Trojan.Encoder.25785

Technical Information

Modifies file system:

Creates the following files:

%APPDATA%\Microsoft\Protect\CREDHIST
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\af2eb888da427f5620e6d14e496c1e05_23ef5514-3059-436f-a4a7-4cefaab20eb1

Deletes the following files:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\af2eb888da427f5620e6d14e496c1e05_23ef5514-3059-436f-a4a7-4cefaab20eb1

Moves the following system files:

from %WINDIR%\Coffee Bean.bmp to %WINDIR%\Coffee Bean-riqq37rdut28kvi.bmp
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo-riqq37rdut28kvi.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.CSharp-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.NETFramework.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.NETFramework-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.WinFx.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.WinFx-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Xaml.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Xaml-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD-riqq37rdut28kvi.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat-riqq37rdut28kvi.jpg
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header-riqq37rdut28kvi.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen-riqq37rdut28kvi.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark-riqq37rdut28kvi.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo-riqq37rdut28kvi.jpg
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\SqlServer.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\SqlServer-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula-riqq37rdut28kvi.rtf
from %WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp to %WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x-riqq37rdut28kvi.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.WinFx.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.WinFx-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header-riqq37rdut28kvi.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen-riqq37rdut28kvi.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark-riqq37rdut28kvi.bmp
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.VisualBasic-riqq37rdut28kvi.targets
from %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\control_up.jpg to %WINDIR%\Help\Tours\htmlTour\control_up-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg to %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg to %WINDIR%\Help\Tours\htmlTour\desktop_up-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\folder_up.jpg to %WINDIR%\Help\Tours\htmlTour\folder_up-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img068.jpg to %WINDIR%\Help\Tours\htmlTour\img068-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\icon_up.jpg to %WINDIR%\Help\Tours\htmlTour\icon_up-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img004b.jpg to %WINDIR%\Help\Tours\htmlTour\img004b-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img014.jpg to %WINDIR%\Help\Tours\htmlTour\img014-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img033.jpg to %WINDIR%\Help\Tours\htmlTour\img033-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img033a.jpg to %WINDIR%\Help\Tours\htmlTour\img033a-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img034.jpg to %WINDIR%\Help\Tours\htmlTour\img034-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img040.jpg to %WINDIR%\Help\Tours\htmlTour\img040-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img046.jpg to %WINDIR%\Help\Tours\htmlTour\img046-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img060.jpg to %WINDIR%\Help\Tours\htmlTour\img060-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\end_up.jpg to %WINDIR%\Help\Tours\htmlTour\end_up-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\best_road.jpg to %WINDIR%\Help\Tours\htmlTour\best_road-riqq37rdut28kvi.jpg
from %WINDIR%\FeatherTexture.bmp to %WINDIR%\FeatherTexture-riqq37rdut28kvi.bmp
from %WINDIR%\Gone Fishing.bmp to %WINDIR%\Gone Fishing-riqq37rdut28kvi.bmp
from %WINDIR%\Greenstone.bmp to %WINDIR%\Greenstone-riqq37rdut28kvi.bmp
from %WINDIR%\Prairie Wind.bmp to %WINDIR%\Prairie Wind-riqq37rdut28kvi.bmp
from %WINDIR%\Rhododendron.bmp to %WINDIR%\Rhododendron-riqq37rdut28kvi.bmp
from %WINDIR%\River Sumida.bmp to %WINDIR%\River Sumida-riqq37rdut28kvi.bmp
from %WINDIR%\Santa Fe Stucco.bmp to %WINDIR%\Santa Fe Stucco-riqq37rdut28kvi.bmp
from %WINDIR%\Soap Bubbles.bmp to %WINDIR%\Soap Bubbles-riqq37rdut28kvi.bmp
from %WINDIR%\Zapotec.bmp to %WINDIR%\Zapotec-riqq37rdut28kvi.bmp
from %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\best_robust.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\best_secure.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_data.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg to %WINDIR%\Help\Tours\htmlTour\intro_logo-riqq37rdut28kvi.jpg
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.Common-riqq37rdut28kvi.targets
from %WINDIR%\Help\Tours\htmlTour\img089.jpg to %WINDIR%\Help\Tours\htmlTour\img089-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg to %WINDIR%\Help\Tours\htmlTour\taskbar_up-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg to %WINDIR%\Help\Tours\htmlTour\ul_logo-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img074a.jpg to %WINDIR%\Help\Tours\htmlTour\img074a-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\window_up.jpg to %WINDIR%\Help\Tours\htmlTour\window_up-riqq37rdut28kvi.jpg
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA-riqq37rdut28kvi.rtf
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.WinFX.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.WinFX-riqq37rdut28kvi.targets
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo-riqq37rdut28kvi.jpg
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD-riqq37rdut28kvi.jpg
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\start_up.jpg to %WINDIR%\Help\Tours\htmlTour\start_up-riqq37rdut28kvi.jpg
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.CSharp-riqq37rdut28kvi.targets
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img149.jpg to %WINDIR%\Help\Tours\htmlTour\img149-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img100.jpg to %WINDIR%\Help\Tours\htmlTour\img100-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img103.jpg to %WINDIR%\Help\Tours\htmlTour\img103-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img109.jpg to %WINDIR%\Help\Tours\htmlTour\img109-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img110.jpg to %WINDIR%\Help\Tours\htmlTour\img110-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img116.jpg to %WINDIR%\Help\Tours\htmlTour\img116-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img121.jpg to %WINDIR%\Help\Tours\htmlTour\img121-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img123.jpg to %WINDIR%\Help\Tours\htmlTour\img123-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img126.jpg to %WINDIR%\Help\Tours\htmlTour\img126-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img136.jpg to %WINDIR%\Help\Tours\htmlTour\img136-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\img072.jpg to %WINDIR%\Help\Tours\htmlTour\img072-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\logo.jpg to %WINDIR%\Help\Tours\htmlTour\logo-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg to %WINDIR%\Help\Tours\htmlTour\pen_icon-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\question_icon.jpg to %WINDIR%\Help\Tours\htmlTour\question_icon-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost-riqq37rdut28kvi.jpg
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big-riqq37rdut28kvi.jpg
from %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg to %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe-riqq37rdut28kvi.jpg

Moves the following files:

from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8-riqq37rdut28kvi.db
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\find.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\find-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\error-48-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\close.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\close-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\blacklist_large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\blacklist_large-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\autoscroll.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\autoscroll-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-toolbar.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-toolbar-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\Filepicker.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\Filepicker-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\downloadButtons-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\key-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\key-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\themeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\themeGeneric-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-warning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-warning-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-info-negative.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-info-negative-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\sslWarning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\sslWarning-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\stripes-error-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\heart.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\heart-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\discover-logo.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\discover-logo-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-themes.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-themes-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-searchengines.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-searchengines-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-search.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-search-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-recent.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-recent-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-languages.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-languages-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-available.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\category-available-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\alerticon-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\alerticon-error-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\downloadButtons-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\media\throbber.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\media\throbber-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\windowControls.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\windowControls-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-large-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\localeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\localeGeneric-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\warning-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-48-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\discover-logo.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\discover-logo-riqq37rdut28kvi.png
from %ProgramFiles%\Movie Maker\Shared\Sample2.jpg to %ProgramFiles%\Movie Maker\Shared\Sample2-riqq37rdut28kvi.jpg
from %ProgramFiles%\Movie Maker\Shared\Sample1.jpg to %ProgramFiles%\Movie Maker\Shared\Sample1-riqq37rdut28kvi.jpg
from %ProgramFiles%\Movie Maker\Shared\paint.png to %ProgramFiles%\Movie Maker\Shared\paint-riqq37rdut28kvi.png
from %ProgramFiles%\Movie Maker\Shared\news.png to %ProgramFiles%\Movie Maker\Shared\news-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\preview.png to %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\preview-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png to %ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\update\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\update\downloadButtons-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\key-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\key-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\themeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\themeGeneric-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-warning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-warning-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-info-negative.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-info-negative-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\stripes-error-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\localeGeneric.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\localeGeneric-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\loading_16.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\loading_16-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\information-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-themes.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-themes-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-searchengines.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-searchengines-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-search.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-search-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-languages.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\category-languages-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\alerticon-error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\alerticon-error-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\downloadButtons.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\downloadButtons-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\media\throbber.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\media\throbber-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\windowControls.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\windowControls-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-large-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\warning-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\sslWarning.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\sslWarning-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\question-48-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\heart.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\heart-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Question.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Question-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\question-48-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options-sync.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Options-sync-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\searching_16.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\searching_16-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\libraryNavigation.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\libraryNavigation-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Toolbar.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Toolbar-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-throbber.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-throbber-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-bg.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-bg-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-32.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\sync-32-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Privacy-48.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Privacy-48-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\pageInfo.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\pageInfo-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor_16-10.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor_16-10-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\monitor-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\loading.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\loading-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\identity.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\identity-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\appmenu-icons.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\appmenu-icons-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-widget-left.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-widget-left-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-icon.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutRobots-icon-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon-small.png to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome-restore-icon-small-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\icon64.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\icon64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\icon48.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\icon48-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\icon128.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\icon128-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\about.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\about-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\about-wordmark.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\about-wordmark-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\content\branding\about-logo.png to %ProgramFiles%\FireFox\chrome\browser\content\branding\about-logo-riqq37rdut28kvi.png
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod-riqq37rdut28kvi.db
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3-riqq37rdut28kvi.db
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Geolocation-64.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\Geolocation-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\tabDragIndicator.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\tabDragIndicator-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\connecting.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\connecting-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\appmenu-icons.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\appmenu-icons-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\loading_16.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\loading_16-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\connecting.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\connecting-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-48-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-32.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\information-32-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Error.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Error-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-64.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-48.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\error-48-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\close.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\close-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\blacklist_large.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\blacklist_large-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\autoscroll.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\autoscroll-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-toolbar.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-toolbar-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\Filepicker.png to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\Filepicker-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\tabDragIndicator.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\tabDragIndicator-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\loading.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\loading-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Geolocation-64.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Geolocation-64-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options-sync.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\Options-sync-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\searching_16.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\searching_16-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryToolbar.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryToolbar-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryNavigation.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\libraryNavigation-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Toolbar.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Toolbar-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-throbber.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-throbber-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-bg.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-bg-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-32.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\sync-32-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Privacy-48.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\Privacy-48-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\pageInfo.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\pageInfo-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor_16-10.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor_16-10-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\monitor-riqq37rdut28kvi.png
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\identity.png to %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\identity-riqq37rdut28kvi.png
from %ProgramFiles%\Windows Media Player\npds.zip to %ProgramFiles%\Windows Media Player\npds-riqq37rdut28kvi.zip
from %ProgramFiles%\Windows NT\Pinball\table.bmp to %ProgramFiles%\Windows NT\Pinball\table-riqq37rdut28kvi.bmp

Modifies user data files (Trojan.Encoder).

Miscellaneous:

Executes the following:

'<SYSTEM32>\cmd.exe' /C net view
'<SYSTEM32>\net.exe' view

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial