Trojan.Encoder.29692

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'unlock' = '"c:\Decoding help.hta"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'searchfiles' = '%WINDIR%\searchfiles.exe'
[<HKLM>\Software\Classes\.[ID]ABeQZXcgq6Y3fYN6[ID]\shell\open\command] '' = '%WINDIR%\SysWow64\mshta.exe "c:\Decoding help.hta"'

Infects the following executable files

%ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow64\ffdshow.ax.[id]abeqzxcgq6y3fyn6[id]
%CommonProgramFiles%\microsoft shared\vc\msdia100.dll.[id]abeqzxcgq6y3fyn6[id]
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppc.dll.[id]abeqzxcgq6y3fyn6[id]
%CommonProgramFiles(x86)%\microsoft shared\office10\1033\msointl.dll.[id]abeqzxcgq6y3fyn6[id]
%CommonProgramFiles(x86)%\microsoft shared\vc\amd64\msdia80.dll.[id]abeqzxcgq6y3fyn6[id]
%CommonProgramFiles(x86)%\px storage engine\pxafs.dll.[id]abeqzxcgq6y3fyn6[id]
%ProgramFiles(x86)%\k-lite codec pack\filters\lav\avfilter-lav-5.dll.[id]abeqzxcgq6y3fyn6[id]
%ProgramFiles(x86)%\opera\29.0.1795.47\ffmpegsumo.dll.[id]abeqzxcgq6y3fyn6[id]
%ProgramFiles(x86)%\qip 2012\protos\jabber\jabber_cz.dll.[id]abeqzxcgq6y3fyn6[id]
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.dll.[id]abeqzxcgq6y3fyn6[id]
%CommonProgramFiles%\microsoft shared\vsto\vstoee.dll.[id]abeqzxcgq6y3fyn6[id]
%CommonProgramFiles(x86)%\microsoft shared\vc\msdia80.dll.[id]abeqzxcgq6y3fyn6[id]

Creates the following files on removable media

<Drive name for removable media>:\decoding help.hta
<Drive name for removable media>:\archer.avi

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

deletes volume shadow copies.

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\taskhost.exe
%WINDIR%\syswow64\vssadmin.exe
%WINDIR%\syswow64\werfault.exe

the following user processes:

iexplore.exe
firefox.exe

Modifies file system

Creates the following files

%WINDIR%\searchfiles.exe
%ProgramFiles(x86)%\mirc\defaults\scripts\decoding help.hta
%APPDATA%\icqm\icq\video\decoding help.hta
%CommonProgramFiles(x86)%\java\java update\decoding help.hta
%APPDATA%\microsoft\uproof\decoding help.hta
%APPDATA%\adobe\logtransport2\decoding help.hta
C:\far2\addons\macros\decoding help.hta
%APPDATA%\opera software\opera stable\decoding help.hta
%ProgramFiles%\defwatch\decoding help.hta
%ProgramFiles%\defensewall\decoding help.hta
%ProgramFiles%\dbtool\decoding help.hta
%ProgramFiles%\dbconvert\decoding help.hta
%ProgramFiles%\claw95\decoding help.hta
%ProgramFiles%\courier\decoding help.hta
%ProgramFiles%\cpd\decoding help.hta
%ProgramFiles%\cuteftp\decoding help.hta
%ProgramFiles%\csendto\decoding help.hta
%ProgramFiles%\copyx64\decoding help.hta
%ProgramFiles%\cmgrdian\decoding help.hta
%ProgramFiles%\clisvc\decoding help.hta
%ProgramFiles%\cmain\decoding help.hta
%ProgramFiles%\clrcche\decoding help.hta
%ProgramFiles%\cleaner\decoding help.hta
%ProgramFiles%\claw95cf\decoding help.hta
%ProgramFiles%\cleaner3\decoding help.hta
%ProgramFiles%\cssexc\decoding help.hta
%ProgramFiles%\clamwin\decoding help.hta
%ProgramFiles(x86)%\google\chrome\application\decoding help.hta
%ProgramFiles%\aim6\decoding help.hta
%ProgramFiles%\blackd\decoding help.hta
%ProgramFiles%\avgscan\decoding help.hta
%ProgramFiles%\avgupden\decoding help.hta
%ProgramFiles%\avgupsvc\decoding help.hta
%ProgramFiles%\avgvv\decoding help.hta
%ProgramFiles%\avinitnt\decoding help.hta
%ProgramFiles%\avgw\decoding help.hta
%ProgramFiles%\avgwizfw\decoding help.hta
%ProgramFiles%\avkservice\decoding help.hta
%ProgramFiles%\avkwctl\decoding help.hta
%ProgramFiles%\avkserv\decoding help.hta
%ProgramFiles(x86)%\microsoft.net\primary interop assemblies\decoding help.hta
C:\far2\addons\colors\decoding help.hta
%ProgramFiles(x86)%\pidgin\gtk\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow64\decoding help.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\decoding help.hta
%ProgramFiles%\admunch\decoding help.hta
%ProgramFiles%\amsn\decoding help.hta
%ProgramFiles%\360tray\decoding help.hta
%ProgramFiles(x86)%\qip 2012\protos\mra\decoding help.hta
%CommonProgramFiles(x86)%\system\en-us\decoding help.hta
%ProgramFiles(x86)%\qip 2012\protos\ximss\decoding help.hta
%ProgramFiles(x86)%\windows nt\accessories\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\msenv\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\portal\1033\decoding help.hta
%ProgramFiles%\clamtray\decoding help.hta
%ProgramFiles%\chrome\decoding help.hta
%ProgramFiles%\bdswitch\decoding help.hta
%ProgramFiles%\avgemc\decoding help.hta
%ProgramFiles%\avsynmgr\decoding help.hta
%ProgramFiles%\avscan\decoding help.hta
%ProgramFiles%\avgrssvc\decoding help.hta
%ProgramFiles%\avpm\decoding help.hta
%ProgramFiles%\avpcc\decoding help.hta
%ProgramFiles%\avnotify\decoding help.hta
%ProgramFiles%\avgnpsvc\decoding help.hta
%ProgramFiles%\avgnpdln\decoding help.hta
%ProgramFiles%\avginet\decoding help.hta
%ProgramFiles%\avgfwsrv\decoding help.hta
%ProgramFiles%\blindman\decoding help.hta
%ProgramFiles%\btinint\decoding help.hta
%ProgramFiles%\bdoesrv\decoding help.hta
%ProgramFiles%\avgamsvr\decoding help.hta
%ProgramFiles%\avadmin\decoding help.hta
%ProgramFiles%\avcenter\decoding help.hta
%ProgramFiles%\autotrace\decoding help.hta
%ProgramFiles%\avconsol\decoding help.hta
%ProgramFiles%\avconfig\decoding help.hta
%ProgramFiles%\autostartexplorer\decoding help.hta
%ProgramFiles%\ashupd\decoding help.hta
%ProgramFiles%\ashskpck\decoding help.hta
%ProgramFiles%\ashsimpl\decoding help.hta
%ProgramFiles%\avgcc\decoding help.hta
%ProgramFiles%\cabalmain\decoding help.hta
%ProgramFiles%\cemrep\decoding help.hta
%ProgramFiles%\bdwizreg\decoding help.hta
%ProgramFiles%\btini\decoding help.hta
%ProgramFiles%\ccsetmgr\decoding help.hta
%ProgramFiles%\custinstall\decoding help.hta
%ProgramFiles%\ccproxy\decoding help.hta
%ProgramFiles%\ccleaner\decoding help.hta
%ProgramFiles%\custsetup\decoding help.hta
%ProgramFiles%\ccevtmgr\decoding help.hta
%ProgramFiles%\ccapp\decoding help.hta
%ProgramFiles%\cavumas\decoding help.hta
%ProgramFiles%\cavvl\decoding help.hta
%ProgramFiles%\cavsubmit\decoding help.hta
%ProgramFiles%\cavuserupd\decoding help.hta
%ProgramFiles%\cavsub\decoding help.hta
%ProgramFiles%\cavscons\decoding help.hta
%ProgramFiles%\cavsn\decoding help.hta
%ProgramFiles%\cavse\decoding help.hta
%ProgramFiles%\cavoar\decoding help.hta
%ProgramFiles%\cavmud\decoding help.hta
%ProgramFiles%\cavq\decoding help.hta
%ProgramFiles%\cavmr\decoding help.hta
%ProgramFiles%\cavaud\decoding help.hta
%ProgramFiles%\cavemsrv\decoding help.hta
%ProgramFiles%\cavasm\decoding help.hta
%ProgramFiles%\cavapp\decoding help.hta
%ProgramFiles%\cafix\decoding help.hta
%ProgramFiles%\clamscan\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1036\decoding help.hta
%ProgramFiles%\bdsurvey\decoding help.hta
<LS_APPDATA>\microsoft\internet explorer\decoding help.hta
%PROGRAMDATA%\microsoft\msdn\7.0\2052\decoding help.hta
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\decoding help.hta
%HOMEPATH%\videos\decoding help.hta
%HOMEPATH%\favorites\msn websites\decoding help.hta
%ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\decoding help.hta
%PROGRAMDATA%\microsoft\windows nt\msscan\decoding help.hta
<LS_APPDATA>low\sun\java\jre1.8.0_45_x64\decoding help.hta
%ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\decoding help.hta
%CommonProgramFiles%\microsoft shared\textconv\decoding help.hta
%CommonProgramFiles%\microsoft shared\source engine\decoding help.hta
%APPDATA%\adobe\acrobat\dc\decoding help.hta
%ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\decoding help.hta
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\decoding help.hta
C:\users\public\music\sample music\decoding help.hta
%PROGRAMDATA%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\decoding help.hta
%ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\lib\decoding help.hta
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\decoding help.hta
%ProgramFiles(x86)%\mozilla thunderbird\defaults\messenger\decoding help.hta
%ProgramFiles(x86)%\mozilla thunderbird\defaults\pref\decoding help.hta
%ProgramFiles(x86)%\windows sidebar\gadgets\weather.gadget\decoding help.hta
%ProgramFiles(x86)%\windows sidebar\gadgets\calendar.gadget\decoding help.hta
%ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\decoding help.hta
%ProgramFiles(x86)%\windows nt\accessories\en-us\decoding help.hta
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\decoding help.hta
C:\users\all users\microsoft\crypto\rsa\machinekeys\decoding help.hta
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\decoding help.hta
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\adobe\arm\s\armmanifest.msi.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\identitycrl\ppcrlui.dll.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\1041\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\3082\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\dbgclr\7.1\1033\dbgclr.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\1040\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\1036\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\1033\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\1028\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\1031\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\1042\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\user account pictures\user.bmp.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\1046\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\1049\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\msdn\7.0\1050\dexplore.ctm.[id]abeqzxcgq6y3fyn6[id]
<LS_APPDATA>low\adobe\acrobat\dc\decoding help.hta
<LS_APPDATA>\adobe\acrocef\dc\acrobat\cookie\decoding help.hta
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\decoding help.hta
<LS_APPDATA>\microsoft\feeds cache\decoding help.hta
<LS_APPDATA>\microsoft\feeds\decoding help.hta
%CommonProgramFiles%\designer\decoding help.hta
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.[id]abeqzxcgq6y3fyn6[id]
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
%ProgramFiles%\autodown\decoding help.hta
%ProgramFiles%\avgdiag\decoding help.hta
%ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\decoding help.hta
C:\users\all users\microsoft\office\decoding help.hta
%APPDATA%\icqm\icq\fonts\decoding help.hta
%APPDATA%\icqm\icq\smiles\decoding help.hta
%ProgramFiles(x86)%\qip 2012\protos\sip\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\msinfo\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\msinfo\en-us\decoding help.hta
%CommonProgramFiles(x86)%\system\msadc\decoding help.hta
%PROGRAMDATA%\mozilla\logs\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1033\decoding help.hta
%ProgramFiles(x86)%\google\update\1.3.26.9\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\filters\lav\decoding help.hta
%APPDATA%\icqm\icq\dll\decoding help.hta
%ProgramFiles(x86)%\qip 2012\protos\social\decoding help.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\decoding help.hta
%ProgramFiles(x86)%\steam\amf\decoding help.hta
C:\users\public\libraries\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\filters\lav64\decoding help.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\decoding help.hta
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\decoding help.hta
%ProgramFiles%\bdagent\decoding help.hta
%ProgramFiles%\bdmcon\decoding help.hta
%ProgramFiles%\bdnews\decoding help.hta
%ProgramFiles%\bdss\decoding help.hta
%ProgramFiles%\bdsubmitwiz\decoding help.hta
%ProgramFiles(x86)%\pidgin\ca-certs\decoding help.hta
%APPDATA%\icqm\icq\database\decoding help.hta
%APPDATA%\icqm\icq\translation\decoding help.hta
%APPDATA%\icqm\icq\sounds\decoding help.hta
%CommonProgramFiles(x86)%\system\ado\en-us\decoding help.hta
%APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\office10\1033\decoding help.hta
%HOMEPATH%\saved games\decoding help.hta
%HOMEPATH%\pictures\decoding help.hta
%APPDATA%\microsoft\document building blocks\1033\14\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\textconv\wksconv\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vba\vba6\decoding help.hta
<LS_APPDATA>low\microsoft\internet explorer\services\decoding help.hta
%ProgramFiles(x86)%\internet explorer\mui\0409\decoding help.hta
%PROGRAMDATA%\microsoft\assistance\client\1.0\en-us\decoding help.hta
%ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.5\decoding help.hta
C:\users\all users\microsoft\office\documentrepository.ico.[id]abeqzxcgq6y3fyn6[id]
%PROGRAMDATA%\microsoft help\decoding help.hta
C:\users\all users\microsoft\officesoftwareprotectionplatform\tokens.dat.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\ntuser.pol.[id]abeqzxcgq6y3fyn6[id]
%APPDATA%\mra\update\decoding help.hta
%ProgramFiles(x86)%\winamp\components\decoding help.hta
C:\users\all users\microsoft toolkit\settings.xml.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log.[id]abeqzxcgq6y3fyn6[id]
<LS_APPDATA>low\oracle\java\au\decoding help.hta
%ProgramFiles(x86)%\google\update\install\{9d022011-ee23-41da-8ad6-0856955c454d}\decoding help.hta
C:\users\all users\microsoft\network\downloader\qmgr0.dat.[id]abeqzxcgq6y3fyn6[id]
C:\users\all users\microsoft\network\downloader\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\web server extensions\14\bin\decoding help.hta
<LS_APPDATA>\adobe\acrobat\dc\decoding help.hta
%ProgramFiles%\bdsubmit\decoding help.hta
%ProgramFiles%\aswupdsv\decoding help.hta
%ProgramFiles%\ashsimp2\decoding help.hta
%ProgramFiles%\ashserv\decoding help.hta
%CommonProgramFiles(x86)%\px storage engine\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\dao\decoding help.hta
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\icons\decoding help.hta
%ProgramFiles(x86)%\opera\29.0.1795.47\decoding help.hta
%ProgramFiles(x86)%\windows mail\decoding help.hta
%HOMEPATH%\music\decoding help.hta
%ProgramFiles(x86)%\windows photo viewer\decoding help.hta
%ProgramFiles(x86)%\windows sidebar\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\tools\decoding help.hta
%APPDATA%\icq-profile\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\filters\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\icaros\decoding help.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\decoding help.hta
%ProgramFiles(x86)%\windows media player\en-us\decoding help.hta
<LS_APPDATA>\decoding help.hta
%HOMEPATH%\desktop\decoding help.hta
%ProgramFiles(x86)%\qip 2012\decoding help.hta
%ProgramFiles%\aoltbserver\decoding help.hta
%ProgramFiles%\anti-trojan\decoding help.hta
%ProgramFiles%\armor2net\decoding help.hta
%ProgramFiles(x86)%\opera\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\decoding help.hta
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1042\decoding help.hta
%ProgramFiles(x86)%\microsoft office\office14\1033\decoding help.hta
%ProgramFiles%\aavshield\decoding help.hta
%ProgramFiles(x86)%\internet explorer\signup\decoding help.hta
%APPDATA%\qipguard\decoding help.hta
%APPDATA%\microsoft\mmc\decoding help.hta
%PROGRAMDATA%\microsoft\user account pictures\default pictures\decoding help.hta
%ProgramFiles(x86)%\opera\assets\decoding help.hta
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\decoding help.hta
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\decoding help.hta
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\decoding help.hta
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\decoding help.hta
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\decoding help.hta
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\decoding help.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\decoding help.hta
%APPDATA%\mozilla\firefox\crash reports\decoding help.hta
%APPDATA%\mozilla\firefox\decoding help.hta
%APPDATA%\mail.ru\agent\decoding help.hta
%APPDATA%\thunderbird\decoding help.hta
%APPDATA%\telegram desktop\decoding help.hta
%APPDATA%\mra\decoding help.hta
%ProgramFiles(x86)%\qip 2012\core\decoding help.hta
%ProgramFiles(x86)%\qip 2012\langs\decoding help.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\decoding help.hta
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\decoding help.hta
%PROGRAMDATA%\microsoft\user account pictures\decoding help.hta
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.[id]abeqzxcgq6y3fyn6[id]
C:\users\public\downloads\decoding help.hta
%ProgramFiles%\a2hijackfree\decoding help.hta
%ProgramFiles(x86)%\mirc\defaults\decoding help.hta
%ProgramFiles(x86)%\microsoft office\office10\decoding help.hta
%ProgramFiles(x86)%\mozilla thunderbird\decoding help.hta
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\decoding help.hta
C:\users\public\desktop\decoding help.hta
C:\users\public\decoding help.hta
%ProgramFiles(x86)%\mirc\decoding help.hta
%ProgramFiles(x86)%\windows media player\decoding help.hta
C:\users\default\decoding help.hta
%CommonProgramFiles(x86)%\adobe\arm\1.0\decoding help.hta
%ProgramFiles(x86)%\google\update\decoding help.hta
%PROGRAMDATA%\decoding help.hta
C:\far2\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\decoding help.hta
C:\users\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\decoding help.hta
%ProgramFiles(x86)%\internet explorer\decoding help.hta
C:\totalcmd\decoding help.hta
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
%ProgramFiles(x86)%\decoding help.hta
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
<Current directory>\decoding help.hta
C:\decoding help.hta
%HOMEPATH%\decoding help.hta
C:\far2\addons\decoding help.hta
%CommonProgramFiles(x86)%\adobe\helpcfg\en_us\decoding help.hta
%ProgramFiles%\ash\decoding help.hta
%ProgramFiles%\ageofconan\decoding help.hta
%HOMEPATH%\contacts\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\icaros\32-bit\decoding help.hta
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\info\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\decoding help.hta
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\decoding help.hta
%HOMEPATH%\downloads\decoding help.hta
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\decoding help.hta
%HOMEPATH%\links\decoding help.hta
%CommonProgramFiles(x86)%\system\decoding help.hta
%HOMEPATH%\favorites\decoding help.hta
%HOMEPATH%\documents\decoding help.hta
<LS_APPDATA>\applicationhistory\decoding help.hta
%ProgramFiles(x86)%\pidgin\decoding help.hta
%ProgramFiles(x86)%\microsoft office\office14\decoding help.hta
%ProgramFiles(x86)%\windows media player\media renderer\decoding help.hta
%ProgramFiles(x86)%\steam\decoding help.hta
%ProgramFiles(x86)%\windows defender\decoding help.hta
%ProgramFiles(x86)%\windows portable devices\decoding help.hta
%ProgramFiles(x86)%\msbuild\decoding help.hta
%ProgramFiles(x86)%\internet explorer\en-us\decoding help.hta
%ProgramFiles(x86)%\mozilla firefox\decoding help.hta
%ProgramFiles(x86)%\winamp\decoding help.hta
%CommonProgramFiles(x86)%\steam\decoding help.hta
%CommonProgramFiles(x86)%\services\decoding help.hta
%ProgramFiles%\a2service\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsto\10.0\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vs7debug\decoding help.hta
%APPDATA%\microsoft\internet explorer\quick launch\decoding help.hta
%ProgramFiles%\ahnsd\decoding help.hta
%ProgramFiles%\dekaron\decoding help.hta
%ProgramFiles%\alsvc\decoding help.hta
%ProgramFiles%\aimpro\decoding help.hta
%ProgramFiles%\ashavast\decoding help.hta
%ProgramFiles%\airdefense\decoding help.hta
%ProgramFiles%\antivirus\decoding help.hta
%ProgramFiles%\armorsurf\decoding help.hta
C:\users\public\videos\decoding help.hta
%ProgramFiles(x86)%\qip 2012\protos\inficq\decoding help.hta
<LS_APPDATA>\adobe\color\decoding help.hta
%ProgramFiles%\ashlogv\decoding help.hta
C:\users\all users\microsoft\identitycrl\decoding help.hta
C:\users\all users\microsoft\mf\decoding help.hta
%ProgramFiles(x86)%\windows nt\tabletextservice\decoding help.hta
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\decoding help.hta
C:\users\public\recorded tv\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\office14\1033\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vgx\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vs7debug\1033\decoding help.hta
C:\users\public\music\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1041\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1031\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1028\decoding help.hta
C:\users\all users\microsoft\ilscache\decoding help.hta
%ProgramFiles%\ashenhcd\decoding help.hta
%ProgramFiles%\ashdug\decoding help.hta
%ProgramFiles%\ashdisp\decoding help.hta
C:\users\public\pictures\decoding help.hta
%ProgramFiles%\aswregsvr\decoding help.hta
%ProgramFiles%\ash_updatemediator\decoding help.hta
%ProgramFiles%\ashwebsv\decoding help.hta
%ProgramFiles%\ashskpcc\decoding help.hta
%ProgramFiles%\ashmaisv\decoding help.hta
%ProgramFiles%\ashquick\decoding help.hta
%ProgramFiles%\ashpopwz\decoding help.hta
%ProgramFiles%\blackice\decoding help.hta
%ProgramFiles%\backweb-4476822\decoding help.hta
%ProgramFiles%\b2\decoding help.hta
%ProgramFiles%\avcmd\decoding help.hta
%ProgramFiles%\avciman\decoding help.hta
%ProgramFiles%\amon\decoding help.hta
%ProgramFiles%\a2cmd\decoding help.hta
%ProgramFiles%\agb5\decoding help.hta
%ProgramFiles%\about\decoding help.hta
%ProgramFiles%\ackwin32\decoding help.hta
%ProgramFiles%\a2wizard\decoding help.hta
%ProgramFiles%\a2start\decoding help.hta
%ProgramFiles%\a2upd\decoding help.hta
%ProgramFiles%\a2scan\decoding help.hta
%ProgramFiles%\a2guard\decoding help.hta
%ProgramFiles%\ashavsrv\decoding help.hta
%ProgramFiles%\ashchest\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\2052\decoding help.hta
%APPDATA%\icqm\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1046\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\information retrieval\decoding help.hta
%APPDATA%\microsoft\office\decoding help.hta
%APPDATA%\microsoft\templates\decoding help.hta
%APPDATA%\microsoft\publisher building blocks\decoding help.hta
%CommonProgramFiles(x86)%\system\ole db\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\stationery\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vsto\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\filters\haali\decoding help.hta
%ProgramFiles(x86)%\qip 2012\protos\jabber\decoding help.hta
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\portal\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\office14\decoding help.hta
%APPDATA%\microsoft\protect\decoding help.hta
%ProgramFiles(x86)%\windows sidebar\en-us\decoding help.hta
%ProgramFiles(x86)%\qip 2012\plugins\qipcurrency\decoding help.hta
%ProgramFiles(x86)%\qip 2012\plugins\qipweather\decoding help.hta
%ProgramFiles(x86)%\qip 2012\plugins\qipradio\decoding help.hta
%APPDATA%\mirc\decoding help.hta
%APPDATA%\ghisler\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\msdn\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\vc\decoding help.hta
%PROGRAMDATA%\microsoft toolkit\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\1.7\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\1.0\decoding help.hta
C:\far2\addons\setup\decoding help.hta
%ProgramFiles(x86)%\qip 2012\plugins\cards\decoding help.hta
%ProgramFiles%\decoding help.hta
%ProgramFiles%\almon\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\office10\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1050\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow\decoding help.hta
%APPDATA%\microsoft\dbgclr\7.1\decoding help.hta
C:\totalcmd\language\decoding help.hta
%ProgramFiles(x86)%\microsoft.net\redistlist\decoding help.hta
%APPDATA%\icq-profile\base\decoding help.hta
%APPDATA%\mra\base\decoding help.hta
%APPDATA%\microsoft\msdn\7.0\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\en-us\decoding help.hta
%APPDATA%\thunderbird\crash reports\decoding help.hta
%ProgramFiles(x86)%\qip 2012\plugins\win7helper\decoding help.hta
%APPDATA%\winamp\decoding help.hta
%ProgramFiles(x86)%\windows photo viewer\en-us\decoding help.hta
%ProgramFiles(x86)%\windows mail\en-us\decoding help.hta
%PROGRAMDATA%\microsoft\crypto\keys\decoding help.hta
C:\users\public\documents\decoding help.hta
%CommonProgramFiles(x86)%\system\ado\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\3082\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1049\decoding help.hta
C:\far2\addons\shell\decoding help.hta
C:\far2\addons\xlat\decoding help.hta
%ProgramFiles(x86)%\windows defender\en-us\decoding help.hta
%ProgramFiles(x86)%\mozilla thunderbird\dictionaries\decoding help.hta
%ProgramFiles(x86)%\windows media player\skins\decoding help.hta
%ProgramFiles(x86)%\mozilla thunderbird\isp\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1040\decoding help.hta
C:\users\all users\microsoft\mf\pending.grl.[id]abeqzxcgq6y3fyn6[id]

Moves the following files

from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\lav\avcodec-lav-56.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\lav\avcodec-lav-56.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\steam\amf\amf-component-vc-windesktop32.dll to %ProgramFiles(x86)%\steam\amf\amf-component-vc-windesktop32.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\lav64\avcodec-lav-56.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\lav64\avcodec-lav-56.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\opera\launcher.exe to %ProgramFiles(x86)%\opera\launcher.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\defaults\scripts\popups.ini to %ProgramFiles(x86)%\mirc\defaults\scripts\popups.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\isp\popfile.sfd to %ProgramFiles(x86)%\mozilla thunderbird\isp\popfile.sfd.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\isp\dspam.sfd to %ProgramFiles(x86)%\mozilla thunderbird\isp\dspam.sfd.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mra\update\languages.dict to %APPDATA%\mra\update\languages.dict.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office14\grooveex.dll to %ProgramFiles(x86)%\microsoft office\office14\grooveex.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mra\update\languages.aff to %APPDATA%\mra\update\languages.aff.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\winamp\components\ssdp.w6c to %ProgramFiles(x86)%\winamp\components\ssdp.w6c.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll to %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\voip_cz.dll to %ProgramFiles(x86)%\qip 2012\core\voip_cz.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\session.dbak to %APPDATA%\opera software\opera stable\session.dbak.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\session.db-journal to %APPDATA%\opera software\opera stable\session.db-journal.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\session.db to %APPDATA%\opera software\opera stable\session.db.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\quotamanager-journal to %APPDATA%\opera software\opera stable\quotamanager-journal.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\quotamanager to %APPDATA%\opera software\opera stable\quotamanager.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\origin bound certs-journal to %APPDATA%\opera software\opera stable\origin bound certs-journal.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\origin bound certs to %APPDATA%\opera software\opera stable\origin bound certs.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\login data-journal.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\google\update\1.3.26.9\googlecrashhandler.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googlecrashhandler.exe.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mra\base\mra.dbs to %APPDATA%\mra\base\mra.dbs.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\redistlist\assemblylist_4_client.xml to %ProgramFiles(x86)%\microsoft.net\redistlist\assemblylist_4_client.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\c1.dll to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\c1.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\voip_es.dll to %ProgramFiles(x86)%\qip 2012\core\voip_es.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sol.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\langs\french.dll to %ProgramFiles(x86)%\qip 2012\langs\french.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\haali\gdsmux.exe to %ProgramFiles(x86)%\k-lite codec pack\filters\haali\gdsmux.exe.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mra\update\languages.hash to %APPDATA%\mra\update\languages.hash.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaprojectui.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaprojectui.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaclientpkgui.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaclientpkgui.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.adapter.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.adapter.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\microsoft.visualstudio.tools.applications.project.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\microsoft.visualstudio.tools.applications.project.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\qipguard\chrome.dll to %APPDATA%\qipguard\chrome.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\gtk\contents to %ProgramFiles(x86)%\pidgin\gtk\contents.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\blocklist.xml to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\blocklist.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\haali\dsmux.exe to %ProgramFiles(x86)%\k-lite codec pack\filters\haali\dsmux.exe.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk to %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla firefox\breakpadinjector.dll to %ProgramFiles(x86)%\mozilla firefox\breakpadinjector.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\sounds\auth.mp3 to %APPDATA%\icqm\icq\sounds\auth.mp3.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office14\ieawsdc.dll to %ProgramFiles(x86)%\microsoft office\office14\ieawsdc.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\internet explorer\mui\0409\mscorier.dll to %ProgramFiles(x86)%\internet explorer\mui\0409\mscorier.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\voip_de.dll to %ProgramFiles(x86)%\qip 2012\core\voip_de.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\stdole.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\stdole.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\msdn\7.0\objbrow.dat to %APPDATA%\microsoft\msdn\7.0\objbrow.dat.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\msdatasrc.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\msdatasrc.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\ximss\ximss.dll to %ProgramFiles(x86)%\qip 2012\protos\ximss\ximss.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\mousephone.dll to %ProgramFiles(x86)%\qip 2012\core\mousephone.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\infiumdetect.dll to %ProgramFiles(x86)%\qip 2012\core\infiumdetect.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\google\update\install\{9d022011-ee23-41da-8ad6-0856955c454d}\42.0.2311.135_chrome_installer.exe to %ProgramFiles(x86)%\google\update\install\{9d022011-ee23-41da-8ad6-0856955c454d}\42.0.2311.135_chrome_installer.exe.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\translation\mralang_cz.xml to %APPDATA%\icqm\icq\translation\mralang_cz.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\dekaron\dekaron.exe to %ProgramFiles%\dekaron\dekaron.exe.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\dll\altergeo.msi to %APPDATA%\icqm\icq\dll\altergeo.msi.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\fonts\segoesc.ttf to %APPDATA%\icqm\icq\fonts\segoesc.ttf.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\sip\pics.dll to %ProgramFiles(x86)%\qip 2012\protos\sip\pics.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\inficq\inficq.dll to %ProgramFiles(x86)%\qip 2012\protos\inficq\inficq.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow\ffdshow.ax to %ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow\ffdshow.ax.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\dbgclr\7.1\objbrow.dat to %APPDATA%\microsoft\dbgclr\7.1\objbrow.dat.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\social\social.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\bdagent\bdagent.exe to %ProgramFiles%\bdagent\bdagent.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\bdmcon\bdmcon.exe to %ProgramFiles%\bdmcon\bdmcon.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\bdnews\bdnews.exe to %ProgramFiles%\bdnews\bdnews.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\bdss\bdss.exe to %ProgramFiles%\bdss\bdss.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe to %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\bdsubmit\bdsubmit.exe to %ProgramFiles%\bdsubmit\bdsubmit.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\bdsurvey\bdsurvey.exe to %ProgramFiles%\bdsurvey\bdsurvey.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\bdswitch\bdswitch.exe to %ProgramFiles%\bdswitch\bdswitch.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\bdwizreg\bdwizreg.exe to %ProgramFiles%\bdwizreg\bdwizreg.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\blackd\blackd.exe to %ProgramFiles%\blackd\blackd.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgscan\avgscan.exe to %ProgramFiles%\avgscan\avgscan.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\openlibeay32.dll to %ProgramFiles(x86)%\qip 2012\core\openlibeay32.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\adodb.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\adodb.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\voip.dll to %ProgramFiles(x86)%\qip 2012\core\voip.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\microsoft.stdformat.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\microsoft.stdformat.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\vistavolume.dll to %ProgramFiles(x86)%\qip 2012\core\vistavolume.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\history provider cache to %APPDATA%\opera software\opera stable\history provider cache.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\favorites.db-journal to %APPDATA%\opera software\opera stable\favorites.db-journal.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\sqlite3.dll to %ProgramFiles(x86)%\qip 2012\core\sqlite3.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\favorites.db to %APPDATA%\opera software\opera stable\favorites.db.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\favicons-journal.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\openssleay32.dll to %ProgramFiles(x86)%\qip 2012\core\openssleay32.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\unins000.exe to %ProgramFiles(x86)%\qip 2012\unins000.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\ximss\ximss_sk.dll to %ProgramFiles(x86)%\qip 2012\protos\ximss\ximss_sk.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\cookies-journal to %APPDATA%\opera software\opera stable\cookies-journal.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\ximss\ximss_ru.dll to %ProgramFiles(x86)%\qip 2012\protos\ximss\ximss_ru.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\cookies to %APPDATA%\opera software\opera stable\cookies.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\certificate revocation lists to %APPDATA%\opera software\opera stable\certificate revocation lists.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\ximss\ximss_de.dll to %ProgramFiles(x86)%\qip 2012\protos\ximss\ximss_de.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\browser.js to %APPDATA%\opera software\opera stable\browser.js.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\ximss\ximss_cz.dll to %ProgramFiles(x86)%\qip 2012\protos\ximss\ximss_cz.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\unins000.dat.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\microsoft.mshtml.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\microsoft.mshtml.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter64.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter64.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\bookmarksextras to %APPDATA%\opera software\opera stable\bookmarksextras.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\bookmarks.bak.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\voip_uk.dll to %ProgramFiles(x86)%\qip 2012\core\voip_uk.dll.[id]abeqzxcgq6y3fyn6[id]
from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\sounds\busy.mp3 to %APPDATA%\icqm\icq\sounds\busy.mp3.[id]abeqzxcgq6y3fyn6[id]
from %TEMP%\adobearm.log to %TEMP%\adobearm.log.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\chrome\icons\default\abcardwindow.ico to %ProgramFiles(x86)%\mozilla thunderbird\chrome\icons\default\abcardwindow.ico.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\lib\cordebug.tlb to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\lib\cordebug.tlb.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\eudora\eudora.exe to %ProgramFiles%\eudora\eudora.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\jabber\jabber_cz.dll to %ProgramFiles(x86)%\qip 2012\protos\jabber\jabber_cz.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\smilies\qip smilies\aa.gif to %ProgramFiles(x86)%\qip 2012\smilies\qip smilies\aa.gif.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mra\base\opt.dbs to %APPDATA%\mra\base\opt.dbs.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\defaults\messenger\mailviews.dat to %ProgramFiles(x86)%\mozilla thunderbird\defaults\messenger\mailviews.dat.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\assert.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\assert.h.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\avformat-ics-56.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\avformat-ics-56.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\icaros\32-bit\avformat-ics-56.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\32-bit\avformat-ics-56.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\unins000.exe to %ProgramFiles(x86)%\k-lite codec pack\unins000.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\google\chrome\application\debug.log to %ProgramFiles(x86)%\google\chrome\application\debug.log.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\defaults\pref\channel-prefs.js to %ProgramFiles(x86)%\mozilla thunderbird\defaults\pref\channel-prefs.js.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx to %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\83aa4cc77f591dfc2374580bbd95f6ba_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\83aa4cc77f591dfc2374580bbd95f6ba_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icqsetup.exe to %APPDATA%\icqm\icqsetup.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool.exe to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\icons\x264vfw.ico to %ProgramFiles(x86)%\k-lite codec pack\icons\x264vfw.ico.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\msdis140.dll to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\msdis140.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\mscordmp.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\mscordmp.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\microsoft.visualstudio.ldo to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\microsoft.visualstudio.ldo.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\microsoft.visualstudio.dll to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\microsoft.visualstudio.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\microsoft.visualstudio.designer.interfaces.dll to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\microsoft.visualstudio.designer.interfaces.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\translation\mralang_de.xml to %APPDATA%\icqm\icq\translation\mralang_de.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\lav64\avfilter-lav-5.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\lav64\avfilter-lav-5.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\gtk\bin\freetype6.dll to %ProgramFiles(x86)%\pidgin\gtk\bin\freetype6.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\msvcp71.dll to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\msvcp71.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\mra\util\qip2mra.ini to %ProgramFiles(x86)%\qip 2012\protos\mra\util\qip2mra.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla firefox\crashreporter.exe to %ProgramFiles(x86)%\mozilla firefox\crashreporter.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office14\1033\mapishellr.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\mapishellr.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\maintenanceservice_installer.exe to %ProgramFiles(x86)%\mozilla thunderbird\maintenanceservice_installer.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dx9_43.dll to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dx9_43.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow\ffmpeg.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow\ffmpeg.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\24a81978-4594-42c5-80e9-bcd9abebab41 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\24a81978-4594-42c5-80e9-bcd9abebab41.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\dll\mailrusputnik.exe to %APPDATA%\icqm\icq\dll\mailrusputnik.exe.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\sounds\call_in.wav to %APPDATA%\icqm\icq\sounds\call_in.wav.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\1pix.gif to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\docs\1pix.gif.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\appcenter_r.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\appcenter_r.aapp.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\sounds\qip sounds\sndadded.wav to %ProgramFiles(x86)%\qip 2012\sounds\qip sounds\sndadded.wav.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\cpde.dll to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\cpde.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp to %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\extension state\000003.ldb to %APPDATA%\opera software\opera stable\extension state\000003.ldb.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\lib\kernel32.lib to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\lib\kernel32.lib.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\google\chrome\application\visualelementsmanifest.xml to %ProgramFiles(x86)%\google\chrome\application\visualelementsmanifest.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\mgmtclassgen.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\mgmtclassgen.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgupden\avgupden.exe to %ProgramFiles%\avgupden\avgupden.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\makecert.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\makecert.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\voip_sk.dll to %ProgramFiles(x86)%\qip 2012\core\voip_sk.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\winamp.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\voip_ru.dll to %ProgramFiles(x86)%\qip 2012\core\voip_ru.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\voip_pt.dll to %ProgramFiles(x86)%\qip 2012\core\voip_pt.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\voip_kk.dll to %ProgramFiles(x86)%\qip 2012\core\voip_kk.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yastatic.net\settings.sol to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yastatic.net\settings.sol.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\settings.sol to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\settings.sol.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\haali\mkx.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\haali\mkx.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\haali\mkunicode.x64.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\haali\mkunicode.x64.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\haali\mkunicode.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\haali\mkunicode.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\c1xx.dll to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\c1xx.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\social\social_cz.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_cz.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\winamp\elevatorps.dll to %ProgramFiles(x86)%\winamp\elevatorps.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\winamp\links.xml to %APPDATA%\winamp\links.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\voip_fr.dll to %ProgramFiles(x86)%\qip 2012\core\voip_fr.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\adobe\acrobat\dc\tmdocs.sav to %APPDATA%\adobe\acrobat\dc\tmdocs.sav.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\opera\29.0.1795.47\ffmpegsumo.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\ffmpegsumo.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\lav\avfilter-lav-5.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\lav\avfilter-lav-5.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\steam\amf\amf-component-vc-windesktop64.dll to %ProgramFiles(x86)%\steam\amf\amf-component-vc-windesktop64.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\steam\appoverlay64.dll to %ProgramFiles(x86)%\steam\appoverlay64.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\etherd\etherd.exe to %ProgramFiles%\etherd\etherd.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\dictionaries\ru.dic to %ProgramFiles(x86)%\mozilla thunderbird\dictionaries\ru.dic.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\sip\sip.dll to %ProgramFiles(x86)%\qip 2012\protos\sip\sip.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\qipguard\qipguard.exe to %APPDATA%\qipguard\qipguard.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\nss3.dll to %ProgramFiles(x86)%\pidgin\nss3.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\jbimp.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\jbimp.exe.config.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\social\social_de.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_de.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\jbimp.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\jbimp.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\ildasm.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\ildasm.exe.config.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\ildasm.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\ildasm.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\gacutil.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\gacutil.exe.config.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\gacutil.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\gacutil.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\fuslogvw.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\fuslogvw.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\disco.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\disco.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\dasmhlp.hlp to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\dasmhlp.hlp.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\dasmhlp.cnt to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\dasmhlp.cnt.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\cordbg.exe.config to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\cordbg.exe.config.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\cordbg.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\cordbg.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\chktrust.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\chktrust.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\certmgr.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\certmgr.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\cert2spc.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\cert2spc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\aximp.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\aximp.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\1033\msdbgui.dll to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\1033\msdbgui.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\siteprefs.json.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\google\update\1.3.26.9\googlecrashhandler64.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googlecrashhandler64.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\cl.exe to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\cl.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\c2.dll to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\c2.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\social\social_kk.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_kk.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\winamp\jnetlib.dll to %ProgramFiles(x86)%\winamp\jnetlib.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\social\social_fr.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_fr.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\social\social_es.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_es.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\ylusbtel.dll to %ProgramFiles(x86)%\qip 2012\core\ylusbtel.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\lc.exe to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\bin\lc.exe.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mail.ru\agent\magent.exe to %APPDATA%\mail.ru\agent\magent.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgupsvc\avgupsvc.exe to %ProgramFiles%\avgupsvc\avgupsvc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cmgrdian\cmgrdian.exe to %ProgramFiles%\cmgrdian\cmgrdian.exe.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq.exe to %APPDATA%\icqm\icq.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mail.ru\agent\libvoip_x86.dll to %APPDATA%\mail.ru\agent\libvoip_x86.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\mmc\taskschd to %APPDATA%\microsoft\mmc\taskschd.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\langs\czech.dll to %ProgramFiles(x86)%\qip 2012\langs\czech.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mra\installerlang.xml to %APPDATA%\mra\installerlang.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\core\bass.dll to %ProgramFiles(x86)%\qip 2012\core\bass.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter.dll.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icq-profile\installerlang.xml to %APPDATA%\icq-profile\installerlang.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dcompiler_43.dll to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dcompiler_43.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\icons\config.ico to %ProgramFiles(x86)%\k-lite codec pack\icons\config.ico.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\windows sidebar\settings.ini to %ProgramFiles(x86)%\windows sidebar\settings.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\opera\29.0.1795.47\d3dcompiler_47.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\d3dcompiler_47.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\avcodec-ics-56.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\avcodec-ics-56.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\qip.exe to %ProgramFiles(x86)%\qip 2012\qip.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\aoltbserver.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\anti-trojan\anti-trojan.exe to %ProgramFiles%\anti-trojan\anti-trojan.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\armor2net\armor2net.exe to %ProgramFiles%\armor2net\armor2net.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\plugins\qipradio\qipradio.dll to %ProgramFiles(x86)%\qip 2012\plugins\qipradio\qipradio.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\plugins\qipcurrency\qipcurrency.dll to %ProgramFiles(x86)%\qip 2012\plugins\qipcurrency\qipcurrency.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\ashdug.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\plugins\cards\cards.dll to %ProgramFiles(x86)%\qip 2012\plugins\cards\cards.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\ashenhcd.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\ashlogv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\ahnsd.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\alsvc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\aimpro.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\ashavast.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\airdefense.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\armorsurf\armorsurf.exe to %ProgramFiles%\armorsurf\armorsurf.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\dictionaries\ru.aff to %ProgramFiles(x86)%\mozilla thunderbird\dictionaries\ru.aff.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\isp\bogofilter.sfd to %ProgramFiles(x86)%\mozilla thunderbird\isp\bogofilter.sfd.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\langs\english.dll to %ProgramFiles(x86)%\qip 2012\langs\english.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\info\faq.css to %ProgramFiles(x86)%\k-lite codec pack\info\faq.css.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\almon.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\microsoft\publisher building blocks\contentstore.xml to %APPDATA%\microsoft\publisher building blocks\contentstore.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\haali\cue2xml.js to %ProgramFiles(x86)%\k-lite codec pack\filters\haali\cue2xml.js.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\jabber\jabber.dll to %ProgramFiles(x86)%\qip 2012\protos\jabber\jabber.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\icons\delete.ico to %ProgramFiles(x86)%\k-lite codec pack\icons\delete.ico.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\internet explorer\signup\install.ins to %ProgramFiles(x86)%\internet explorer\signup\install.ins.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla firefox\application.ini to %ProgramFiles(x86)%\mozilla firefox\application.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office14\1033\grooveintlresource.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\grooveintlresource.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office14\1033\bhointl.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\bhointl.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\plugins\qipweather\qipweather.dll to %ProgramFiles(x86)%\qip 2012\plugins\qipweather\qipweather.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\a2service.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libmeanwhile-1.dll to %ProgramFiles(x86)%\pidgin\libmeanwhile-1.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\freebl3.chk to %ProgramFiles(x86)%\mozilla thunderbird\freebl3.chk.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\dependentlibs.list to %ProgramFiles(x86)%\mozilla thunderbird\dependentlibs.list.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libjabber.dll to %ProgramFiles(x86)%\pidgin\libjabber.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\freebl3.dll to %ProgramFiles(x86)%\pidgin\freebl3.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\mirc.exe to %ProgramFiles(x86)%\mirc\mirc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office10\ucscribe.dll to %ProgramFiles(x86)%\microsoft office\office10\ucscribe.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\d3dcompiler_43.dll to %ProgramFiles(x86)%\mozilla thunderbird\d3dcompiler_43.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office10\trigram.lex to %ProgramFiles(x86)%\microsoft office\office10\trigram.lex.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\crashreporter.ini to %ProgramFiles(x86)%\mozilla thunderbird\crashreporter.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\exchndl.dll to %ProgramFiles(x86)%\pidgin\exchndl.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office10\thdic.lex to %ProgramFiles(x86)%\microsoft office\office10\thdic.lex.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\crashreporter.exe to %ProgramFiles(x86)%\mozilla thunderbird\crashreporter.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\ash.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\defaults\urls.ini to %ProgramFiles(x86)%\mirc\defaults\urls.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office10\seqchk10.dll to %ProgramFiles(x86)%\microsoft office\office10\seqchk10.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\defaults\servers.ini to %ProgramFiles(x86)%\mirc\defaults\servers.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\breakpadinjector.dll to %ProgramFiles(x86)%\mozilla thunderbird\breakpadinjector.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\google\update\googleupdate.exe to %ProgramFiles(x86)%\google\update\googleupdate.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office10\saext.dll to %ProgramFiles(x86)%\microsoft office\office10\saext.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\blocklist.xml to %ProgramFiles(x86)%\mozilla thunderbird\blocklist.xml.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\defaults\mirc.ini to %ProgramFiles(x86)%\mirc\defaults\mirc.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\application.ini to %ProgramFiles(x86)%\mozilla thunderbird\application.ini.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\accessiblemarshal.dll to %ProgramFiles(x86)%\mozilla thunderbird\accessiblemarshal.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office10\msostyle.dll to %ProgramFiles(x86)%\microsoft office\office10\msostyle.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\freebl3.dll to %ProgramFiles(x86)%\mozilla thunderbird\freebl3.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\a2hijackfree.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\uninstall.exe to %ProgramFiles(x86)%\mirc\uninstall.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\ageofconan.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\icaros\32-bit\avcodec-ics-56.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\32-bit\avcodec-ics-56.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\info\contents.rtf to %ProgramFiles(x86)%\k-lite codec pack\info\contents.rtf.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\steam\appoverlay.dll to %ProgramFiles(x86)%\steam\appoverlay.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\winamp\burnlib.dll to %ProgramFiles(x86)%\winamp\burnlib.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla firefox\accessiblemarshal.dll to %ProgramFiles(x86)%\mozilla firefox\accessiblemarshal.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\microsoft office\office14\authzax.dll to %ProgramFiles(x86)%\microsoft office\office14\authzax.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\libglesv2.dll to %ProgramFiles(x86)%\mozilla thunderbird\libglesv2.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\libegl.dll to %ProgramFiles(x86)%\mozilla thunderbird\libegl.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\install.log to %ProgramFiles(x86)%\mozilla thunderbird\install.log.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libxml2-2.dll to %ProgramFiles(x86)%\pidgin\libxml2-2.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libssp-0.dll to %ProgramFiles(x86)%\pidgin\libssp-0.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\icuuc52.dll to %ProgramFiles(x86)%\mozilla thunderbird\icuuc52.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libsilcclient-1-1-3.dll to %ProgramFiles(x86)%\pidgin\libsilcclient-1-1-3.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\icuin52.dll to %ProgramFiles(x86)%\mozilla thunderbird\icuin52.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libsilc-1-1-2.dll to %ProgramFiles(x86)%\pidgin\libsilc-1-1-2.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libsasl.dll to %ProgramFiles(x86)%\pidgin\libsasl.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\icudt52.dll to %ProgramFiles(x86)%\mozilla thunderbird\icudt52.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libpurple.dll to %ProgramFiles(x86)%\pidgin\libpurple.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libplds4.dll to %ProgramFiles(x86)%\pidgin\libplds4.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libplc4.dll to %ProgramFiles(x86)%\pidgin\libplc4.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\liboscar.dll to %ProgramFiles(x86)%\pidgin\liboscar.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\gkmedias.dll to %ProgramFiles(x86)%\mozilla thunderbird\gkmedias.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libnspr4.dll to %ProgramFiles(x86)%\pidgin\libnspr4.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\aavshield.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\autostartexplorer\autostartexplorer.exe to %ProgramFiles%\autostartexplorer\autostartexplorer.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avinitnt\avinitnt.exe to %ProgramFiles%\avinitnt\avinitnt.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\ashavsrv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cmain\cmain.exe to %ProgramFiles%\cmain\cmain.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\clrcche\clrcche.exe to %ProgramFiles%\clrcche\clrcche.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cleaner\cleaner.exe to %ProgramFiles%\cleaner\cleaner.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\claw95cf\claw95cf.exe to %ProgramFiles%\claw95cf\claw95cf.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cleaner3\cleaner3.exe to %ProgramFiles%\cleaner3\cleaner3.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\clamwin\clamwin.exe to %ProgramFiles%\clamwin\clamwin.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\claw95\claw95.exe to %ProgramFiles%\claw95\claw95.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\clamtray\clamtray.exe to %ProgramFiles%\clamtray\clamtray.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\clamscan\clamscan.exe to %ProgramFiles%\clamscan\clamscan.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\chrome\chrome.exe to %ProgramFiles%\chrome\chrome.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cemrep\cemrep.exe to %ProgramFiles%\cemrep\cemrep.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ccsetmgr\ccsetmgr.exe to %ProgramFiles%\ccsetmgr\ccsetmgr.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\custinstall\custinstall.exe to %ProgramFiles%\custinstall\custinstall.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ccproxy\ccproxy.exe to %ProgramFiles%\ccproxy\ccproxy.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ccleaner\ccleaner.exe to %ProgramFiles%\ccleaner\ccleaner.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\custsetup\custsetup.exe to %ProgramFiles%\custsetup\custsetup.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ccevtmgr\ccevtmgr.exe to %ProgramFiles%\ccevtmgr\ccevtmgr.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ccapp\ccapp.exe to %ProgramFiles%\ccapp\ccapp.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavumas\cavumas.exe to %ProgramFiles%\cavumas\cavumas.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavvl\cavvl.exe to %ProgramFiles%\cavvl\cavvl.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavsubmit\cavsubmit.exe to %ProgramFiles%\cavsubmit\cavsubmit.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavuserupd\cavuserupd.exe to %ProgramFiles%\cavuserupd\cavuserupd.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavsub\cavsub.exe to %ProgramFiles%\cavsub\cavsub.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavscons\cavscons.exe to %ProgramFiles%\cavscons\cavscons.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavsn\cavsn.exe to %ProgramFiles%\cavsn\cavsn.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavse\cavse.exe to %ProgramFiles%\cavse\cavse.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavoar\cavoar.exe to %ProgramFiles%\cavoar\cavoar.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\clisvc\clisvc.exe to %ProgramFiles%\clisvc\clisvc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\copyx64\copyx64.exe to %ProgramFiles%\copyx64\copyx64.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\ashchest.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\csendto\csendto.exe to %ProgramFiles%\csendto\csendto.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgw\avgw.exe to %ProgramFiles%\avgw\avgw.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgwizfw\avgwizfw.exe to %ProgramFiles%\avgwizfw\avgwizfw.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avkservice\avkservice.exe to %ProgramFiles%\avkservice\avkservice.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avkwctl\avkwctl.exe to %ProgramFiles%\avkwctl\avkwctl.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avkserv\avkserv.exe to %ProgramFiles%\avkserv\avkserv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\plugins\win7helper\win7helper.dll to %ProgramFiles(x86)%\qip 2012\plugins\win7helper\win7helper.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\aim6.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\pidgin\libymsg.dll to %ProgramFiles(x86)%\pidgin\libymsg.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow64\ffdshow.ax to %ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow64\ffdshow.ax.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\admunch.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\amsn.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\360tray.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\winamp\elevator.exe to %ProgramFiles(x86)%\winamp\elevator.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\qip 2012\protos\mra\mra.dll to %ProgramFiles(x86)%\qip 2012\protos\mra\mra.dll.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\google\chrome\application\chrome.exe to %ProgramFiles(x86)%\google\chrome\application\chrome.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mirc\defaults\scripts\aliases.ini to %ProgramFiles(x86)%\mirc\defaults\scripts\aliases.ini.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\icqm\icq\video\video.swf to %APPDATA%\icqm\icq\video\video.swf.[id]abeqzxcgq6y3fyn6[id]
from %APPDATA%\adobe\logtransport2\logtransport2.cfg to %APPDATA%\adobe\logtransport2\logtransport2.cfg.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\defwatch\defwatch.exe to %ProgramFiles%\defwatch\defwatch.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\defensewall\defensewall.exe to %ProgramFiles%\defensewall\defensewall.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\dbtool\dbtool.exe to %ProgramFiles%\dbtool\dbtool.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\dbconvert\dbconvert.exe to %ProgramFiles%\dbconvert\dbconvert.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\courier\courier.exe to %ProgramFiles%\courier\courier.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cssexc\cssexc.exe to %ProgramFiles%\cssexc\cssexc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles(x86)%\mozilla thunderbird\maintenanceservice.exe to %ProgramFiles(x86)%\mozilla thunderbird\maintenanceservice.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cpd\cpd.exe to %ProgramFiles%\cpd\cpd.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cuteftp\cuteftp.exe to %ProgramFiles%\cuteftp\cuteftp.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavmud\cavmud.exe to %ProgramFiles%\cavmud\cavmud.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgvv\avgvv.exe to %ProgramFiles%\avgvv\avgvv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavq\cavq.exe to %ProgramFiles%\cavq\cavq.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashupd\ashupd.exe to %ProgramFiles%\ashupd\ashupd.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashsimpl\ashsimpl.exe to %ProgramFiles%\ashsimpl\ashsimpl.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\autodown\autodown.exe to %ProgramFiles%\autodown\autodown.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\aswupdsv\aswupdsv.exe to %ProgramFiles%\aswupdsv\aswupdsv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashsimp2\ashsimp2.exe to %ProgramFiles%\ashsimp2\ashsimp2.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\ashserv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\aswregsvr\aswregsvr.exe to %ProgramFiles%\aswregsvr\aswregsvr.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe to %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashwebsv\ashwebsv.exe to %ProgramFiles%\ashwebsv\ashwebsv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashskpcc\ashskpcc.exe to %ProgramFiles%\ashskpcc\ashskpcc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\ashmaisv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashquick\ashquick.exe to %ProgramFiles%\ashquick\ashquick.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashpopwz\ashpopwz.exe to %ProgramFiles%\ashpopwz\ashpopwz.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\blackice\blackice.exe to %ProgramFiles%\blackice\blackice.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\backweb-4476822\backweb-4476822.exe to %ProgramFiles%\backweb-4476822\backweb-4476822.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\b2\b2.exe to %ProgramFiles%\b2\b2.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avcmd\avcmd.exe to %ProgramFiles%\avcmd\avcmd.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avciman\avciman.exe to %ProgramFiles%\avciman\avciman.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\amon\amon.exe to %ProgramFiles%\amon\amon.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\agb5.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\about.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\ackwin32.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\a2start.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\a2upd.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\a2scan.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\a2guard.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashskpck\ashskpck.exe to %ProgramFiles%\ashskpck\ashskpck.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\ashdisp.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavaud\cavaud.exe to %ProgramFiles%\cavaud\cavaud.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avconfig\avconfig.exe to %ProgramFiles%\avconfig\avconfig.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavemsrv\cavemsrv.exe to %ProgramFiles%\cavemsrv\cavemsrv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavasm\cavasm.exe to %ProgramFiles%\cavasm\cavasm.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavapp\cavapp.exe to %ProgramFiles%\cavapp\cavapp.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cafix\cafix.exe to %ProgramFiles%\cafix\cafix.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cabalmain\cabalmain.exe to %ProgramFiles%\cabalmain\cabalmain.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\blindman\blindman.exe to %ProgramFiles%\blindman\blindman.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\bdoesrv\bdoesrv.exe to %ProgramFiles%\bdoesrv\bdoesrv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\btinint\btinint.exe to %ProgramFiles%\btinint\btinint.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\btini\btini.exe to %ProgramFiles%\btini\btini.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avsynmgr\avsynmgr.exe to %ProgramFiles%\avsynmgr\avsynmgr.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avscan\avscan.exe to %ProgramFiles%\avscan\avscan.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgrssvc\avgrssvc.exe to %ProgramFiles%\avgrssvc\avgrssvc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avpm\avpm.exe to %ProgramFiles%\avpm\avpm.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avpcc\avpcc.exe to %ProgramFiles%\avpcc\avpcc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avnotify\avnotify.exe to %ProgramFiles%\avnotify\avnotify.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgnpsvc\avgnpsvc.exe to %ProgramFiles%\avgnpsvc\avgnpsvc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgnpdln\avgnpdln.exe to %ProgramFiles%\avgnpdln\avgnpdln.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avginet\avginet.exe to %ProgramFiles%\avginet\avginet.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgfwsrv\avgfwsrv.exe to %ProgramFiles%\avgfwsrv\avgfwsrv.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgemc\avgemc.exe to %ProgramFiles%\avgemc\avgemc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgdiag\avgdiag.exe to %ProgramFiles%\avgdiag\avgdiag.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgcc\avgcc.exe to %ProgramFiles%\avgcc\avgcc.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avgamsvr\avgamsvr.exe to %ProgramFiles%\avgamsvr\avgamsvr.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avadmin\avadmin.exe to %ProgramFiles%\avadmin\avadmin.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avcenter\avcenter.exe to %ProgramFiles%\avcenter\avcenter.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\autotrace\autotrace.exe to %ProgramFiles%\autotrace\autotrace.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\avconsol\avconsol.exe to %ProgramFiles%\avconsol\avconsol.exe.[id]abeqzxcgq6y3fyn6[id]
from %ProgramFiles%\cavmr\cavmr.exe to %ProgramFiles%\cavmr\cavmr.exe.[id]abeqzxcgq6y3fyn6[id]
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.[id]abeqzxcgq6y3fyn6[id]

Substitutes the following executable files

<Full path to file>

Substitutes the following files

%CommonProgramFiles(x86)%\Services\verisign.bmp
%PROGRAMDATA%\Microsoft Toolkit\Settings.xml
%PROGRAMDATA%\Microsoft\User Account Pictures\guest.bmp

Moves itself

from <Full path to file> to <Full path to file>.[id]abeqzxcgq6y3fyn6[id]

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all' (with hidden window)
'%WINDIR%\syswow64\werfault.exe' -u -p 1976 -s 1392' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial