_0x20000
%WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\How Recovery Files.txt
C:\Muldrop\dmp_0x1b8_0x10000
C:\Muldrop\dmp_0x1b8_0x20000
C:\Muldrop\dmp_0x1b8_0x30000
C:\Muldrop\dmp_0x1bc_0x10000
C:\Muldrop\dmp_0x1bc_0x20000
C:\Muldrop\dmp_0x1bc_0x30000
C:\Muldrop\dmp_0x1c0_0x10000
C:\Muldrop\dmp_0x1c0_0x20000
<STUBS_DIR>\360tray\How Recovery Files.txt
C:\Muldrop\dmp_0x1c0_0x30000
<STUBS_DIR>\aion\How Recovery Files.txt
<STUBS_DIR>\ageofconan\How Recovery Files.txt
C:\Muldrop\dmp_0x88_0x10000
<STUBS_DIR>\ash\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\How Recovery Files.txt
<STUBS_DIR>\ashAvast\How Recovery Files.txt
<STUBS_DIR>\avgcc\How Recovery Files.txt
<STUBS_DIR>\cbank\How Recovery Files.txt
<STUBS_DIR>\BBClient\How Recovery Files.txt
<STUBS_DIR>\cabalmain\How Recovery Files.txt
<STUBS_DIR>\cbmain\How Recovery Files.txt
<STUBS_DIR>\chrome\How Recovery Files.txt
%WINDIR%\Web\printers\How Recovery Files.txt
<STUBS_DIR>\egni\How Recovery Files.txt
<STUBS_DIR>\ekrn\How Recovery Files.txt
C:\Muldrop\npgdpnq.mph_5
<STUBS_DIR>\elbank\How Recovery Files.txt
<STUBS_DIR>\elementclient\How Recovery Files.txt
<STUBS_DIR>\el_cli\How Recovery Files.txt
<STUBS_DIR>\firefox\How Recovery Files.txt
<STUBS_DIR>\fsav\How Recovery Files.txt
C:\Muldrop\Sztufn.emm_0
<STUBS_DIR>\ecmd\How Recovery Files.txt
<STUBS_DIR>\fsav32\How Recovery Files.txt
<STUBS_DIR>\fsavaui\How Recovery Files.txt
<STUBS_DIR>\fsavgui\How Recovery Files.txt
<STUBS_DIR>\gc\How Recovery Files.txt
<STUBS_DIR>\ge\How Recovery Files.txt
<STUBS_DIR>\googletalk\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\How Recovery Files.txt
C:\Muldrop\unq3.unq_0
C:\Muldrop\dmp_0x1a8_0x20000
<STUBS_DIR>\Drwebwcl\How Recovery Files.txt
C:\Muldrop\npgdpnq.mph_3
<STUBS_DIR>\drweb386\How Recovery Files.txt
C:\Muldrop\npgdpnq.mph_4
<STUBS_DIR>\cbsmain\How Recovery Files.txt
<STUBS_DIR>\ccapp\How Recovery Files.txt
<STUBS_DIR>\clbank\How Recovery Files.txt
<STUBS_DIR>\ClamWin\How Recovery Files.txt
C:\Muldrop\M15XpD_0
<STUBS_DIR>\clmain\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\How Recovery Files.txt
<STUBS_DIR>\client7\How Recovery Files.txt
<STUBS_DIR>\clntw32\How Recovery Files.txt
<STUBS_DIR>\contactNG\How Recovery Files.txt
<STUBS_DIR>\dekaron\How Recovery Files.txt
C:\Muldrop\npgdpnq.mph_0
<STUBS_DIR>\dnf\How Recovery Files.txt
<STUBS_DIR>\drweb\How Recovery Files.txt
%WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\How Recovery Files.txt
C:\Muldrop\npgdpnq.mph_1
<STUBS_DIR>\Drweb32w\How Recovery Files.txt
C:\Muldrop\npgdpnq.mph_2
<STUBS_DIR>\Drwebupw\How Recovery Files.txt
%ProgramFiles%\MSN\MSNCoreFiles\OOBE\How Recovery Files.txt

Deletes the following files:

%TEMP%\tmp3.tmp
%TEMP%\tmp4.tmp

Moves the following system files:

from %WINDIR%\_default.pif to %WINDIR%\_default.pif.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll.rapid
from %WINDIR%\Web\bullet.gif to %WINDIR%\Web\bullet.gif.rapid
from %WINDIR%\Web\printers\images\ipp_0012.gif to %WINDIR%\Web\printers\images\ipp_0012.gif.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll.rapid
from %WINDIR%\vmmreg32.dll to %WINDIR%\vmmreg32.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll.rapid
from %WINDIR%\Web\printers\images\ipp_0005.gif to %WINDIR%\Web\printers\images\ipp_0005.gif.rapid
from %WINDIR%\twunk_32.exe to %WINDIR%\twunk_32.exe.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll.rapid
from %WINDIR%\Web\printers\images\ipp_0004.gif to %WINDIR%\Web\printers\images\ipp_0004.gif.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll.rapid
from %WINDIR%\vb.ini to %WINDIR%\vb.ini.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll.rapid
from %WINDIR%\updspapi.log to %WINDIR%\updspapi.log.rapid
from %WINDIR%\Web\printers\images\ipp_0003.gif to %WINDIR%\Web\printers\images\ipp_0003.gif.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll.rapid
from %WINDIR%\vbaddin.ini to %WINDIR%\vbaddin.ini.rapid
from %WINDIR%\Web\deskmovr.htt to %WINDIR%\Web\deskmovr.htt.rapid
from %WINDIR%\XXInstall\Scripts\apply_theme.vbs to %WINDIR%\XXInstall\Scripts\apply_theme.vbs.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll.rapid
from %WINDIR%\Web\printers\ipp_0004.asp to %WINDIR%\Web\printers\ipp_0004.asp.rapid
from %WINDIR%\XXInstall\Scripts\bcode-start.vbs to %WINDIR%\XXInstall\Scripts\bcode-start.vbs.rapid
from %WINDIR%\Web\printers\ipp_0003.asp to %WINDIR%\Web\printers\ipp_0003.asp.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll.rapid
from %WINDIR%\XXInstall\Scripts\bcode-start-stop.vbs to %WINDIR%\XXInstall\Scripts\bcode-start-stop.vbs.rapid
from %WINDIR%\Web\printers\ipp_0002.asp to %WINDIR%\Web\printers\ipp_0002.asp.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll.rapid
from %WINDIR%\Web\printers\images\ipp_0015.gif to %WINDIR%\Web\printers\images\ipp_0015.gif.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll.rapid
from %WINDIR%\Web\printers\ipp_0001.asp to %WINDIR%\Web\printers\ipp_0001.asp.rapid
from %WINDIR%\XXInstall\Scripts\antivm.exe to %WINDIR%\XXInstall\Scripts\antivm.exe.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll.rapid
from %WINDIR%\Web\printers\ipp_0000.inc to %WINDIR%\Web\printers\ipp_0000.inc.rapid
from %WINDIR%\XXInstall\Scripts\antivm.bat to %WINDIR%\XXInstall\Scripts\antivm.bat.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll.rapid
from %WINDIR%\Web\exclam.gif to %WINDIR%\Web\exclam.gif.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.cat to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.cat.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.30729.4148.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.30729.4148.cat.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.4148.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.4148.policy.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.4148.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.4148.cat.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.policy.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.cat.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.4148.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.4148.policy.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.4148.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.4148.cat.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.21022.8.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.21022.8.policy.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.21022.8.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.21022.8.cat.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.policy.rapid
from %WINDIR%\Web\printers\images\ipp_0002.gif to %WINDIR%\Web\printers\images\ipp_0002.gif.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.4148.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.4148.policy.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.cat to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.cat.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.cat to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.cat.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.4148.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.4148.cat.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.policy.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.cat to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.cat.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.policy.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.cat to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.cat.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.policy.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.30729.4148.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.30729.4148.policy.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll.rapid
from %WINDIR%\Temp\Perflib_Perfdata_7e8.dat to %WINDIR%\Temp\Perflib_Perfdata_7e8.dat.rapid
from %WINDIR%\twunk_16.exe to %WINDIR%\twunk_16.exe.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll.rapid
from %WINDIR%\twain_32.dll to %WINDIR%\twain_32.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll.rapid
from %WINDIR%\twain.dll to %WINDIR%\twain.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll.rapid
from %WINDIR%\tsoc.log to %WINDIR%\tsoc.log.rapid
from %WINDIR%\twain_32\wiatwain.ds to %WINDIR%\twain_32\wiatwain.ds.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll.rapid
from %WINDIR%\TASKMAN.EXE to %WINDIR%\TASKMAN.EXE.rapid
from %WINDIR%\tabletoc.log to %WINDIR%\tabletoc.log.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.policy.rapid
from %WINDIR%\XXInstall\Scripts\bcode-stop.vbs to %WINDIR%\XXInstall\Scripts\bcode-stop.vbs.rapid
from %WINDIR%\Web\printers\ipp_0010.asp to %WINDIR%\Web\printers\ipp_0010.asp.rapid
from %WINDIR%\XXInstall\Scripts\smart_assembly_fix.reg to %WINDIR%\XXInstall\Scripts\smart_assembly_fix.reg.rapid
from %WINDIR%\wiaservc.log to %WINDIR%\wiaservc.log.rapid
from %WINDIR%\wiadebug.log to %WINDIR%\wiadebug.log.rapid
from %WINDIR%\XXInstall\Scripts\safely.reg to %WINDIR%\XXInstall\Scripts\safely.reg.rapid
from %WINDIR%\XXInstall\hashdeep.exe to %WINDIR%\XXInstall\hashdeep.exe.rapid
from %WINDIR%\XXInstall\Scripts\reboot_on_bsod.reg to %WINDIR%\XXInstall\Scripts\reboot_on_bsod.reg.rapid
from %WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll.rapid
from %WINDIR%\XXInstall\Scripts\prefs.js to %WINDIR%\XXInstall\Scripts\prefs.js.rapid
from %WINDIR%\Web\tips.gif to %WINDIR%\Web\tips.gif.rapid
from %WINDIR%\XXInstall\exdir.exe to %WINDIR%\XXInstall\exdir.exe.rapid
from %WINDIR%\Web\printers\prtwebvw.css to %WINDIR%\Web\printers\prtwebvw.css.rapid
from %WINDIR%\XXInstall\Scripts\perf.reg to %WINDIR%\XXInstall\Scripts\perf.reg.rapid
from %WINDIR%\Web\tip.htm to %WINDIR%\Web\tip.htm.rapid
from %WINDIR%\Web\Wallpaper\Wind.jpg to %WINDIR%\Web\Wallpaper\Wind.jpg.rapid
from %WINDIR%\Web\safemode.htt to %WINDIR%\Web\safemode.htt.rapid
from %WINDIR%\XXInstall\Scripts\not_collect_offline.reg to %WINDIR%\XXInstall\Scripts\not_collect_offline.reg.rapid
from %WINDIR%\XXInstall\events.exe to %WINDIR%\XXInstall\events.exe.rapid
from %WINDIR%\Web\Wallpaper\Vortec space.jpg to %WINDIR%\Web\Wallpaper\Vortec space.jpg.rapid
from %WINDIR%\XXInstall\Scripts\norun.reg to %WINDIR%\XXInstall\Scripts\norun.reg.rapid
from %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll.rapid
from %WINDIR%\XXInstall\install.bat to %WINDIR%\XXInstall\install.bat.rapid
from %WINDIR%\Web\Wallpaper\Windows XP.jpg to %WINDIR%\Web\Wallpaper\Windows XP.jpg.rapid
from %WINDIR%\XXInstall\Scripts\startup_ar.bat to %WINDIR%\XXInstall\Scripts\startup_ar.bat.rapid
from %WINDIR%\XXInstall\vminstall.exe to %WINDIR%\XXInstall\vminstall.exe.rapid
from %WINDIR%\Zapotec.bmp to %WINDIR%\Zapotec.bmp.rapid
from %WINDIR%\WMSysPr9.prx to %WINDIR%\WMSysPr9.prx.rapid
from %WINDIR%\wmsetup.log to %WINDIR%\wmsetup.log.rapid
from %WINDIR%\winnt256.bmp to %WINDIR%\winnt256.bmp.rapid
from %WINDIR%\winnt.bmp to %WINDIR%\winnt.bmp.rapid
from %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll to %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll.rapid
from %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll to %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll.rapid
from %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll to %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll.rapid
from %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll to %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll.rapid
from %WINDIR%\winhlp32.exe to %WINDIR%\winhlp32.exe.rapid
from %WINDIR%\XXInstall\install_ar.bat to %WINDIR%\XXInstall\install_ar.bat.rapid
from %WINDIR%\XXInstall\screen.exe to %WINDIR%\XXInstall\screen.exe.rapid
from %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll.rapid
from %WINDIR%\XXInstall\Scripts\WindowsKiller.ini to %WINDIR%\XXInstall\Scripts\WindowsKiller.ini.rapid
from %WINDIR%\XXInstall\ps.exe to %WINDIR%\XXInstall\ps.exe.rapid
from %WINDIR%\XXInstall\Scripts\taskmgr.reg to %WINDIR%\XXInstall\Scripts\taskmgr.reg.rapid
from %WINDIR%\XXInstall\install_small.bat to %WINDIR%\XXInstall\install_small.bat.rapid
from %WINDIR%\winhelp.exe to %WINDIR%\winhelp.exe.rapid
from %WINDIR%\WindowsUpdate.log to %WINDIR%\WindowsUpdate.log.rapid
from %WINDIR%\XXInstall\Scripts\startup_bsod.bat to %WINDIR%\XXInstall\Scripts\startup_bsod.bat.rapid
from %WINDIR%\win.ini to %WINDIR%\win.ini.rapid
from %WINDIR%\Web\Wallpaper\Purple flower.jpg to %WINDIR%\Web\Wallpaper\Purple flower.jpg.rapid
from %WINDIR%\Web\printers\ipp_0005.asp to %WINDIR%\Web\printers\ipp_0005.asp.rapid
from %WINDIR%\XXInstall\devcon.exe to %WINDIR%\XXInstall\devcon.exe.rapid
from %WINDIR%\XXInstall\Scripts\KernelDump.reg to %WINDIR%\XXInstall\Scripts\KernelDump.reg.rapid
from %WINDIR%\Web\Wallpaper\Follow.jpg to %WINDIR%\Web\Wallpaper\Follow.jpg.rapid
from %WINDIR%\Web\Wallpaper\Crystal.jpg to %WINDIR%\Web\Wallpaper\Crystal.jpg.rapid
from %WINDIR%\Web\printers\ipp_0013.asp to %WINDIR%\Web\printers\ipp_0013.asp.rapid
from %WINDIR%\XXInstall\Scripts\ipv6_disable.reg to %WINDIR%\XXInstall\Scripts\ipv6_disable.reg.rapid
from %WINDIR%\Web\Wallpaper\Bliss.bmp to %WINDIR%\Web\Wallpaper\Bliss.bmp.rapid
from %WINDIR%\Web\Wallpaper\Azul.jpg to %WINDIR%\Web\Wallpaper\Azul.jpg.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll.rapid
from %WINDIR%\XXInstall\Scripts\eventmon-startlog.vbs to %WINDIR%\XXInstall\Scripts\eventmon-startlog.vbs.rapid
from %WINDIR%\Web\Wallpaper\Autumn.jpg to %WINDIR%\Web\Wallpaper\Autumn.jpg.rapid
from %WINDIR%\Web\Wallpaper\Stonehenge.jpg to %WINDIR%\Web\Wallpaper\Stonehenge.jpg.rapid
from %WINDIR%\XXInstall\Scripts\eventmon-setup.vbs to %WINDIR%\XXInstall\Scripts\eventmon-setup.vbs.rapid
from %WINDIR%\Web\Wallpaper\Ascent.jpg to %WINDIR%\Web\Wallpaper\Ascent.jpg.rapid
from %WINDIR%\Web\printers\ipp_0007.asp to %WINDIR%\Web\printers\ipp_0007.asp.rapid
from %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll.rapid
from %WINDIR%\XXInstall\Scripts\CompleteDump.reg to %WINDIR%\XXInstall\Scripts\CompleteDump.reg.rapid
from %WINDIR%\Web\printers\ipp_0006.asp to %WINDIR%\Web\printers\ipp_0006.asp.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll.rapid
from %WINDIR%\Web\printers\ipp_0014.asp to %WINDIR%\Web\printers\ipp_0014.asp.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll.rapid
from %WINDIR%\XXInstall\Scripts\kill_saves.vbs to %WINDIR%\XXInstall\Scripts\kill_saves.vbs.rapid
from %WINDIR%\Web\printers\ipp_res.inc to %WINDIR%\Web\printers\ipp_res.inc.rapid
from %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcirt.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcirt.dll.rapid
from %WINDIR%\XXInstall\Scripts\noballon.reg to %WINDIR%\XXInstall\Scripts\noballon.reg.rapid
from %WINDIR%\Web\printers\page1.asp to %WINDIR%\Web\printers\page1.asp.rapid
from %WINDIR%\Web\Wallpaper\Ripple.jpg to %WINDIR%\Web\Wallpaper\Ripple.jpg.rapid
from %WINDIR%\Web\printers\ipp_util.inc to %WINDIR%\Web\printers\ipp_util.inc.rapid
from %WINDIR%\XXInstall\cmdow.exe to %WINDIR%\XXInstall\cmdow.exe.rapid
from %WINDIR%\XXInstall\Scripts\ncsi_disable.reg to %WINDIR%\XXInstall\Scripts\ncsi_disable.reg.rapid
from %WINDIR%\Web\Wallpaper\Red moon desert.jpg to %WINDIR%\Web\Wallpaper\Red moon desert.jpg.rapid
from %WINDIR%\Web\Wallpaper\Radiance.jpg to %WINDIR%\Web\Wallpaper\Radiance.jpg.rapid
from %WINDIR%\Web\Wallpaper\Tulips.jpg to %WINDIR%\Web\Wallpaper\Tulips.jpg.rapid
from %WINDIR%\Web\Wallpaper\Friend.jpg to %WINDIR%\Web\Wallpaper\Friend.jpg.rapid
from %WINDIR%\XXInstall\Scripts\LanDisabler.vbs to %WINDIR%\XXInstall\Scripts\LanDisabler.vbs.rapid
from %WINDIR%\Web\Wallpaper\Power.jpg to %WINDIR%\Web\Wallpaper\Power.jpg.rapid
from %WINDIR%\Web\printers\ipp_adsi.inc to %WINDIR%\Web\printers\ipp_adsi.inc.rapid
from %WINDIR%\Web\Wallpaper\Peace.jpg to %WINDIR%\Web\Wallpaper\Peace.jpg.rapid
from %WINDIR%\XXInstall\Scripts\kill_windows.vbs to %WINDIR%\XXInstall\Scripts\kill_windows.vbs.rapid
from %WINDIR%\Web\Wallpaper\Moon flower.jpg to %WINDIR%\Web\Wallpaper\Moon flower.jpg.rapid
from %WINDIR%\Web\printers\ipp_0015.asp to %WINDIR%\Web\printers\ipp_0015.asp.rapid
from %WINDIR%\Web\Wallpaper\Home.jpg to %WINDIR%\Web\Wallpaper\Home.jpg.rapid
from %WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll.rapid
from %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll.rapid
from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.3053.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.3053.policy.rapid

Moves the following files:

from C:\Muldrop\unq4.unq_0 to C:\Muldrop\unq4.unq_0.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.rapid
from <ANALYSE_DIR>\DWS-DUMP\0B4C_dws_cmd.exe to <ANALYSE_DIR>\DWS-DUMP\0B4C_dws_cmd.exe.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll.rapid
from <ANALYSE_DIR>\DWS-DUMP\0B44_dws_vssadmin.exe to <ANALYSE_DIR>\DWS-DUMP\0B44_dws_vssadmin.exe.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.rapid
from <ANALYSE_DIR>\DWS-DUMP\0B14_dws_<File name>.exe to <ANALYSE_DIR>\DWS-DUMP\0B14_dws_<File name>.exe.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.rapid
from <APATH_DUMPS_DIR>\0B14_<File name>.exe_0.ndmp to <APATH_DUMPS_DIR>\0B14_<File name>.exe_0.ndmp.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.rapid
from <ANALYSE_DIR>\PET-DUMP\0B44_pet_vssadmin.exe to <ANALYSE_DIR>\PET-DUMP\0B44_pet_vssadmin.exe.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.rapid
from <ANALYSE_DIR>\PET-DUMP\0B14_pet_<File name>.exe to <ANALYSE_DIR>\PET-DUMP\0B14_pet_<File name>.exe.rapid
from %APPDATA%\winscp.rnd to %APPDATA%\winscp.rnd.rapid
from %APPDATA%\Mozilla\Firefox\profiles.ini to %APPDATA%\Mozilla\Firefox\profiles.ini.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.rapid
from <APATH_DUMPS_DIR>\0B44_vssadmin.exe_0.ndmp to <APATH_DUMPS_DIR>\0B44_vssadmin.exe_0.ndmp.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll.rapid
from %TEMP%\M15XoD to %TEMP%\M15XoD.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.rapid
from %TEMP%\nsu2.tmp\System.dll to %TEMP%\nsu2.tmp\System.dll.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.rapid
from <APATH_DUMPS_DIR>\0B4C_cmd.exe_0.ndmp to <APATH_DUMPS_DIR>\0B4C_cmd.exe_0.ndmp.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND19.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND19.WAV.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00630000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00630000.alloc.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00520000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00520000.alloc.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00510000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00510000.alloc.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00450000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00450000.alloc.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003B0000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003B0000.alloc.rapid
from %ProgramFiles%\Outlook Express\wabmig.exe to %ProgramFiles%\Outlook Express\wabmig.exe.rapid
from %ProgramFiles%\Outlook Express\wabimp.dll to %ProgramFiles%\Outlook Express\wabimp.dll.rapid
from %ProgramFiles%\Outlook Express\wabfind.dll to %ProgramFiles%\Outlook Express\wabfind.dll.rapid
from %ProgramFiles%\Outlook Express\wab.exe to %ProgramFiles%\Outlook Express\wab.exe.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003A0000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003A0000.alloc.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00930000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00930000.alloc.rapid
from %ProgramFiles%\Outlook Express\oeimport.dll to %ProgramFiles%\Outlook Express\oeimport.dll.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00390000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00390000.alloc.rapid
from %ProgramFiles%\Outlook Express\msoeres.dll to %ProgramFiles%\Outlook Express\msoeres.dll.rapid
from %ProgramFiles%\Outlook Express\msoe.txt to %ProgramFiles%\Outlook Express\msoe.txt.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00380000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00380000.alloc.rapid
from %ProgramFiles%\Outlook Express\msoe.dll to %ProgramFiles%\Outlook Express\msoe.dll.rapid
from %ProgramFiles%\Outlook Express\msimn.exe to %ProgramFiles%\Outlook Express\msimn.exe.rapid
from %ProgramFiles%\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk to %ProgramFiles%\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk.rapid
from %ProgramFiles%\Online Services\Refer me to more Internet Service Providers.lnk to %ProgramFiles%\Online Services\Refer me to more Internet Service Providers.lnk.rapid
from %ProgramFiles%\NetMeeting\wb32.exe to %ProgramFiles%\NetMeeting\wb32.exe.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00330000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00330000.alloc.rapid
from %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml to %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml.rapid
from %ProgramFiles%\NetMeeting\TestSnd.wav to %ProgramFiles%\NetMeeting\TestSnd.wav.rapid
from %ProgramFiles%\Outlook Express\oemiglib.dll to %ProgramFiles%\Outlook Express\oemiglib.dll.rapid
from %ProgramFiles%\Outlook Express\setup50.exe to %ProgramFiles%\Outlook Express\setup50.exe.rapid
from <ANALYSE_DIR>\PET-DUMP\0B4C_pet_cmd.exe to <ANALYSE_DIR>\PET-DUMP\0B4C_pet_cmd.exe.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.rapid
from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~ to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json.rapid
from %APPDATA%\Microsoft\Media Player\0007F0B7.wpl to %APPDATA%\Microsoft\Media Player\0007F0B7.wpl.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFE0000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFE0000.alloc.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFDF000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFDF000.alloc.rapid
from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk.rapid
from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf.rapid
from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFD5000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFD5000.alloc.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.rapid
from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini.rapid
from %APPDATA%\Microsoft\Internet Explorer\Desktop.htt to %APPDATA%\Microsoft\Internet Explorer\Desktop.htt.rapid
from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00990000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00990000.alloc.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css.rapid
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll.rapid
from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll.rapid
from %APPDATA%\desktop.ini to %APPDATA%\desktop.ini.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7F6F0000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7F6F0000.alloc.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00B60000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00B60000.alloc.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00A80000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00A80000.alloc.rapid
from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFB0000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFB0000.alloc.rapid
from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND528.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND528.WAV.rapid
from C:\Muldrop\dmp_0x1bc_0x30000 to C:\Muldrop\dmp_0x1bc_0x30000.rapid
from C:\Muldrop\dmp_0x1bc_0x20000 to C:\Muldrop\dmp_0x1bc_0x20000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND50.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND50.WAV.rapid
from C:\Muldrop\dmp_0x1bc_0x10000 to C:\Muldrop\dmp_0x1bc_0x10000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND5.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND5.WAV.rapid
from C:\Muldrop\dmp_0x1b8_0x30000 to C:\Muldrop\dmp_0x1b8_0x30000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV.rapid
from C:\Muldrop\dmp_0x1b8_0x20000 to C:\Muldrop\dmp_0x1b8_0x20000.rapid
from C:\Muldrop\dmp_0x1b8_0x10000 to C:\Muldrop\dmp_0x1b8_0x10000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND49.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND49.WAV.rapid
from C:\Muldrop\dmp_0x1a8_0x30000 to C:\Muldrop\dmp_0x1a8_0x30000.rapid
from C:\Muldrop\dmp_0x1c0_0x20000 to C:\Muldrop\dmp_0x1c0_0x20000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND7.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND7.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND53.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND53.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND45.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND45.WAV.rapid
from C:\Muldrop\dmp_0x1a4_0x30000 to C:\Muldrop\dmp_0x1a4_0x30000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND42.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND42.WAV.rapid
from C:\Muldrop\dmp_0x1a4_0x20000 to C:\Muldrop\dmp_0x1a4_0x20000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND4.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND4.WAV.rapid
from C:\Muldrop\dmp_0x1a4_0x10000 to C:\Muldrop\dmp_0x1a4_0x10000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND39.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND39.WAV.rapid
from C:\Muldrop\dmp_0x198_0x30000 to C:\Muldrop\dmp_0x198_0x30000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND38.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND38.WAV.rapid
from C:\Muldrop\dmp_0x198_0x20000 to C:\Muldrop\dmp_0x198_0x20000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND36.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND36.WAV.rapid
from C:\Muldrop\dmp_0x198_0x10000 to C:\Muldrop\dmp_0x198_0x10000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND35.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND35.WAV.rapid
from C:\Muldrop\dmp_0x1a8_0x20000 to C:\Muldrop\dmp_0x1a8_0x20000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND43.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND43.WAV.rapid
from C:\Muldrop\dmp_0x1a8_0x10000 to C:\Muldrop\dmp_0x1a8_0x10000.rapid
from %ProgramFiles%\NetMeeting\rrcm.dll to %ProgramFiles%\NetMeeting\rrcm.dll.rapid
from C:\Muldrop\dmp_0x14c_0x30000 to C:\Muldrop\dmp_0x14c_0x30000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND55.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND55.WAV.rapid
from C:\Muldrop\Sztufn.emm_0 to C:\Muldrop\Sztufn.emm_0.rapid
from C:\Muldrop\npgdpnq.mph_5 to C:\Muldrop\npgdpnq.mph_5.rapid
from C:\Muldrop\npgdpnq.mph_4 to C:\Muldrop\npgdpnq.mph_4.rapid
from %ProgramFiles%\Windows NT\Pinball\table.bmp to %ProgramFiles%\Windows NT\Pinball\table.bmp.rapid
from C:\Muldrop\npgdpnq.mph_3 to C:\Muldrop\npgdpnq.mph_3.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND999.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND999.WAV.rapid
from C:\Muldrop\npgdpnq.mph_2 to C:\Muldrop\npgdpnq.mph_2.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND9.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND9.WAV.rapid
from C:\Muldrop\npgdpnq.mph_1 to C:\Muldrop\npgdpnq.mph_1.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND827.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND827.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND8.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND8.WAV.rapid
from C:\Muldrop\npgdpnq.mph_0 to C:\Muldrop\npgdpnq.mph_0.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND735.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND735.WAV.rapid
from C:\Muldrop\dmp_0x1c0_0x30000 to C:\Muldrop\dmp_0x1c0_0x30000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND54.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND54.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND713.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND713.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND68.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND68.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND65.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND65.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND6.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND6.WAV.rapid
from C:\Muldrop\jogp.fyf_0 to C:\Muldrop\jogp.fyf_0.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND58.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND58.WAV.rapid
from C:\Muldrop\dmp_0xd8_0x20000 to C:\Muldrop\dmp_0xd8_0x20000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND57.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND57.WAV.rapid
from C:\Muldrop\dmp_0xd8_0x10000 to C:\Muldrop\dmp_0xd8_0x10000.rapid
from C:\Muldrop\dmp_0x88_0x30000 to C:\Muldrop\dmp_0x88_0x30000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND563.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND563.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND560.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND560.WAV.rapid
from C:\Muldrop\dmp_0x88_0x20000 to C:\Muldrop\dmp_0x88_0x20000.rapid
from C:\Muldrop\dmp_0x88_0x10000 to C:\Muldrop\dmp_0x88_0x10000.rapid
from C:\Muldrop\unq3.unq_0 to C:\Muldrop\unq3.unq_0.rapid
from C:\Muldrop\M15XpD_0 to C:\Muldrop\M15XpD_0.rapid
from %ProgramFiles%\Outlook Express\oemig50.exe to %ProgramFiles%\Outlook Express\oemig50.exe.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND34.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND34.WAV.rapid
from C:\Muldrop\dmp_0x14c_0x10000 to C:\Muldrop\dmp_0x14c_0x10000.rapid
from %ProgramFiles%\Windows NT\Pinball\FONT.DAT to %ProgramFiles%\Windows NT\Pinball\FONT.DAT.rapid
from %ProgramFiles%\Windows NT\hypertrm.exe to %ProgramFiles%\Windows NT\hypertrm.exe.rapid
from %ProgramFiles%\Windows NT\htrn_jis.dll to %ProgramFiles%\Windows NT\htrn_jis.dll.rapid
from %ProgramFiles%\Windows NT\dialer.exe to %ProgramFiles%\Windows NT\dialer.exe.rapid
from %ProgramFiles%\Windows NT\Accessories\write.wpc to %ProgramFiles%\Windows NT\Accessories\write.wpc.rapid
from %ProgramFiles%\Windows NT\Accessories\wordpad.exe to %ProgramFiles%\Windows NT\Accessories\wordpad.exe.rapid
from %ProgramFiles%\Windows NT\Accessories\mswrd8.wpc to %ProgramFiles%\Windows NT\Accessories\mswrd8.wpc.rapid
from %ProgramFiles%\Windows NT\Accessories\mswrd6.wpc to %ProgramFiles%\Windows NT\Accessories\mswrd6.wpc.rapid
from %ProgramFiles%\Windows Media Player\wmpns.dll to %ProgramFiles%\Windows Media Player\wmpns.dll.rapid
from %ProgramFiles%\Windows Media Player\wmplayer.exe to %ProgramFiles%\Windows Media Player\wmplayer.exe.rapid
from %ProgramFiles%\Windows Media Player\wmpband.dll to %ProgramFiles%\Windows Media Player\wmpband.dll.rapid
from %ProgramFiles%\Windows Media Player\Skins\Revert.wmz to %ProgramFiles%\Windows Media Player\Skins\Revert.wmz.rapid
from %ProgramFiles%\Windows Media Player\Skins\compact.wmz to %ProgramFiles%\Windows Media Player\Skins\compact.wmz.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND30.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND30.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\PINBALL.DAT to %ProgramFiles%\Windows NT\Pinball\PINBALL.DAT.rapid
from %ProgramFiles%\Windows NT\Pinball\PINBALL.EXE to %ProgramFiles%\Windows NT\Pinball\PINBALL.EXE.rapid
from %ProgramFiles%\Windows Media Player\npdrmv2.dll to %ProgramFiles%\Windows Media Player\npdrmv2.dll.rapid
from %ProgramFiles%\Windows Media Player\mpvis.dll to %ProgramFiles%\Windows Media Player\mpvis.dll.rapid
from %ProgramFiles%\Windows Media Player\mplayer2.exe to %ProgramFiles%\Windows Media Player\mplayer2.exe.rapid
from %ProgramFiles%\Windows Media Player\migrate.exe to %ProgramFiles%\Windows Media Player\migrate.exe.rapid
from %ProgramFiles%\Windows Media Player\custsat.dll to %ProgramFiles%\Windows Media Player\custsat.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.rapid
from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll.rapid
from %ProgramFiles%\Windows Media Player\setup_wm.exe to %ProgramFiles%\Windows Media Player\setup_wm.exe.rapid
from %ProgramFiles%\Windows Media Player\npdsplay.dll to %ProgramFiles%\Windows Media Player\npdsplay.dll.rapid
from C:\Muldrop\dmp_0x14c_0x20000 to C:\Muldrop\dmp_0x14c_0x20000.rapid
from %ProgramFiles%\Windows Media Player\npwmsdrm.dll to %ProgramFiles%\Windows Media Player\npwmsdrm.dll.rapid
from C:\Muldrop\dmp_0x1c0_0x10000 to C:\Muldrop\dmp_0x1c0_0x10000.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND3.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND3.WAV.rapid
from C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_1 to C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_1.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND29.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND29.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND28.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND28.WAV.rapid
from C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_0 to C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_0.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND27.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND27.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND26.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND26.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND25.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND25.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND243.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND243.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND240.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND240.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND24.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND24.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND22.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND22.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND21.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND21.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND1.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND1.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\PINBALL.MID to %ProgramFiles%\Windows NT\Pinball\PINBALL.MID.rapid
from %ProgramFiles%\Windows NT\Pinball\PINBALL2.MID to %ProgramFiles%\Windows NT\Pinball\PINBALL2.MID.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND18.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND18.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND17.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND17.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND16.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND16.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND14.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND14.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND136.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND136.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND131.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND131.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND13.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND13.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND12.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND12.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND112.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND112.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND111.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND111.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND108.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND108.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND105.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND105.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND104.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND104.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND20.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND20.WAV.rapid
from %ProgramFiles%\Windows NT\Pinball\SOUND181.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND181.WAV.rapid
from %ProgramFiles%\MSN\MSNCoreFiles\OOBE\signup.mar to %ProgramFiles%\MSN\MSNCoreFiles\OOBE\signup.mar.rapid

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous:

Creates and executes the following:

'<Full path to file>'

Executes the following:

'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} recoveryenabled No
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /c wmic SHADOWCOPY DELETE
'<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /TN Encrypter /TR %APPDATA%\info.exe
'<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /TN EncrypterSt /TR %APPDATA%\info.exe

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial