Trojan.Encoder.29752

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\Г«ГґГ§Г©ГҐiГµГ¤

Creates the following files on removable media

%TEMP%\split.avi.non
%TEMP%\sdksampleunprivdeveloper.cer.non
<Drive name for removable media>:\sdksampleunprivdeveloper.cer.non
%TEMP%\contoso_1.cer.non
<Drive name for removable media>:\contoso_1.cer.non
%TEMP%\contoso.cer.non
<Drive name for removable media>:\contoso.cer.non
%TEMP%\contosoroot.cer.non
%TEMP%\coffee.bmp.non
<Drive name for removable media>:\contosoroot.cer.non
<Drive name for removable media>:\testcertificate.cer.non
%TEMP%\sdksampleprivdeveloper.cer.non
<Drive name for removable media>:\sdksampleprivdeveloper.cer.non
%TEMP%\hanni_umami_chapter.doc.non
<Drive name for removable media>:\hanni_umami_chapter.doc.non
%TEMP%\applicantform_en.doc.non
<Drive name for removable media>:\applicantform_en.doc.non
%TEMP%\contosoroot_1.cer.non
<Drive name for removable media>:\contosoroot_1.cer.non
<Drive name for removable media>:\dashborder_192.bmp.non
%TEMP%\dashborder_192.bmp.non
<Drive name for removable media>:\dashborder_120.bmp.non
%TEMP%\join.avi.non
<Drive name for removable media>:\join.avi.non
%TEMP%\tileimage.bmp.non
<Drive name for removable media>:\tileimage.bmp.non
%TEMP%\correct.avi.non
<Drive name for removable media>:\correct.avi.non
%TEMP%\dialmap.bmp.non
%TEMP%\calc.exe.non
%TEMP%\testcertificate.cer.non
<Drive name for removable media>:\dialmap.bmp.non
%TEMP%\dial.bmp.non
<Drive name for removable media>:\dial.bmp.non
%TEMP%\dashborder_96.bmp.non
<Drive name for removable media>:\dashborder_96.bmp.non
%TEMP%\dashborder_144.bmp.non
<Drive name for removable media>:\dashborder_144.bmp.non
%TEMP%\dashborder_120.bmp.non
<Drive name for removable media>:\split.avi.non
<Drive name for removable media>:\coffee.bmp.non
<Drive name for removable media>:\calc.exe.non

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files

Executes the following

'<SYSTEM32>\net.exe' stop mssqlserver
'<SYSTEM32>\net.exe' stop mssql$sqlexpress
'<SYSTEM32>\net.exe' stop mikroclientwservice
'<SYSTEM32>\net.exe' stop reportserver
'<SYSTEM32>\net.exe' stop sqlserveragent
'<SYSTEM32>\net.exe' stop MSSQL$MIKRO
'<SYSTEM32>\net.exe' stop msdtc
'<SYSTEM32>\net.exe' stop sqltelemetryvv
'<SYSTEM32>\taskkill.exe' /F /IM jusched.exe
'<SYSTEM32>\taskkill.exe' /F /IM tv_w32.exe
'<SYSTEM32>\taskkill.exe' /F /IM jucheck.exe
'<SYSTEM32>\taskkill.exe' /F /IM IAStorDataMgrSvc.exe
'<SYSTEM32>\taskkill.exe' /F /IM IAStorIcon.exe
'<SYSTEM32>\taskkill.exe' /F /IM isa.exe
'<SYSTEM32>\taskkill.exe' /F /IM armsvc.exe
'<SYSTEM32>\taskkill.exe' /F /IM TeamViewer.exe
'<SYSTEM32>\taskkill.exe' /F /IM TeamViewer_Service.exe
'<SYSTEM32>\net.exe' stop sqltelemetry$sqlexpress
'<SYSTEM32>\taskkill.exe' /F /IM Veam.EndPoint.Tray.exe
'<SYSTEM32>\net.exe' stop sqlagent$sql2008exp
'<SYSTEM32>\net.exe' stop mysql
'<SYSTEM32>\net.exe' stop sqlwriter
'<SYSTEM32>\net.exe' stop VeeamEndpointBackupSvc
'<SYSTEM32>\net.exe' stop mssqlfdlauncher
'<SYSTEM32>\net.exe' stop cpqvcagent
'<SYSTEM32>\net.exe' stop TeamViewer
'<SYSTEM32>\net.exe' stop klsbackup2013pro
'<SYSTEM32>\net.exe' stop foxitreaderservice
'<SYSTEM32>\net.exe' stop mysql501
'<SYSTEM32>\net.exe' stop sqlbrowser
'<SYSTEM32>\net.exe' stop veeamdeploysvc
'<SYSTEM32>\net.exe' stop veeamtransportsvc
'<SYSTEM32>\net.exe' stop wuauserv
'<SYSTEM32>\net.exe' stop sysmgmthp
'<SYSTEM32>\net.exe' stop sysdown
'<SYSTEM32>\net.exe' stop adobearmservice
'<SYSTEM32>\net.exe' stop themes
'<SYSTEM32>\net.exe' stop sql backupmaster
'<SYSTEM32>\taskkill.exe' /F /IM tv_x64.exe

Modifies file system

Creates the following files

%TEMP%\b.bat
%TEMP%\ccproxy.exe.non
%ProgramFiles%\ccproxy\howtobackfiles.txt
%TEMP%\ccsetmgr.exe.non
%ProgramFiles%\ccsetmgr\howtobackfiles.txt
%TEMP%\cemrep.exe.non
%ProgramFiles%\cemrep\howtobackfiles.txt
%TEMP%\chrome.exe.non
%ProgramFiles%\chrome\howtobackfiles.txt
%ProgramFiles%\ccevtmgr\howtobackfiles.txt
%TEMP%\clamscan.exe.non
%ProgramFiles%\ccleaner\howtobackfiles.txt
%TEMP%\clamtray.exe.non
%ProgramFiles%\clamwin\howtobackfiles.txt
%TEMP%\clamwin.exe.non
%TEMP%\claw95.exe.non
%ProgramFiles%\claw95\howtobackfiles.txt
%ProgramFiles%\claw95cf\howtobackfiles.txt
%TEMP%\claw95cf.exe.non
%ProgramFiles%\cleaner\howtobackfiles.txt
%TEMP%\cleaner.exe.non
%ProgramFiles%\clamscan\howtobackfiles.txt
%ProgramFiles%\ccapp\howtobackfiles.txt
%ProgramFiles%\clamtray\howtobackfiles.txt
%TEMP%\ccleaner.exe.non
%TEMP%\ccevtmgr.exe.non
%TEMP%\ccapp.exe.non
%TEMP%\cavoar.exe.non
%ProgramFiles%\cavoar\howtobackfiles.txt
%ProgramFiles%\cavq\howtobackfiles.txt
%TEMP%\cavq.exe.non
%TEMP%\cavscons.exe.non
%ProgramFiles%\cavscons\howtobackfiles.txt
%ProgramFiles%\cavse\howtobackfiles.txt
%TEMP%\cavse.exe.non
%TEMP%\cavsn.exe.non
%ProgramFiles%\cavsn\howtobackfiles.txt
%TEMP%\cavsub.exe.non
%ProgramFiles%\cavsub\howtobackfiles.txt
%TEMP%\cavsubmit.exe.non
%ProgramFiles%\cavsubmit\howtobackfiles.txt
%TEMP%\cavumas.exe.non
%ProgramFiles%\cavumas\howtobackfiles.txt
%TEMP%\cavuserupd.exe.non
%ProgramFiles%\cavuserupd\howtobackfiles.txt
%TEMP%\cavvl.exe.non
%ProgramFiles%\cavvl\howtobackfiles.txt
%ProgramFiles%\cleaner3\howtobackfiles.txt
%TEMP%\cavmr.exe.non
%TEMP%\cleaner3.exe.non
%ProgramFiles%\bdsubmitwiz\howtobackfiles.txt
%TEMP%\clisvc.exe.non
%TEMP%\plugin.x.manifest.non
%ProgramFiles%\clrcche\howtobackfiles.txt
%TEMP%\list.txt.non
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_ca\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_gb\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_us\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\howtobackfiles.txt
%TEMP%\en_ca.aff.non
%TEMP%\en_ca.dic.non
%TEMP%\hyph_en_ca.dic.non
%TEMP%\readme_en_ca.txt.non
%TEMP%\readme_th_en_ca_v2.txt.non
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\howtobackfiles.txt
%TEMP%\changelog.txt.non
%TEMP%\affdescription.txt.non
%TEMP%\license.txt.non
%TEMP%\en_gb.aff.non
%TEMP%\en_gb.dic.non
%TEMP%\hyph_en_gb.dic.non
%TEMP%\readme.txt.non
%TEMP%\wordnet_license.txt.non
%TEMP%\readme_en_gb.txt.non
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\howtobackfiles.txt
%TEMP%\info.plist.non
%TEMP%\dummy.dic.non
%TEMP%\comdll.x.manifest.non
%ProgramFiles%\cavmud\howtobackfiles.txt
%ProgramFiles%\cavmr\howtobackfiles.txt
%ProgramFiles%\clisvc\howtobackfiles.txt
%TEMP%\cmain.exe.non
%ProgramFiles%\cmain\howtobackfiles.txt
%TEMP%\cmgrdian.exe.non
%ProgramFiles%\cmgrdian\howtobackfiles.txt
%CommonProgramFiles%\adobe\acrobat\howtobackfiles.txt
%TEMP%\adobearm.exe.non
%TEMP%\adobearmhelper.exe.non
%TEMP%\armsvc.exe.non
%CommonProgramFiles%\adobe\arm\1.0\howtobackfiles.txt
%CommonProgramFiles%\adobe\arm\howtobackfiles.txt
%TEMP%\reader.helpcfg.non
%CommonProgramFiles%\adobe\helpcfg\en_us\howtobackfiles.txt
%CommonProgramFiles%\adobe\helpcfg\howtobackfiles.txt
%TEMP%\displaylanguagenames.en_ca.txt.non
%TEMP%\displaylanguagenames.en_us.txt.non
%TEMP%\displaylanguagenames.en_gb.txt.non
%TEMP%\displaylanguagenames.en_gb_euro.txt.non
%CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\howtobackfiles.txt
%TEMP%\displaylanguagenames.en_us_posix.txt.non
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\adobe\howtobackfiles.txt
%TEMP%\products.txt.non
%TEMP%\dummy.aff.non
%TEMP%\clrcche.exe.non
%TEMP%\adobehunspellplugin.dll.non
%TEMP%\cavmud.exe.non
%ProgramFiles%\cavemsrv\howtobackfiles.txt
%TEMP%\cavemsrv.exe.non
%ProgramFiles%\avgrssvc\howtobackfiles.txt
%TEMP%\avgscan.exe.non
%ProgramFiles%\avgscan\howtobackfiles.txt
%TEMP%\avgupden.exe.non
%ProgramFiles%\avgupden\howtobackfiles.txt
%TEMP%\avgupsvc.exe.non
%ProgramFiles%\avgupsvc\howtobackfiles.txt
%TEMP%\avgvv.exe.non
%ProgramFiles%\avgvv\howtobackfiles.txt
%ProgramFiles%\avgw\howtobackfiles.txt
%TEMP%\avgw.exe.non
%TEMP%\avgwizfw.exe.non
%ProgramFiles%\avgwizfw\howtobackfiles.txt
%TEMP%\avinitnt.exe.non
%ProgramFiles%\avinitnt\howtobackfiles.txt
%TEMP%\avkserv.exe.non
%ProgramFiles%\avkserv\howtobackfiles.txt
%ProgramFiles%\avkservice\howtobackfiles.txt
%TEMP%\avkservice.exe.non
%TEMP%\avkwctl.exe.non
%ProgramFiles%\avgnpdln\howtobackfiles.txt
%TEMP%\avginet.exe.non
%TEMP%\en_us.aff.non
%TEMP%\avgrssvc.exe.non
%TEMP%\avnotify.exe.non
%ProgramFiles%\avgnpsvc\howtobackfiles.txt
%TEMP%\avgnpdln.exe.non
%ProgramFiles%\avadmin\howtobackfiles.txt
%TEMP%\avcenter.exe.non
%ProgramFiles%\avcenter\howtobackfiles.txt
%TEMP%\avciman.exe.non
%ProgramFiles%\avciman\howtobackfiles.txt
%ProgramFiles%\avcmd\howtobackfiles.txt
%TEMP%\avconfig.exe.non
%ProgramFiles%\avconfig\howtobackfiles.txt
%TEMP%\avcmd.exe.non
%ProgramFiles%\autotrace\howtobackfiles.txt
%TEMP%\avconsol.exe.non
%TEMP%\avgamsvr.exe.non
%ProgramFiles%\avgamsvr\howtobackfiles.txt
%ProgramFiles%\avgcc\howtobackfiles.txt
%TEMP%\avgdiag.exe.non
%TEMP%\avgcc.exe.non
%ProgramFiles%\avgdiag\howtobackfiles.txt
%ProgramFiles%\avgemc\howtobackfiles.txt
%TEMP%\avgemc.exe.non
%TEMP%\avgfwsrv.exe.non
%ProgramFiles%\avgfwsrv\howtobackfiles.txt
%ProgramFiles%\avconsol\howtobackfiles.txt
%ProgramFiles%\avginet\howtobackfiles.txt
%ProgramFiles%\avkwctl\howtobackfiles.txt
%TEMP%\autotrace.exe.non
%ProgramFiles%\avpcc\howtobackfiles.txt
%TEMP%\avpm.exe.non
%TEMP%\bdwizreg.exe.non
%ProgramFiles%\bdwizreg\howtobackfiles.txt
%TEMP%\blackd.exe.non
%ProgramFiles%\blackd\howtobackfiles.txt
%TEMP%\blackice.exe.non
%ProgramFiles%\blackice\howtobackfiles.txt
%TEMP%\blindman.exe.non
%ProgramFiles%\blindman\howtobackfiles.txt
%TEMP%\btini.exe.non
%ProgramFiles%\btini\howtobackfiles.txt
%TEMP%\btinint.exe.non
%ProgramFiles%\btinint\howtobackfiles.txt
%TEMP%\cabalmain.exe.non
%ProgramFiles%\cabalmain\howtobackfiles.txt
%TEMP%\cafix.exe.non
%ProgramFiles%\cafix\howtobackfiles.txt
%TEMP%\cavapp.exe.non
%ProgramFiles%\cavapp\howtobackfiles.txt
%TEMP%\cavasm.exe.non
%ProgramFiles%\cavasm\howtobackfiles.txt
%TEMP%\cavaud.exe.non
%ProgramFiles%\avnotify\howtobackfiles.txt
%ProgramFiles%\cavaud\howtobackfiles.txt
%ProgramFiles%\bdswitch\howtobackfiles.txt
%TEMP%\avpcc.exe.non
%TEMP%\bdswitch.exe.non
%TEMP%\bdsurvey.exe.non
%ProgramFiles%\avpm\howtobackfiles.txt
%TEMP%\avscan.exe.non
%ProgramFiles%\avscan\howtobackfiles.txt
%ProgramFiles%\avsynmgr\howtobackfiles.txt
%TEMP%\avsynmgr.exe.non
%ProgramFiles%\b2\howtobackfiles.txt
%TEMP%\b2.exe.non
%TEMP%\backweb-4476822.exe.non
%ProgramFiles%\backweb-4476822\howtobackfiles.txt
%TEMP%\bdagent.exe.non
%ProgramFiles%\bdagent\howtobackfiles.txt
%ProgramFiles%\bdmcon\howtobackfiles.txt
%TEMP%\bdmcon.exe.non
%TEMP%\bdnews.exe.non
%ProgramFiles%\bdnews\howtobackfiles.txt
%TEMP%\bdoesrv.exe.non
%ProgramFiles%\bdoesrv\howtobackfiles.txt
%TEMP%\bdss.exe.non
%ProgramFiles%\bdss\howtobackfiles.txt
%TEMP%\bdsubmit.exe.non
%ProgramFiles%\bdsubmit\howtobackfiles.txt
%TEMP%\bdsubmitwiz.exe.non
%TEMP%\avgnpsvc.exe.non
%ProgramFiles%\bdsurvey\howtobackfiles.txt
%TEMP%\avadmin.exe.non
%TEMP%\en_us.dic.non
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\pt-br\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\pt-pt\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\ro-ro\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\ru-ru\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\sk-sk\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\sv-se\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\th-th\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\nl-nl\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\pl-pl\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\tr-tr\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\zh-tw\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\howtobackfiles.txt
%TEMP%\mscdm.dll.non
%CommonProgramFiles%\microsoft shared\msclientdatamgr\howtobackfiles.txt
%TEMP%\cookdoc.dll.non
%TEMP%\docutil.dll.non
%CommonProgramFiles%\microsoft shared\msdn\howtobackfiles.txt
%TEMP%\contextp.dll.non
%TEMP%\dte.olb.non
%CommonProgramFiles%\microsoft shared\ink\uk-ua\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\zh-cn\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\nb-no\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\lt-lt\howtobackfiles.txt
%TEMP%\vshelp.tlb.non
%CommonProgramFiles%\microsoft shared\ink\es-es\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\et-ee\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fi-fi\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fr-fr\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\he-il\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\hu-hu\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\it-it\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\ja-jp\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\ko-kr\howtobackfiles.txt
%TEMP%\msenvp.dll.non
%CommonProgramFiles%\microsoft shared\ink\el-gr\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\lv-lv\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\cs-cz\howtobackfiles.txt
%TEMP%\vsext.olb.non
%TEMP%\aceoledb.dll.non
%TEMP%\acerclr.dll.non
%TEMP%\acetxt.dll.non
%TEMP%\acewdat.dll.non
%TEMP%\csisoap.dll.non
%TEMP%\exp_pdf.dll.non
%TEMP%\liclua.exe.non
%TEMP%\acewss.dll.non
%TEMP%\exp_xps.dll.non
%TEMP%\csi.dll.non
%TEMP%\expsrv.dll.non
%TEMP%\iacom2.dll.non
%TEMP%\acexbe.dll.non
%TEMP%\fltldr.exe.non
%TEMP%\msoxev.dll.non
%TEMP%\msores.dll.non
%TEMP%\aceodexl.dll.non
%TEMP%\vbajet32.dll.non
%TEMP%\wisc30.dll.non
%TEMP%\optinps.dll.non
%TEMP%\xlsrvintl.dll.non
%TEMP%\oarpmanr.dll.non
%TEMP%\mssoapr3.dll.non
%TEMP%\acerep.dll.non
%CommonProgramFiles%\microsoft shared\ink\de-de\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\howtobackfiles.txt
%TEMP%\acecore.dll.non
%CommonProgramFiles%\microsoft shared\msenv\publicassemblies\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\msenv\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\msinfo\en-us\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\msinfo\howtobackfiles.txt
%TEMP%\ctryinfo.txt.non
%TEMP%\mso.dll.non
%TEMP%\mso7ftp.exe.non
%TEMP%\mso7ftpa.exe.non
%TEMP%\ucs20.dll.non
%TEMP%\mso7ftps.exe.non
%TEMP%\msoicons.exe.non
%TEMP%\usp10.dll.non
%TEMP%\riched20.dll.non
%TEMP%\msointl.dll.non
%CommonProgramFiles%\microsoft shared\office10\1033\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\office10\howtobackfiles.txt
%TEMP%\aceexch.dll.non
%TEMP%\aceoddbs.dll.non
%TEMP%\aceexcl.dll.non
%TEMP%\aceodbc.dll.non
%TEMP%\aceerr.dll.non
%TEMP%\acedao.dll.non
%TEMP%\acees.dll.non
%TEMP%\aceodtxt.dll.non
%TEMP%\extensibility.dll.non
%CommonProgramFiles%\microsoft shared\ink\da-dk\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\bg-bg\howtobackfiles.txt
%TEMP%\turnonnotificationinacrobat.gif.non
%CommonProgramFiles%\microsoft shared\dw\howtobackfiles.txt
%TEMP%\eqnedt32.exe.non
%TEMP%\eqnedt32.exe.manifest.non
%TEMP%\eqnedt32.hlp.non
%TEMP%\mtextra.ttf.non
%TEMP%\eqnedt32.cnt.non
%CommonProgramFiles%\microsoft shared\equation\1033\howtobackfiles.txt
%TEMP%\eeintl.dll.non
%CommonProgramFiles%\microsoft shared\equation\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\euro\howtobackfiles.txt
%TEMP%\msoeuro.dll.non
%TEMP%\msgfilt.dll.non
%TEMP%\odffilt.dll.non
%TEMP%\offfiltx.dll.non
%CommonProgramFiles%\microsoft shared\filters\howtobackfiles.txt
%TEMP%\cgmimp32.cfg.non
%TEMP%\cgmimp32.flt.non
%TEMP%\cgmimp32.fnt.non
%TEMP%\epsimp32.flt.non
%TEMP%\gifimp32.flt.non
%TEMP%\jpegim32.flt.non
%TEMP%\dwtrig20.exe.non
%CommonProgramFiles%\microsoft shared\dao\howtobackfiles.txt
%TEMP%\dw20.exe.non
%TEMP%\dbghelp.dll.non
%TEMP%\ms.cgm.non
%TEMP%\hyph_en_us.dic.non
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\howtobackfiles.txt
%TEMP%\added.txt.non
%TEMP%\excluded.txt.non
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\linguistics\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\howtobackfiles.txt
%CommonProgramFiles%\adobe\howtobackfiles.txt
%CommonProgramFiles%\designer\howtobackfiles.txt
%TEMP%\msaddndr.dll.non
%TEMP%\jaucheck.exe.non
%TEMP%\jaureg.exe.non
%TEMP%\jusched.exe.non
%TEMP%\task.xml.non
%TEMP%\jucheck.exe.non
%TEMP%\task64.xml.non
%CommonProgramFiles%\java\howtobackfiles.txt
%CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\howtobackfiles.txt
%CommonProgramFiles%\java\java update\howtobackfiles.txt
%TEMP%\readme_en_us.txt.non
%TEMP%\ms.eps.non
%TEMP%\ms.wpg.non
%TEMP%\dexplmui.dll.non
%TEMP%\dexplore.hxs.non
%TEMP%\msenvui.dll.non
%TEMP%\vsbrowseui.dll.non
%CommonProgramFiles%\microsoft shared\help\1033\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\help\1036\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\help\1040\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\help\1041\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\help\1042\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\help\1046\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\help\1049\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\help\1050\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\help\2052\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\help\3082\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\help\howtobackfiles.txt
%TEMP%\itircl54.dll.non
%TEMP%\msitss.dll.non
%CommonProgramFiles%\microsoft shared\information retrieval\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\1.0\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\1.7\howtobackfiles.txt
%CommonProgramFiles%\microsoft shared\ink\ar-sa\howtobackfiles.txt
%TEMP%\hxvzui.dll.non
%CommonProgramFiles%\microsoft shared\help\1028\howtobackfiles.txt
%TEMP%\cmddefui.dll.non
%CommonProgramFiles%\microsoft shared\help\1031\howtobackfiles.txt
%TEMP%\ms.gif.non
%TEMP%\ms.jpg.non
%TEMP%\pictim32.flt.non
%TEMP%\png32.flt.non
%TEMP%\wpgimp32.flt.non
%CommonProgramFiles%\microsoft shared\grphflt\howtobackfiles.txt
%TEMP%\atl71.dll.non
%TEMP%\cmddef.dll.non
%TEMP%\dexplore.exe.non
%TEMP%\dexplmnu.dll.non
%TEMP%\dexplore.xml.non
%TEMP%\hx.hxt.non
%TEMP%\hx.hxc.non
%TEMP%\hxvz.dll.non
%TEMP%\itircl55.dll.non
%TEMP%\keywords.hxk.non
%TEMP%\msitss55.dll.non
%TEMP%\msenv.dll.non
%TEMP%\msvcr71.dll.non
%TEMP%\namedurls.hxk.non
%TEMP%\visualui.ttf.non
%TEMP%\hxruntime.hxs.non
%TEMP%\hxds.dll.non
%TEMP%\hxdsui.dll.non
%TEMP%\ms.png.non
%TEMP%\vsbrowse.dll.non
%ProgramFiles%\autostartexplorer\howtobackfiles.txt
%TEMP%\autostartexplorer.exe.non
%ProgramFiles%\autodown\howtobackfiles.txt
%TEMP%\aiodlite.dll.non
%ProgramFiles%\adobe\reader 11.0\esl\howtobackfiles.txt
%TEMP%\readme.htm.non
%TEMP%\a3dutils.dll.non
%TEMP%\ace.dll.non
%TEMP%\acrobroker.exe.non
%TEMP%\acrofx32.dll.non
%TEMP%\acrord32.dll.non
%TEMP%\ackwin32.exe.non
%TEMP%\acrord32.exe.non
%ProgramFiles%\admunch\howtobackfiles.txt
%TEMP%\adobe.reader.dependencies.manifest.non
%TEMP%\acrotextextractor.exe.non
%TEMP%\wow_helper.exe.non
%TEMP%\adoberfp.dll.non
%TEMP%\adobecollabsync.exe.non
%TEMP%\adobelinguistic.dll.non
%TEMP%\rt3d.dll.non
%TEMP%\reader_sl.exe.non
%TEMP%\pmd.cer.non
%TEMP%\acrord32info.exe.non
%ProgramFiles%\ackwin32\howtobackfiles.txt
%TEMP%\acrordif.dll.non
%ProgramFiles%\about\howtobackfiles.txt
%TEMP%\phytoremediation.rtf.non
%TEMP%\npswf32.dll.non
%TEMP%\360tray.exe.non
%ProgramFiles%\360tray\howtobackfiles.txt
%TEMP%\a2cmd.exe.non
%ProgramFiles%\a2cmd\howtobackfiles.txt
%TEMP%\a2guard.exe.non
%ProgramFiles%\a2guard\howtobackfiles.txt
%TEMP%\a2hijackfree.exe.non
%ProgramFiles%\a2hijackfree\howtobackfiles.txt
%TEMP%\a2scan.exe.non
%ProgramFiles%\a2scan\howtobackfiles.txt
%TEMP%\a2service.exe.non
%ProgramFiles%\a2service\howtobackfiles.txt
%TEMP%\a2start.exe.non
%ProgramFiles%\a2start\howtobackfiles.txt
%TEMP%\a2upd.exe.non
%ProgramFiles%\a2upd\howtobackfiles.txt
%TEMP%\a2wizard.exe.non
%ProgramFiles%\a2wizard\howtobackfiles.txt
%ProgramFiles%\aavshield\howtobackfiles.txt
%TEMP%\aavshield.exe.non
%TEMP%\pe.dll.non
%TEMP%\onix32.dll.non
%TEMP%\static_electricity_easy_and_quick_activities.rtf.non
%TEMP%\about.exe.non
%TEMP%\makeaccessible.api.non
%TEMP%\pdfsigqformalrep.pdf.non
%TEMP%\rtc.der.non
%ProgramFiles%\adobe\reader 11.0\reader\air\howtobackfiles.txt
%TEMP%\nppdf32.dll.non
%ProgramFiles%\adobe\reader 11.0\reader\browser\howtobackfiles.txt
%TEMP%\adobeid.pdf.non
%TEMP%\defaultid.pdf.non
%ProgramFiles%\adobe\reader 11.0\reader\idtemplates\enu\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\reader\idtemplates\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\reader\javascripts\howtobackfiles.txt
%TEMP%\jsbytecodewin.bin.non
%TEMP%\eula.ini.non
%TEMP%\license.html.non
%ProgramFiles%\adobe\reader 11.0\reader\legal\enu\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\reader\legal\howtobackfiles.txt
%TEMP%\annots.api.non
%TEMP%\digsig.api.non
%TEMP%\accessibility.api.non
%TEMP%\acroform.api.non
%TEMP%\checkers.api.non
%TEMP%\dva.api.non
%TEMP%\ebook.api.non
%TEMP%\escript.api.non
%TEMP%\sccore.dll.non
%TEMP%\myhrvoldhanssenbiharfamine.rtf.non
%TEMP%\viewerps.dll.non
%TEMP%\waterlandhealthkano.rtf.non
%TEMP%\pdfprevhndlr.dll.non
%TEMP%\logtransport2.exe.non
%TEMP%\logsession.dll.non
%TEMP%\jp2klib.dll.non
%TEMP%\icudt40.dll.non
%TEMP%\icucnv40.dll.non
%TEMP%\extendscript.dll.non
%TEMP%\eula.exe.non
%TEMP%\cryptocme.sig.non
%TEMP%\cryptocme.dll.non
%TEMP%\cooltype.dll.non
%TEMP%\ccme_base_non_fips.dll.non
%TEMP%\ccme_ecc.dll.non
%TEMP%\ccme_ecdrbg.dll.non
%TEMP%\ccme_asym.dll.non
%TEMP%\ccme_base.dll.non
%TEMP%\bib.dll.non
%TEMP%\bibutils.dll.non
%TEMP%\axsle.dll.non
%TEMP%\axe8sharedexpat.dll.non
%TEMP%\agmgpuoptin.ini.non
%TEMP%\ahclient.dll.non
%TEMP%\arh.exe.non
%TEMP%\adobexmp.dll.non
%TEMP%\fungalnameauthors.rtf.non
%TEMP%\sqlite.dll.non
%TEMP%\router_manual.rtf.non
%TEMP%\babyboymaintoscenesbackground_pal.wmv.non
%TEMP%\holycrosschurchinstructions.docx.non
%TEMP%\skypesetup.exe.non
%TEMP%\calc.exe.non
%TEMP%\tcm851ax32.exe.non
%TEMP%\wrar520.exe.non
%TEMP%\dotnetfx45_full_setup.exe.non
%TEMP%\alert.htm.non
%TEMP%\tree_view.htm.non
%TEMP%\about.html.non
%TEMP%\iisstart.html.non
%TEMP%\3.jpeg.non
%TEMP%\pushkin.jpeg.non
%TEMP%\210252809.jpeg.non
%TEMP%\4f0bf7ff71f28.jpeg.non
%TEMP%\168.jpeg.non
%TEMP%\4f0bf7ff71f28.jpg.non
%TEMP%\region-north-karelia.jpg.non
%TEMP%\2.jpg.non
%TEMP%\210252809.jpg.non
%TEMP%\168.jpg.non
%TEMP%\parnas_01.jpg.non
%TEMP%\hadac_newsletter_july_2010_final.docx.non
%TEMP%\scan.mov.non
%TEMP%\ia32.api.non
%TEMP%\nwfieldnotes1966.docx.non
%TEMP%\firefly1.mov.non
%TEMP%\thlps_keeper_mayer_1965.docx.non
%TEMP%\split.avi.non
%TEMP%\correct.avi.non
%TEMP%\tileimage.bmp.non
%TEMP%\dialmap.bmp.non
%TEMP%\coffee.bmp.non
%TEMP%\dial.bmp.non
%TEMP%\dashborder_96.bmp.non
%TEMP%\dashborder_144.bmp.non
%TEMP%\dashborder_120.bmp.non
%TEMP%\dashborder_192.bmp.non
%TEMP%\contosoroot_1.cer.non
%TEMP%\join.avi.non
%TEMP%\sdksampleunprivdeveloper.cer.non
%TEMP%\contoso.cer.non
%TEMP%\contosoroot.cer.non
%TEMP%\testcertificate.cer.non
%TEMP%\sdksampleprivdeveloper.cer.non
%TEMP%\ovp25012015.doc.non
%TEMP%\lisp_success.doc.non
%TEMP%\hanni_umami_chapter.doc.non
%TEMP%\february_catalogue__2015.doc.non
%TEMP%\cveuropeo.doc.non
%TEMP%\sdszfo.docx.non
%TEMP%\contoso_1.cer.non
%TEMP%\applicantform_en.doc.non
%TEMP%\agm.dll.non
%TEMP%\video_1.mp4.non
%TEMP%\spib_pima.pdf.non
%TEMP%\military_callsigns_0311.rtf.non
%TEMP%\taxus_baccata.rdf.non
%TEMP%\schema.rdf.non
%TEMP%\foaf.rdf.non
%TEMP%\swc_2009-03-02.rdf.non
%TEMP%\sioc.rdf.non
%TEMP%\desktop.ini.non
%TEMP%\price030215.zip.non
%TEMP%\productos.zip.non
%TEMP%\highly_cited_2001.xlsx.non
%TEMP%\trtf_matrix2012_oct.xlsx.non
%TEMP%\cee_mmsprogram_summary_public.xlsx.non
%TEMP%\al.xlsx.non
%TEMP%\suspendedcompanies.xlsx.non
%TEMP%\2013_finalsummaryforweb.xlsx.non
%TEMP%\fiche_inscription_2015.xls.non
%TEMP%\productos.xls.non
%TEMP%\contractualdeadlines.xls.non
%TEMP%\removedtitles_records.xls.non
%TEMP%\babyboymaintonotesbackground_pal.wmv.non
%TEMP%\passport_pal.wmv.non
%TEMP%\1sm_price.zip.non
%TEMP%\subjectclassification.zip.non
%TEMP%\price.zip.non
%TEMP%\contractualdeadlines.zip.non
%TEMP%\spanner.mov.non
%TEMP%\aoc_saq_d_v3_merchant.docx.non
%TEMP%\ff_ot_user_guide.pdf.non
%TEMP%\config.sys.non
<Current directory>\howtobackfiles.txt
%TEMP%\investmentbankca_ca8.pem.non
%TEMP%\systisoft.pem.non
%TEMP%\dissolveanother.png.non
%TEMP%\asm.png.non
%TEMP%\breakpoint.png.non
%TEMP%\bg_search_box.png.non
%TEMP%\writingcompletesarnarrative_1103.ppt.non
%TEMP%\sacs_presentation_sacs_qep_improving_rt_education_final.ppt.non
%TEMP%\mappingconcepthubberlin.ppt.non
%TEMP%\accountsreceivable.ppt.non
%TEMP%\file1.ppt.non
%TEMP%\sim_gametheory_to_finance.ppt.non
%TEMP%\metac.ppt.non
C:\perflogs\howtobackfiles.txt
C:\perflogs\admin\howtobackfiles.txt
%TEMP%\stoc13_ml_quoc_le.pptx.non
%TEMP%\samieee_obiee_presentation.pptx.non
%TEMP%\indogerman2010.pptx.non
%TEMP%\autoexec.bat.non
%TEMP%\d0068197bb5a41fea16a220c45390606.mp4.non
%TEMP%\waterresourcesag.pptx.non
%TEMP%\admunch.exe.non
%TEMP%\multimedia.api.non
%ProgramFiles%\adobe\reader 11.0\setup files\{ac76ba86-7ad7-1033-7b44-ab0000000001}\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\howtobackfiles.txt
%ProgramFiles%\adobe\howtobackfiles.txt
%TEMP%\agb5.exe.non
%ProgramFiles%\agb5\howtobackfiles.txt
%TEMP%\ageofconan.exe.non
%ProgramFiles%\ageofconan\howtobackfiles.txt
%TEMP%\ahnsd.exe.non
%ProgramFiles%\ahnsd\howtobackfiles.txt
%TEMP%\aim6.exe.non
%ProgramFiles%\aim6\howtobackfiles.txt
%TEMP%\aimpro.exe.non
%ProgramFiles%\aimpro\howtobackfiles.txt
%TEMP%\airdefense.exe.non
%ProgramFiles%\airdefense\howtobackfiles.txt
%ProgramFiles%\almon\howtobackfiles.txt
%TEMP%\almon.exe.non
%TEMP%\alsvc.exe.non
%ProgramFiles%\alsvc\howtobackfiles.txt
%TEMP%\amon.exe.non
%ProgramFiles%\amon\howtobackfiles.txt
%TEMP%\amsn.exe.non
%ProgramFiles%\adobe\reader 11.0\resource\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\resource\typesupport\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\setup files\howtobackfiles.txt
%TEMP%\pddom.api.non
%ProgramFiles%\amsn\howtobackfiles.txt
%TEMP%\icudt26l.dat.non
%TEMP%\zdingbat.txt.non
%ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\adobe\howtobackfiles.txt
%TEMP%\centeuro.txt.non
%TEMP%\corpchar.txt.non
%TEMP%\croatian.txt.non
%TEMP%\cyrillic.txt.non
%TEMP%\greek.txt.non
%TEMP%\iceland.txt.non
%TEMP%\roman.txt.non
%TEMP%\romanian.txt.non
%TEMP%\turkish.txt.non
%TEMP%\ukraine.txt.non
%ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\howtobackfiles.txt
%TEMP%\cp1250.txt.non
%TEMP%\cp1253.txt.non
%TEMP%\cp1251.txt.non
%TEMP%\cp1257.txt.non
%TEMP%\cp1254.txt.non
%TEMP%\cp1252.txt.non
%TEMP%\cp1258.txt.non
%ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\icu\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\howtobackfiles.txt
%TEMP%\symbol.txt.non
%TEMP%\anti-trojan.exe.non
%TEMP%\aoltbserver.exe.non
%TEMP%\ashserv.exe.non
%ProgramFiles%\ashserv\howtobackfiles.txt
%TEMP%\ashsimp2.exe.non
%ProgramFiles%\ashsimp2\howtobackfiles.txt
%ProgramFiles%\ashsimpl\howtobackfiles.txt
%TEMP%\ashsimpl.exe.non
%TEMP%\ashskpcc.exe.non
%ProgramFiles%\ashskpcc\howtobackfiles.txt
%TEMP%\ashskpck.exe.non
%ProgramFiles%\ashskpck\howtobackfiles.txt
%TEMP%\ashupd.exe.non
%ProgramFiles%\ashupd\howtobackfiles.txt
%ProgramFiles%\ashwebsv\howtobackfiles.txt
%TEMP%\ashwebsv.exe.non
%TEMP%\ash_updatemediator.exe.non
%ProgramFiles%\ash_updatemediator\howtobackfiles.txt
%ProgramFiles%\aswregsvr\howtobackfiles.txt
%TEMP%\aswregsvr.exe.non
%TEMP%\aswupdsv.exe.non
%ProgramFiles%\aswupdsv\howtobackfiles.txt
%TEMP%\autodown.exe.non
%ProgramFiles%\ashpopwz\howtobackfiles.txt
%TEMP%\ashpopwz.exe.non
%ProgramFiles%\ashquick\howtobackfiles.txt
%TEMP%\ashquick.exe.non
%ProgramFiles%\anti-trojan\howtobackfiles.txt
%TEMP%\antivirus.exe.non
%ProgramFiles%\aoltbserver\howtobackfiles.txt
%ProgramFiles%\armor2net\howtobackfiles.txt
%TEMP%\armor2net.exe.non
%TEMP%\armorsurf.exe.non
%ProgramFiles%\armorsurf\howtobackfiles.txt
%TEMP%\ash.exe.non
%ProgramFiles%\ash\howtobackfiles.txt
%ProgramFiles%\ashavast\howtobackfiles.txt
%TEMP%\ashavast.exe.non
%TEMP%\ashavsrv.exe.non
%ProgramFiles%\ashavsrv\howtobackfiles.txt
%TEMP%\ashchest.exe.non
%ProgramFiles%\ashchest\howtobackfiles.txt
%TEMP%\ashdisp.exe.non
%ProgramFiles%\ashdisp\howtobackfiles.txt
%TEMP%\ashdug.exe.non
%ProgramFiles%\ashdug\howtobackfiles.txt
%TEMP%\ashenhcd.exe.non
%ProgramFiles%\ashenhcd\howtobackfiles.txt
%TEMP%\ashlogv.exe.non
%ProgramFiles%\ashlogv\howtobackfiles.txt
%ProgramFiles%\ashmaisv\howtobackfiles.txt
%ProgramFiles%\antivirus\howtobackfiles.txt
%TEMP%\ashmaisv.exe.non
%TEMP%\acer3x.dll.non
%TEMP%\msointl.rest.idx_dll.non
%ProgramFiles%\adobe\reader 11.0\resource\font\howtobackfiles.txt
%TEMP%\2d.x3d.non
%TEMP%\3difr.x3d.non
%TEMP%\drvdx9.x3d.non
%TEMP%\drvsoft.x3d.non
%TEMP%\prcr.x3d.non
%TEMP%\tesselate.x3d.non
%TEMP%\myriadcad.otf.non
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\prc\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\howtobackfiles.txt
%TEMP%\dexechosign.spi.non
%TEMP%\dexshare.spi.non
%TEMP%\services.cfg.non
%ProgramFiles%\adobe\reader 11.0\reader\services\howtobackfiles.txt
%TEMP%\bl.gif.non
%TEMP%\br.gif.non
%TEMP%\distribute_form.gif.non
%TEMP%\ended_review_or_form.gif.non
%TEMP%\create_form.gif.non
%TEMP%\email_initiator.gif.non
%TEMP%\add_reviewer.gif.non
%TEMP%\email_all.gif.non
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\howtobackfiles.txt
%TEMP%\quicktime.mpp.non
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\howtobackfiles.txt
%TEMP%\saslprepprofile_norm_bidi.spp.non
%TEMP%\forms_super.gif.non
%TEMP%\mcimpp.mpp.non
%TEMP%\reflow.api.non
%TEMP%\saveasrtf.api.non
%TEMP%\readoutloud.api.non
%TEMP%\updater.api.non
%TEMP%\sendmail.api.non
%TEMP%\weblink.api.non
%TEMP%\spelling.api.non
%TEMP%\search.api.non
%TEMP%\adobepdf.xdc.non
%TEMP%\qrcode.pmp.non
%TEMP%\ppklite.api.non
%TEMP%\adobepdf417.pmp.non
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\howtobackfiles.txt
%TEMP%\words.pdf.non
%TEMP%\dynamic.pdf.non
%TEMP%\signhere.pdf.non
%TEMP%\standardbusiness.pdf.non
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\howtobackfiles.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\howtobackfiles.txt
%TEMP%\flash.mpp.non
%TEMP%\datamatrix.pmp.non
%TEMP%\windowsmedia.mpp.non
%ProgramFiles%\adobe\reader 11.0\resource\saslprep\howtobackfiles.txt
%TEMP%\info.gif.non
%TEMP%\forms_distributed.gif.non
%ProgramFiles%\adobe\reader 11.0\reader\howtobackfiles.txt
%TEMP%\enutxt.pdf.non
%TEMP%\courierstd.otf.non
%TEMP%\courierstd-boldoblique.otf.non
%TEMP%\courierstd-oblique.otf.non
%TEMP%\adobepistd.otf.non
%TEMP%\courierstd-bold.otf.non
%TEMP%\minionpro-bold.otf.non
%TEMP%\myriadpro-boldit.otf.non
%TEMP%\myriadpro-it.otf.non
%TEMP%\zx______.pfb.non
%TEMP%\minionpro-it.otf.non
%TEMP%\minionpro-regular.otf.non
%TEMP%\myriadpro-bold.otf.non
%TEMP%\myriadpro-regular.otf.non
%TEMP%\minionpro-boldit.otf.non
%TEMP%\zy______.pfb.non
%TEMP%\sy______.pfb.non
%TEMP%\sy______.pfm.non
%TEMP%\zx______.pfm.non
%TEMP%\zy______.pfm.non
%ProgramFiles%\adobe\reader 11.0\resource\font\pfm\howtobackfiles.txt
%TEMP%\forms_received.gif.non
%ProgramFiles%\adobe\reader 11.0\reader\tracker\howtobackfiles.txt
%TEMP%\form_responses.gif.non
%TEMP%\turnoffnotificationintray.gif.non
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\howtobackfiles.txt
%TEMP%\main.css.non
%TEMP%\open_original_form.gif.non
%TEMP%\server_ok.gif.non
%TEMP%\rss.gif.non
%TEMP%\server_issue.gif.non
%TEMP%\pdf.gif.non
%TEMP%\tl.gif.non
%TEMP%\tr.gif.non
%TEMP%\reviews_sent.gif.non
%TEMP%\reviews_super.gif.non
%TEMP%\review_email.gif.non
%TEMP%\review_same_reviewers.gif.non
%TEMP%\review_shared.gif.non
%TEMP%\server_lg.gif.non
%TEMP%\stop_collection_data.gif.non
%TEMP%\submission_history.gif.non
%TEMP%\end_review.gif.non
%TEMP%\reviewers.gif.non
%TEMP%\review_browser.gif.non
%TEMP%\reviews_joined.gif.non
%TEMP%\warning.gif.non
%TEMP%\turnoffnotificationinacrobat.gif.non
%TEMP%\trash.gif.non
%TEMP%\turnonnotificationintray.gif.non
%TEMP%\msointl.dll.idx_dll.non

Deletes the following files

%WINDIR%\Temp\CProgram Filesopera33.0.1990.115opera_autoupdate.download.lock
%WINDIR%\installer\af12.msi
%WINDIR%\installer\af0c.msi
%WINDIR%\installer\af06.msi
%WINDIR%\installer\af00.msi
%WINDIR%\installer\aefa.msi
%WINDIR%\installer\aef4.msi
%WINDIR%\installer\aed9.msi
%WINDIR%\installer\aed2.msi
%WINDIR%\installer\aecc.msi
%WINDIR%\installer\aec6.msi
%WINDIR%\installer\af18.msi
%WINDIR%\installer\aec0.msi
%WINDIR%\installer\aeb4.msi
%WINDIR%\installer\aeae.msi
%WINDIR%\installer\aea8.msi
%WINDIR%\installer\aea2.msi
%WINDIR%\installer\ae97.msi
%WINDIR%\installer\ae90.msi
%WINDIR%\installer\ae8a.msi
%WINDIR%\installer\ae84.msi
%WINDIR%\installer\ae7e.msi
%WINDIR%\installer\ae78.msi
%WINDIR%\installer\aeba.msi
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\grvicons.exe
%WINDIR%\installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\MSDN_Icon
%WINDIR%\installer\af2a.msi
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\shellui.mst
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\pubs.exe
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\msouc.exe
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe
%WINDIR%\installer\5a85b.msi
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\graph.ico
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe
%WINDIR%\installer\{90140000-0011-0000-0000-0000000FF1CE}\accicons.exe
%WINDIR%\installer\msi2965.tmp
%WINDIR%\installer\d74e4.msi
%WINDIR%\installer\c2539.msi
%WINDIR%\installer\ba566.msi
%WINDIR%\installer\ba560.msi
%WINDIR%\installer\af36.msi
%WINDIR%\installer\af30.msi
%WINDIR%\installer\af1e.msi
%WINDIR%\installer\af24.msi
%WINDIR%\installer\45275b3.msi
%WINDIR%\logs\directx.log
%WINDIR%\temp\ts_61d1.tmp
%WINDIR%\temp\ts_5f81.tmp
%WINDIR%\temp\ts_5446.tmp
%WINDIR%\temp\ts_539b.tmp
%WINDIR%\temp\ts_4f1a.tmp
%WINDIR%\temp\ts_4acb.tmp
%WINDIR%\temp\ts_47c7.tmp
%WINDIR%\temp\ts_46ea.tmp
%WINDIR%\temp\ts_43a0.tmp
%WINDIR%\Temp\opera_crashreporter.log
%WINDIR%\temp\ts_b2bb.tmp
%WINDIR%\Temp\Opera Installer\opera_installer_20160310115841.log
%WINDIR%\Temp\Opera Installer\installer.exe
%WINDIR%\Temp\opera autoupdate\opera_autoupdate.log
%WINDIR%\Temp\opera autoupdate\installer.exe
%WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
%WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
%WINDIR%\Temp\MpSigStub.log
%WINDIR%\temp\mpcmdrun.log
%WINDIR%\Temp\FXSTIFFDebugLogFile.txt
%WINDIR%\Temp\FXSAPIDebugLogFile.txt
%WINDIR%\temp\dmi8ab5.tmp
%WINDIR%\Temp\Opera Installer\opera_installer_20160310115839.log
%WINDIR%\installer\3fc460.msi
%WINDIR%\installer\43eef42.msi
%WINDIR%\logs\dpx\setupact.log
%WINDIR%\installer\43eef3e.msi
%WINDIR%\installer\3fc49f.msi
%WINDIR%\installer\3fc497.msi
%WINDIR%\installer\3fc491.msi
%WINDIR%\installer\3fc48b.msi
%WINDIR%\installer\3fc485.msi
%WINDIR%\installer\3fc47e.msi
%WINDIR%\installer\3fc478.msi
%WINDIR%\installer\3fc472.msi
%WINDIR%\installer\3fc46c.msi
%WINDIR%\installer\45275ad.msi
%WINDIR%\installer\3fc466.msi
%WINDIR%\installer\3fc45a.msi
%WINDIR%\installer\3fc454.msi
%WINDIR%\installer\3fc44e.msi
%WINDIR%\installer\3fc448.msi
%WINDIR%\installer\3fc442.msi
%WINDIR%\installer\3fc43c.msi
%WINDIR%\installer\3f9b38.msi
%WINDIR%\Logs\SystemRestore\RestoreUI.0.etl
%WINDIR%\Logs\HomeGroup\homegrouplog.etl
%WINDIR%\logs\dpx\setuperr.log
%WINDIR%\logs\cbs\cbs.log
%WINDIR%\installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\ndpsetup.ico

Moves the following files

from %TEMP%\config.sys.non to C:\config.sys.non
from %TEMP%\displaylanguagenames.en_us.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_us.txt.non
from %TEMP%\adobearm.exe.non to %CommonProgramFiles%\adobe\arm\1.0\adobearm.exe.non
from %TEMP%\reader.helpcfg.non to %CommonProgramFiles%\adobe\helpcfg\en_us\reader.helpcfg.non
from %TEMP%\adobearmhelper.exe.non to %CommonProgramFiles%\adobe\arm\1.0\adobearmhelper.exe.non
from %TEMP%\armsvc.exe.non to %CommonProgramFiles%\adobe\arm\1.0\armsvc.exe.non
from %TEMP%\cmgrdian.exe.non to %ProgramFiles%\cmgrdian\cmgrdian.exe.non
from %TEMP%\cmain.exe.non to %ProgramFiles%\cmain\cmain.exe.non
from %TEMP%\clrcche.exe.non to %ProgramFiles%\clrcche\clrcche.exe.non
from %TEMP%\clisvc.exe.non to %ProgramFiles%\clisvc\clisvc.exe.non
from %TEMP%\cleaner3.exe.non to %ProgramFiles%\cleaner3\cleaner3.exe.non
from %TEMP%\cleaner.exe.non to %ProgramFiles%\cleaner\cleaner.exe.non
from %TEMP%\bdagent.exe.non to %ProgramFiles%\bdagent\bdagent.exe.non
from %TEMP%\claw95cf.exe.non to %ProgramFiles%\claw95cf\claw95cf.exe.non
from %TEMP%\claw95.exe.non to %ProgramFiles%\claw95\claw95.exe.non
from %TEMP%\clamtray.exe.non to %ProgramFiles%\clamtray\clamtray.exe.non
from %TEMP%\clamscan.exe.non to %ProgramFiles%\clamscan\clamscan.exe.non
from %TEMP%\chrome.exe.non to %ProgramFiles%\chrome\chrome.exe.non
from %TEMP%\cemrep.exe.non to %ProgramFiles%\cemrep\cemrep.exe.non
from %TEMP%\ccsetmgr.exe.non to %ProgramFiles%\ccsetmgr\ccsetmgr.exe.non
from %TEMP%\ccproxy.exe.non to %ProgramFiles%\ccproxy\ccproxy.exe.non
from %TEMP%\ccleaner.exe.non to %ProgramFiles%\ccleaner\ccleaner.exe.non
from %TEMP%\ccevtmgr.exe.non to %ProgramFiles%\ccevtmgr\ccevtmgr.exe.non
from %TEMP%\ccapp.exe.non to %ProgramFiles%\ccapp\ccapp.exe.non
from %TEMP%\cavvl.exe.non to %ProgramFiles%\cavvl\cavvl.exe.non
from %TEMP%\displaylanguagenames.en_ca.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_ca.txt.non
from %TEMP%\displaylanguagenames.en_gb.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_gb.txt.non
from %TEMP%\en_gb.dic.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\en_gb.dic.non
from %TEMP%\cavumas.exe.non to %ProgramFiles%\cavumas\cavumas.exe.non
from %TEMP%\displaylanguagenames.en_gb_euro.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_gb_euro.txt.non
from %TEMP%\readme_en_us.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\readme_en_us.txt.non
from %TEMP%\en_us.aff.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\en_us.aff.non
from %TEMP%\hyph_en_gb.dic.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\hyph_en_gb.dic.non
from %TEMP%\en_ca.dic.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\en_ca.dic.non
from %TEMP%\readme_en_gb.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme_en_gb.txt.non
from %TEMP%\wordnet_license.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\wordnet_license.txt.non
from %TEMP%\en_gb.aff.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\en_gb.aff.non
from %TEMP%\readme.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme.txt.non
from %TEMP%\license.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\license.txt.non
from %TEMP%\affdescription.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\affdescription.txt.non
from %TEMP%\changelog.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\changelog.txt.non
from %TEMP%\hyph_en_ca.dic.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\hyph_en_ca.dic.non
from %TEMP%\adobehunspellplugin.dll.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\adobehunspellplugin.dll.non
from %TEMP%\readme_th_en_ca_v2.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_th_en_ca_v2.txt.non
from %TEMP%\readme_en_ca.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_en_ca.txt.non
from %TEMP%\en_ca.aff.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\en_ca.aff.non
from %TEMP%\list.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_ca\list.txt.non
from %TEMP%\comdll.x.manifest.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\comdll.x.manifest.non
from %TEMP%\plugin.x.manifest.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\plugin.x.manifest.non
from %TEMP%\info.plist.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\info.plist.non
from %TEMP%\dummy.dic.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dummy.dic.non
from %TEMP%\dummy.aff.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dummy.aff.non
from %TEMP%\products.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\adobe\products.txt.non
from %TEMP%\displaylanguagenames.en_us_posix.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\languagenames2\displaylanguagenames.en_us_posix.txt.non
from %TEMP%\cavuserupd.exe.non to %ProgramFiles%\cavuserupd\cavuserupd.exe.non
from %TEMP%\clamwin.exe.non to %ProgramFiles%\clamwin\clamwin.exe.non
from %TEMP%\cavsubmit.exe.non to %ProgramFiles%\cavsubmit\cavsubmit.exe.non
from %TEMP%\cavsub.exe.non to %ProgramFiles%\cavsub\cavsub.exe.non
from %TEMP%\hyph_en_us.dic.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\hyph_en_us.dic.non
from %TEMP%\avgupsvc.exe.non to %ProgramFiles%\avgupsvc\avgupsvc.exe.non
from %TEMP%\avscan.exe.non to %ProgramFiles%\avscan\avscan.exe.non
from %TEMP%\avpm.exe.non to %ProgramFiles%\avpm\avpm.exe.non
from %TEMP%\avpcc.exe.non to %ProgramFiles%\avpcc\avpcc.exe.non
from %TEMP%\avnotify.exe.non to %ProgramFiles%\avnotify\avnotify.exe.non
from %TEMP%\avkwctl.exe.non to %ProgramFiles%\avkwctl\avkwctl.exe.non
from %TEMP%\avkservice.exe.non to %ProgramFiles%\avkservice\avkservice.exe.non
from %TEMP%\avkserv.exe.non to %ProgramFiles%\avkserv\avkserv.exe.non
from %TEMP%\avinitnt.exe.non to %ProgramFiles%\avinitnt\avinitnt.exe.non
from %TEMP%\avgwizfw.exe.non to %ProgramFiles%\avgwizfw\avgwizfw.exe.non
from %TEMP%\avgw.exe.non to %ProgramFiles%\avgw\avgw.exe.non
from %TEMP%\avgvv.exe.non to %ProgramFiles%\avgvv\avgvv.exe.non
from %TEMP%\avgupden.exe.non to %ProgramFiles%\avgupden\avgupden.exe.non
from %TEMP%\b2.exe.non to %ProgramFiles%\b2\b2.exe.non
from %TEMP%\avgscan.exe.non to %ProgramFiles%\avgscan\avgscan.exe.non
from %TEMP%\avgrssvc.exe.non to %ProgramFiles%\avgrssvc\avgrssvc.exe.non
from %TEMP%\avgnpsvc.exe.non to %ProgramFiles%\avgnpsvc\avgnpsvc.exe.non
from %TEMP%\avginet.exe.non to %ProgramFiles%\avginet\avginet.exe.non
from %TEMP%\avgnpdln.exe.non to %ProgramFiles%\avgnpdln\avgnpdln.exe.non
from %TEMP%\avgfwsrv.exe.non to %ProgramFiles%\avgfwsrv\avgfwsrv.exe.non
from %TEMP%\avgemc.exe.non to %ProgramFiles%\avgemc\avgemc.exe.non
from %TEMP%\avgcc.exe.non to %ProgramFiles%\avgcc\avgcc.exe.non
from %TEMP%\avgdiag.exe.non to %ProgramFiles%\avgdiag\avgdiag.exe.non
from %TEMP%\avgamsvr.exe.non to %ProgramFiles%\avgamsvr\avgamsvr.exe.non
from %TEMP%\backweb-4476822.exe.non to %ProgramFiles%\backweb-4476822\backweb-4476822.exe.non
from %TEMP%\avcmd.exe.non to %ProgramFiles%\avcmd\avcmd.exe.non
from %TEMP%\bdmcon.exe.non to %ProgramFiles%\bdmcon\bdmcon.exe.non
from %TEMP%\bdoesrv.exe.non to %ProgramFiles%\bdoesrv\bdoesrv.exe.non
from %TEMP%\cavsn.exe.non to %ProgramFiles%\cavsn\cavsn.exe.non
from %TEMP%\avsynmgr.exe.non to %ProgramFiles%\avsynmgr\avsynmgr.exe.non
from %TEMP%\cavse.exe.non to %ProgramFiles%\cavse\cavse.exe.non
from %TEMP%\cavscons.exe.non to %ProgramFiles%\cavscons\cavscons.exe.non
from %TEMP%\cavq.exe.non to %ProgramFiles%\cavq\cavq.exe.non
from %TEMP%\cavoar.exe.non to %ProgramFiles%\cavoar\cavoar.exe.non
from %TEMP%\cavmud.exe.non to %ProgramFiles%\cavmud\cavmud.exe.non
from %TEMP%\cavmr.exe.non to %ProgramFiles%\cavmr\cavmr.exe.non
from %TEMP%\cavemsrv.exe.non to %ProgramFiles%\cavemsrv\cavemsrv.exe.non
from %TEMP%\cavaud.exe.non to %ProgramFiles%\cavaud\cavaud.exe.non
from %TEMP%\cavasm.exe.non to %ProgramFiles%\cavasm\cavasm.exe.non
from %TEMP%\cavapp.exe.non to %ProgramFiles%\cavapp\cavapp.exe.non
from %TEMP%\cafix.exe.non to %ProgramFiles%\cafix\cafix.exe.non
from %TEMP%\cabalmain.exe.non to %ProgramFiles%\cabalmain\cabalmain.exe.non
from %TEMP%\btinint.exe.non to %ProgramFiles%\btinint\btinint.exe.non
from %TEMP%\btini.exe.non to %ProgramFiles%\btini\btini.exe.non
from %TEMP%\blindman.exe.non to %ProgramFiles%\blindman\blindman.exe.non
from %TEMP%\blackice.exe.non to %ProgramFiles%\blackice\blackice.exe.non
from %TEMP%\blackd.exe.non to %ProgramFiles%\blackd\blackd.exe.non
from %TEMP%\bdwizreg.exe.non to %ProgramFiles%\bdwizreg\bdwizreg.exe.non
from %TEMP%\bdswitch.exe.non to %ProgramFiles%\bdswitch\bdswitch.exe.non
from %TEMP%\bdsurvey.exe.non to %ProgramFiles%\bdsurvey\bdsurvey.exe.non
from %TEMP%\bdsubmitwiz.exe.non to %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe.non
from %TEMP%\bdsubmit.exe.non to %ProgramFiles%\bdsubmit\bdsubmit.exe.non
from %TEMP%\bdss.exe.non to %ProgramFiles%\bdss\bdss.exe.non
from %TEMP%\bdnews.exe.non to %ProgramFiles%\bdnews\bdnews.exe.non
from %TEMP%\avconsol.exe.non to %ProgramFiles%\avconsol\avconsol.exe.non
from %TEMP%\added.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\added.txt.non
from %TEMP%\jpegim32.flt.non to %CommonProgramFiles%\microsoft shared\grphflt\jpegim32.flt.non
from %TEMP%\acerclr.dll.non to %CommonProgramFiles%\microsoft shared\office14\acerclr.dll.non
from %TEMP%\aceodtxt.dll.non to %CommonProgramFiles%\microsoft shared\office14\aceodtxt.dll.non
from %TEMP%\aceoddbs.dll.non to %CommonProgramFiles%\microsoft shared\office14\aceoddbs.dll.non
from %TEMP%\aceerr.dll.non to %CommonProgramFiles%\microsoft shared\office14\aceerr.dll.non
from %TEMP%\msointl.dll.non to %CommonProgramFiles%\microsoft shared\office10\1033\msointl.dll.non
from %TEMP%\riched20.dll.non to %CommonProgramFiles%\microsoft shared\office10\riched20.dll.non
from %TEMP%\usp10.dll.non to %CommonProgramFiles%\microsoft shared\office10\usp10.dll.non
from %TEMP%\ucs20.dll.non to %CommonProgramFiles%\microsoft shared\office10\ucs20.dll.non
from %TEMP%\msoicons.exe.non to %CommonProgramFiles%\microsoft shared\office10\msoicons.exe.non
from %TEMP%\mso7ftps.exe.non to %CommonProgramFiles%\microsoft shared\office10\mso7ftps.exe.non
from %TEMP%\mso7ftp.exe.non to %CommonProgramFiles%\microsoft shared\office10\mso7ftp.exe.non
from %TEMP%\aceexch.dll.non to %CommonProgramFiles%\microsoft shared\office14\aceexch.dll.non
from %TEMP%\aceodbc.dll.non to %CommonProgramFiles%\microsoft shared\office14\aceodbc.dll.non
from %TEMP%\extensibility.dll.non to %CommonProgramFiles%\microsoft shared\msenv\publicassemblies\extensibility.dll.non
from %TEMP%\msenvp.dll.non to %CommonProgramFiles%\microsoft shared\msenv\msenvp.dll.non
from %TEMP%\dte.olb.non to %CommonProgramFiles%\microsoft shared\msenv\dte.olb.non
from %TEMP%\vsext.olb.non to %CommonProgramFiles%\microsoft shared\msenv\vsext.olb.non
from %TEMP%\vshelp.tlb.non to %CommonProgramFiles%\microsoft shared\msenv\vshelp.tlb.non
from %TEMP%\contextp.dll.non to %CommonProgramFiles%\microsoft shared\msenv\contextp.dll.non
from %TEMP%\docutil.dll.non to %CommonProgramFiles%\microsoft shared\msdn\docutil.dll.non
from %TEMP%\cookdoc.dll.non to %CommonProgramFiles%\microsoft shared\msdn\cookdoc.dll.non
from %TEMP%\mscdm.dll.non to %CommonProgramFiles%\microsoft shared\msclientdatamgr\mscdm.dll.non
from %TEMP%\msitss.dll.non to %CommonProgramFiles%\microsoft shared\information retrieval\msitss.dll.non
from %TEMP%\itircl54.dll.non to %CommonProgramFiles%\microsoft shared\information retrieval\itircl54.dll.non
from %TEMP%\mso7ftpa.exe.non to %CommonProgramFiles%\microsoft shared\office10\mso7ftpa.exe.non
from %TEMP%\dexplore.hxs.non to %CommonProgramFiles%\microsoft shared\help\1033\dexplore.hxs.non
from %TEMP%\acer3x.dll.non to %CommonProgramFiles%\microsoft shared\office14\acer3x.dll.non
from %TEMP%\oarpmanr.dll.non to %CommonProgramFiles%\microsoft shared\office14\1033\oarpmanr.dll.non
from %TEMP%\xlsrvintl.dll.non to %CommonProgramFiles%\microsoft shared\office14\1033\xlsrvintl.dll.non
from %TEMP%\optinps.dll.non to %CommonProgramFiles%\microsoft shared\office14\optinps.dll.non
from %TEMP%\mso.dll.non to %CommonProgramFiles%\microsoft shared\office10\mso.dll.non
from %TEMP%\csi.dll.non to %CommonProgramFiles%\microsoft shared\office14\csi.dll.non
from %TEMP%\acewdat.dll.non to %CommonProgramFiles%\microsoft shared\office14\acewdat.dll.non
from %TEMP%\iacom2.dll.non to %CommonProgramFiles%\microsoft shared\office14\iacom2.dll.non
from %TEMP%\aceodexl.dll.non to %CommonProgramFiles%\microsoft shared\office14\aceodexl.dll.non
from %TEMP%\exp_xps.dll.non to %CommonProgramFiles%\microsoft shared\office14\exp_xps.dll.non
from %TEMP%\exp_pdf.dll.non to %CommonProgramFiles%\microsoft shared\office14\exp_pdf.dll.non
from %TEMP%\fltldr.exe.non to %CommonProgramFiles%\microsoft shared\office14\fltldr.exe.non
from %TEMP%\liclua.exe.non to %CommonProgramFiles%\microsoft shared\office14\liclua.exe.non
from %TEMP%\expsrv.dll.non to %CommonProgramFiles%\microsoft shared\office14\expsrv.dll.non
from %TEMP%\csisoap.dll.non to %CommonProgramFiles%\microsoft shared\office14\csisoap.dll.non
from %TEMP%\acewss.dll.non to %CommonProgramFiles%\microsoft shared\office14\acewss.dll.non
from %TEMP%\acexbe.dll.non to %CommonProgramFiles%\microsoft shared\office14\acexbe.dll.non
from %TEMP%\wisc30.dll.non to %CommonProgramFiles%\microsoft shared\office14\wisc30.dll.non
from %TEMP%\vbajet32.dll.non to %CommonProgramFiles%\microsoft shared\office14\vbajet32.dll.non
from %TEMP%\msoxev.dll.non to %CommonProgramFiles%\microsoft shared\office14\msoxev.dll.non
from %TEMP%\acetxt.dll.non to %CommonProgramFiles%\microsoft shared\office14\acetxt.dll.non
from %TEMP%\acecore.dll.non to %CommonProgramFiles%\microsoft shared\office14\acecore.dll.non
from %TEMP%\acerep.dll.non to %CommonProgramFiles%\microsoft shared\office14\acerep.dll.non
from %TEMP%\acees.dll.non to %CommonProgramFiles%\microsoft shared\office14\acees.dll.non
from %TEMP%\aceexcl.dll.non to %CommonProgramFiles%\microsoft shared\office14\aceexcl.dll.non
from %TEMP%\acedao.dll.non to %CommonProgramFiles%\microsoft shared\office14\acedao.dll.non
from %TEMP%\vsbrowseui.dll.non to %CommonProgramFiles%\microsoft shared\help\1033\vsbrowseui.dll.non
from %TEMP%\ctryinfo.txt.non to %CommonProgramFiles%\microsoft shared\office10\ctryinfo.txt.non
from %TEMP%\msenvui.dll.non to %CommonProgramFiles%\microsoft shared\help\1033\msenvui.dll.non
from %TEMP%\cmddefui.dll.non to %CommonProgramFiles%\microsoft shared\help\1033\cmddefui.dll.non
from %TEMP%\turnoffnotificationintray.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnoffnotificationintray.gif.non
from %TEMP%\excluded.txt.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\excluded.txt.non
from %TEMP%\cgmimp32.flt.non to %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.flt.non
from %TEMP%\cgmimp32.fnt.non to %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.fnt.non
from %TEMP%\ms.cgm.non to %CommonProgramFiles%\microsoft shared\grphflt\ms.cgm.non
from %TEMP%\cgmimp32.cfg.non to %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.cfg.non
from %TEMP%\offfiltx.dll.non to %CommonProgramFiles%\microsoft shared\filters\offfiltx.dll.non
from %TEMP%\odffilt.dll.non to %CommonProgramFiles%\microsoft shared\filters\odffilt.dll.non
from %TEMP%\msgfilt.dll.non to %CommonProgramFiles%\microsoft shared\filters\msgfilt.dll.non
from %TEMP%\msoeuro.dll.non to %CommonProgramFiles%\microsoft shared\euro\msoeuro.dll.non
from %TEMP%\eeintl.dll.non to %CommonProgramFiles%\microsoft shared\equation\1033\eeintl.dll.non
from %TEMP%\eqnedt32.cnt.non to %CommonProgramFiles%\microsoft shared\equation\eqnedt32.cnt.non
from %TEMP%\mtextra.ttf.non to %CommonProgramFiles%\microsoft shared\equation\mtextra.ttf.non
from %TEMP%\eqnedt32.hlp.non to %CommonProgramFiles%\microsoft shared\equation\eqnedt32.hlp.non
from %TEMP%\eqnedt32.exe.non to %CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe.non
from %TEMP%\eqnedt32.exe.manifest.non to %CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe.manifest.non
from %TEMP%\dw20.exe.non to %CommonProgramFiles%\microsoft shared\dw\dw20.exe.non
from %TEMP%\dwtrig20.exe.non to %CommonProgramFiles%\microsoft shared\dw\dwtrig20.exe.non
from %TEMP%\dbghelp.dll.non to %CommonProgramFiles%\microsoft shared\dw\dbghelp.dll.non
from %TEMP%\jucheck.exe.non to %CommonProgramFiles%\java\java update\jucheck.exe.non
from %TEMP%\jusched.exe.non to %CommonProgramFiles%\java\java update\jusched.exe.non
from %TEMP%\jaureg.exe.non to %CommonProgramFiles%\java\java update\jaureg.exe.non
from %TEMP%\jaucheck.exe.non to %CommonProgramFiles%\java\java update\jaucheck.exe.non
from %TEMP%\task64.xml.non to %CommonProgramFiles%\java\java update\task64.xml.non
from %TEMP%\task.xml.non to %CommonProgramFiles%\java\java update\task.xml.non
from %TEMP%\msaddndr.dll.non to %CommonProgramFiles%\designer\msaddndr.dll.non
from %TEMP%\ms.eps.non to %CommonProgramFiles%\microsoft shared\grphflt\ms.eps.non
from %TEMP%\en_us.dic.non to %CommonProgramFiles%\adobe\reader\11.0\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\en_us.dic.non
from %TEMP%\epsimp32.flt.non to %CommonProgramFiles%\microsoft shared\grphflt\epsimp32.flt.non
from %TEMP%\gifimp32.flt.non to %CommonProgramFiles%\microsoft shared\grphflt\gifimp32.flt.non
from %TEMP%\ms.gif.non to %CommonProgramFiles%\microsoft shared\grphflt\ms.gif.non
from %TEMP%\hxvzui.dll.non to %CommonProgramFiles%\microsoft shared\help\1028\hxvzui.dll.non
from %TEMP%\hxdsui.dll.non to %CommonProgramFiles%\microsoft shared\help\1028\hxdsui.dll.non
from %TEMP%\msenv.dll.non to %CommonProgramFiles%\microsoft shared\help\msenv.dll.non
from %TEMP%\itircl55.dll.non to %CommonProgramFiles%\microsoft shared\help\itircl55.dll.non
from %TEMP%\hxds.dll.non to %CommonProgramFiles%\microsoft shared\help\hxds.dll.non
from %TEMP%\vsbrowse.dll.non to %CommonProgramFiles%\microsoft shared\help\vsbrowse.dll.non
from %TEMP%\msvcr71.dll.non to %CommonProgramFiles%\microsoft shared\help\msvcr71.dll.non
from %TEMP%\msitss55.dll.non to %CommonProgramFiles%\microsoft shared\help\msitss55.dll.non
from %TEMP%\hxvz.dll.non to %CommonProgramFiles%\microsoft shared\help\hxvz.dll.non
from %TEMP%\hxruntime.hxs.non to %CommonProgramFiles%\microsoft shared\help\hxruntime.hxs.non
from %TEMP%\visualui.ttf.non to %CommonProgramFiles%\microsoft shared\help\visualui.ttf.non
from %TEMP%\namedurls.hxk.non to %CommonProgramFiles%\microsoft shared\help\namedurls.hxk.non
from %TEMP%\keywords.hxk.non to %CommonProgramFiles%\microsoft shared\help\keywords.hxk.non
from %TEMP%\hx.hxc.non to %CommonProgramFiles%\microsoft shared\help\hx.hxc.non
from %TEMP%\hx.hxt.non to %CommonProgramFiles%\microsoft shared\help\hx.hxt.non
from %TEMP%\dexplore.xml.non to %CommonProgramFiles%\microsoft shared\help\dexplore.xml.non
from %TEMP%\dexplmnu.dll.non to %CommonProgramFiles%\microsoft shared\help\dexplmnu.dll.non
from %TEMP%\dexplore.exe.non to %CommonProgramFiles%\microsoft shared\help\dexplore.exe.non
from %TEMP%\cmddef.dll.non to %CommonProgramFiles%\microsoft shared\help\cmddef.dll.non
from %TEMP%\atl71.dll.non to %CommonProgramFiles%\microsoft shared\help\atl71.dll.non
from %TEMP%\wpgimp32.flt.non to %CommonProgramFiles%\microsoft shared\grphflt\wpgimp32.flt.non
from %TEMP%\png32.flt.non to %CommonProgramFiles%\microsoft shared\grphflt\png32.flt.non
from %TEMP%\pictim32.flt.non to %CommonProgramFiles%\microsoft shared\grphflt\pictim32.flt.non
from %TEMP%\ms.wpg.non to %CommonProgramFiles%\microsoft shared\grphflt\ms.wpg.non
from %TEMP%\dexplmui.dll.non to %CommonProgramFiles%\microsoft shared\help\1033\dexplmui.dll.non
from %TEMP%\avconfig.exe.non to %ProgramFiles%\avconfig\avconfig.exe.non
from %TEMP%\avciman.exe.non to %ProgramFiles%\avciman\avciman.exe.non
from %TEMP%\avcenter.exe.non to %ProgramFiles%\avcenter\avcenter.exe.non
from %TEMP%\escript.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\escript.api.non
from %TEMP%\multimedia.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia.api.non
from %TEMP%\search.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\search.api.non
from %TEMP%\saveasrtf.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\saveasrtf.api.non
from %TEMP%\reflow.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\reflow.api.non
from %TEMP%\weblink.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\weblink.api.non
from %TEMP%\spelling.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\spelling.api.non
from %TEMP%\updater.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\updater.api.non
from %TEMP%\readoutloud.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\readoutloud.api.non
from %TEMP%\checkers.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\checkers.api.non
from %TEMP%\makeaccessible.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\makeaccessible.api.non
from %TEMP%\digsig.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\digsig.api.non
from %TEMP%\pddom.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\pddom.api.non
from %TEMP%\ebook.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ebook.api.non
from %TEMP%\dva.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\dva.api.non
from %TEMP%\agm.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\agm.dll.non
from %TEMP%\jsbytecodewin.bin.non to %ProgramFiles%\adobe\reader 11.0\reader\javascripts\jsbytecodewin.bin.non
from %TEMP%\eula.ini.non to %ProgramFiles%\adobe\reader 11.0\reader\legal\enu\eula.ini.non
from %TEMP%\cooltype.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\cooltype.dll.non
from %TEMP%\nppdf32.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\browser\nppdf32.dll.non
from %TEMP%\sccore.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\sccore.dll.non
from %TEMP%\nppdf32.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\air\nppdf32.dll.non
from %TEMP%\sqlite.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\sqlite.dll.non
from %TEMP%\accessibility.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\accessibility.api.non
from %TEMP%\ia32.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ia32.api.non
from %TEMP%\add_reviewer.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\add_reviewer.gif.non
from %TEMP%\ppklite.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ppklite.api.non
from %TEMP%\distribute_form.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\distribute_form.gif.non
from %TEMP%\info.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\info.gif.non
from %TEMP%\forms_super.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_super.gif.non
from %TEMP%\ended_review_or_form.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\ended_review_or_form.gif.non
from %TEMP%\br.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\br.gif.non
from %TEMP%\bl.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\bl.gif.non
from %TEMP%\prcr.x3d.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\prcr.x3d.non
from %TEMP%\myriadcad.otf.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\prc\myriadcad.otf.non
from %TEMP%\drvdx9.x3d.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\drvdx9.x3d.non
from %TEMP%\tesselate.x3d.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\tesselate.x3d.non
from %TEMP%\2d.x3d.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\2d.x3d.non
from %TEMP%\3difr.x3d.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\3difr.x3d.non
from %TEMP%\drvsoft.x3d.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\drvsoft.x3d.non
from %TEMP%\windowsmedia.mpp.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\windowsmedia.mpp.non
from %TEMP%\quicktime.mpp.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\quicktime.mpp.non
from %TEMP%\mcimpp.mpp.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\mcimpp.mpp.non
from %TEMP%\flash.mpp.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\flash.mpp.non
from %TEMP%\datamatrix.pmp.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\datamatrix.pmp.non
from %TEMP%\adobepdf417.pmp.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\adobepdf417.pmp.non
from %TEMP%\qrcode.pmp.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\qrcode.pmp.non
from %TEMP%\adobepdf.xdc.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\adobepdf.xdc.non
from %TEMP%\acrord32.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\acrord32.dll.non
from %TEMP%\acroform.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform.api.non
from %TEMP%\annots.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annots.api.non
from %TEMP%\adobexmp.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\adobexmp.dll.non
from %TEMP%\axsle.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\axsle.dll.non
from %TEMP%\npswf32.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\npswf32.dll.non
from %TEMP%\rtc.der.non to %ProgramFiles%\adobe\reader 11.0\reader\rtc.der.non
from %TEMP%\acrordif.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\acrordif.dll.non
from %TEMP%\adobelinguistic.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\adobelinguistic.dll.non
from %TEMP%\aavshield.exe.non to %ProgramFiles%\aavshield\aavshield.exe.non
from %TEMP%\acrotextextractor.exe.non to %ProgramFiles%\adobe\reader 11.0\reader\acrotextextractor.exe.non
from %TEMP%\adobe.reader.dependencies.manifest.non to %ProgramFiles%\adobe\reader 11.0\reader\adobe.reader.dependencies.manifest.non
from %TEMP%\acrord32info.exe.non to %ProgramFiles%\adobe\reader 11.0\reader\acrord32info.exe.non
from %TEMP%\ace.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\ace.dll.non
from %TEMP%\acrofx32.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\acrofx32.dll.non
from %TEMP%\acrobroker.exe.non to %ProgramFiles%\adobe\reader 11.0\reader\acrobroker.exe.non
from %TEMP%\a3dutils.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\a3dutils.dll.non
from %TEMP%\aiodlite.dll.non to %ProgramFiles%\adobe\reader 11.0\esl\aiodlite.dll.non
from %TEMP%\admunch.exe.non to %ProgramFiles%\admunch\admunch.exe.non
from %TEMP%\ackwin32.exe.non to %ProgramFiles%\ackwin32\ackwin32.exe.non
from %TEMP%\about.exe.non to %ProgramFiles%\about\about.exe.non
from %TEMP%\a2wizard.exe.non to %ProgramFiles%\a2wizard\a2wizard.exe.non
from %TEMP%\email_initiator.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\email_initiator.gif.non
from %TEMP%\a2upd.exe.non to %ProgramFiles%\a2upd\a2upd.exe.non
from %TEMP%\a2start.exe.non to %ProgramFiles%\a2start\a2start.exe.non
from %TEMP%\a2service.exe.non to %ProgramFiles%\a2service\a2service.exe.non
from %TEMP%\a2scan.exe.non to %ProgramFiles%\a2scan\a2scan.exe.non
from %TEMP%\a2hijackfree.exe.non to %ProgramFiles%\a2hijackfree\a2hijackfree.exe.non
from %TEMP%\a2guard.exe.non to %ProgramFiles%\a2guard\a2guard.exe.non
from %TEMP%\a2cmd.exe.non to %ProgramFiles%\a2cmd\a2cmd.exe.non
from %TEMP%\360tray.exe.non to %ProgramFiles%\360tray\360tray.exe.non
from %TEMP%\desktop.ini.non to %ProgramFiles%\desktop.ini.non
from %TEMP%\autoexec.bat.non to C:\autoexec.bat.non
from %TEMP%\adobecollabsync.exe.non to %ProgramFiles%\adobe\reader 11.0\reader\adobecollabsync.exe.non
from %TEMP%\wow_helper.exe.non to %ProgramFiles%\adobe\reader 11.0\reader\wow_helper.exe.non
from %TEMP%\create_form.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\create_form.gif.non
from %TEMP%\pdfprevhndlr.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\pdfprevhndlr.dll.non
from %TEMP%\reader_sl.exe.non to %ProgramFiles%\adobe\reader 11.0\reader\reader_sl.exe.non
from %TEMP%\rt3d.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\rt3d.dll.non
from %TEMP%\viewerps.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\viewerps.dll.non
from %TEMP%\ahclient.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\ahclient.dll.non
from %TEMP%\axe8sharedexpat.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\axe8sharedexpat.dll.non
from %TEMP%\arh.exe.non to %ProgramFiles%\adobe\reader 11.0\reader\arh.exe.non
from %TEMP%\bibutils.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\bibutils.dll.non
from %TEMP%\agmgpuoptin.ini.non to %ProgramFiles%\adobe\reader 11.0\reader\agmgpuoptin.ini.non
from %TEMP%\ccme_ecc.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\ccme_ecc.dll.non
from %TEMP%\extendscript.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\extendscript.dll.non
from %TEMP%\bib.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\bib.dll.non
from %TEMP%\ccme_ecdrbg.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\ccme_ecdrbg.dll.non
from %TEMP%\ccme_base.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\ccme_base.dll.non
from %TEMP%\ccme_asym.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\ccme_asym.dll.non
from %TEMP%\icucnv40.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\icucnv40.dll.non
from %TEMP%\ccme_base_non_fips.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\ccme_base_non_fips.dll.non
from %TEMP%\cryptocme.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\cryptocme.dll.non
from %TEMP%\eula.exe.non to %ProgramFiles%\adobe\reader 11.0\reader\eula.exe.non
from %TEMP%\jp2klib.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\jp2klib.dll.non
from %TEMP%\cryptocme.sig.non to %ProgramFiles%\adobe\reader 11.0\reader\cryptocme.sig.non
from %TEMP%\pe.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\pe.dll.non
from %TEMP%\onix32.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\onix32.dll.non
from %TEMP%\logsession.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\logsession.dll.non
from %TEMP%\icudt40.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\icudt40.dll.non
from %TEMP%\logtransport2.exe.non to %ProgramFiles%\adobe\reader 11.0\reader\logtransport2.exe.non
from %TEMP%\acrord32.exe.non to %ProgramFiles%\adobe\reader 11.0\reader\acrord32.exe.non
from %TEMP%\adoberfp.dll.non to %ProgramFiles%\adobe\reader 11.0\reader\adoberfp.dll.non
from %TEMP%\sendmail.api.non to %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\sendmail.api.non
from %TEMP%\email_all.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\email_all.gif.non
from %TEMP%\anti-trojan.exe.non to %ProgramFiles%\anti-trojan\anti-trojan.exe.non
from %TEMP%\cyrillic.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\cyrillic.txt.non
from %TEMP%\amsn.exe.non to %ProgramFiles%\amsn\amsn.exe.non
from %TEMP%\amon.exe.non to %ProgramFiles%\amon\amon.exe.non
from %TEMP%\alsvc.exe.non to %ProgramFiles%\alsvc\alsvc.exe.non
from %TEMP%\almon.exe.non to %ProgramFiles%\almon\almon.exe.non
from %TEMP%\airdefense.exe.non to %ProgramFiles%\airdefense\airdefense.exe.non
from %TEMP%\aimpro.exe.non to %ProgramFiles%\aimpro\aimpro.exe.non
from %TEMP%\aim6.exe.non to %ProgramFiles%\aim6\aim6.exe.non
from %TEMP%\ahnsd.exe.non to %ProgramFiles%\ahnsd\ahnsd.exe.non
from %TEMP%\ageofconan.exe.non to %ProgramFiles%\ageofconan\ageofconan.exe.non
from %TEMP%\agb5.exe.non to %ProgramFiles%\agb5\agb5.exe.non
from %TEMP%\cp1252.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1252.txt.non
from %TEMP%\cp1258.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1258.txt.non
from %TEMP%\cp1254.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1254.txt.non
from %TEMP%\cp1257.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1257.txt.non
from %TEMP%\cp1251.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1251.txt.non
from %TEMP%\cp1253.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1253.txt.non
from %TEMP%\cp1250.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\win\cp1250.txt.non
from %TEMP%\ukraine.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\ukraine.txt.non
from %TEMP%\turkish.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\turkish.txt.non
from %TEMP%\symbol.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\symbol.txt.non
from %TEMP%\romanian.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\romanian.txt.non
from %TEMP%\roman.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\roman.txt.non
from %TEMP%\iceland.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\iceland.txt.non
from %TEMP%\greek.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\greek.txt.non
from %TEMP%\open_original_form.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\open_original_form.gif.non
from %TEMP%\antivirus.exe.non to %ProgramFiles%\antivirus\antivirus.exe.non
from %TEMP%\aoltbserver.exe.non to %ProgramFiles%\aoltbserver\aoltbserver.exe.non
from %TEMP%\armor2net.exe.non to %ProgramFiles%\armor2net\armor2net.exe.non
from %TEMP%\armorsurf.exe.non to %ProgramFiles%\armorsurf\armorsurf.exe.non
from %TEMP%\autotrace.exe.non to %ProgramFiles%\autotrace\autotrace.exe.non
from %TEMP%\autostartexplorer.exe.non to %ProgramFiles%\autostartexplorer\autostartexplorer.exe.non
from %TEMP%\autodown.exe.non to %ProgramFiles%\autodown\autodown.exe.non
from %TEMP%\aswupdsv.exe.non to %ProgramFiles%\aswupdsv\aswupdsv.exe.non
from %TEMP%\aswregsvr.exe.non to %ProgramFiles%\aswregsvr\aswregsvr.exe.non
from %TEMP%\ash_updatemediator.exe.non to %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe.non
from %TEMP%\ashwebsv.exe.non to %ProgramFiles%\ashwebsv\ashwebsv.exe.non
from %TEMP%\ashupd.exe.non to %ProgramFiles%\ashupd\ashupd.exe.non
from %TEMP%\ashskpck.exe.non to %ProgramFiles%\ashskpck\ashskpck.exe.non
from %TEMP%\ashskpcc.exe.non to %ProgramFiles%\ashskpcc\ashskpcc.exe.non
from %TEMP%\ashsimpl.exe.non to %ProgramFiles%\ashsimpl\ashsimpl.exe.non
from %TEMP%\ashserv.exe.non to %ProgramFiles%\ashserv\ashserv.exe.non
from %TEMP%\ashsimp2.exe.non to %ProgramFiles%\ashsimp2\ashsimp2.exe.non
from %TEMP%\ashquick.exe.non to %ProgramFiles%\ashquick\ashquick.exe.non
from %TEMP%\ashmaisv.exe.non to %ProgramFiles%\ashmaisv\ashmaisv.exe.non
from %TEMP%\ashpopwz.exe.non to %ProgramFiles%\ashpopwz\ashpopwz.exe.non
from %TEMP%\ashlogv.exe.non to %ProgramFiles%\ashlogv\ashlogv.exe.non
from %TEMP%\ashenhcd.exe.non to %ProgramFiles%\ashenhcd\ashenhcd.exe.non
from %TEMP%\ashdug.exe.non to %ProgramFiles%\ashdug\ashdug.exe.non
from %TEMP%\ashdisp.exe.non to %ProgramFiles%\ashdisp\ashdisp.exe.non
from %TEMP%\ashchest.exe.non to %ProgramFiles%\ashchest\ashchest.exe.non
from %TEMP%\ashavast.exe.non to %ProgramFiles%\ashavast\ashavast.exe.non
from %TEMP%\ashavsrv.exe.non to %ProgramFiles%\ashavsrv\ashavsrv.exe.non
from %TEMP%\ash.exe.non to %ProgramFiles%\ash\ash.exe.non
from %TEMP%\avadmin.exe.non to %ProgramFiles%\avadmin\avadmin.exe.non
from %TEMP%\aceoledb.dll.non to %CommonProgramFiles%\microsoft shared\office14\aceoledb.dll.non
from %TEMP%\mssoapr3.dll.non to %CommonProgramFiles%\microsoft shared\office14\1033\mssoapr3.dll.non
from %TEMP%\centeuro.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\centeuro.txt.non
from %TEMP%\review_email.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_email.gif.non
from %TEMP%\turnonnotificationinacrobat.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnonnotificationinacrobat.gif.non
from %TEMP%\warning.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\warning.gif.non
from %TEMP%\reviews_joined.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_joined.gif.non
from %TEMP%\review_browser.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_browser.gif.non
from %TEMP%\reviewers.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviewers.gif.non
from %TEMP%\end_review.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\end_review.gif.non
from %TEMP%\submission_history.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\submission_history.gif.non
from %TEMP%\stop_collection_data.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\stop_collection_data.gif.non
from %TEMP%\server_lg.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_lg.gif.non
from %TEMP%\review_shared.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_shared.gif.non
from %TEMP%\review_same_reviewers.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_same_reviewers.gif.non
from %TEMP%\reviews_super.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_super.gif.non
from %TEMP%\turnoffnotificationinacrobat.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnoffnotificationinacrobat.gif.non
from %TEMP%\reviews_sent.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_sent.gif.non
from %TEMP%\tr.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\tr.gif.non
from %TEMP%\tl.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\tl.gif.non
from %TEMP%\pdf.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\pdf.gif.non
from %TEMP%\server_issue.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_issue.gif.non
from %TEMP%\rss.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\rss.gif.non
from %TEMP%\server_ok.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_ok.gif.non
from %TEMP%\forms_received.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_received.gif.non
from %TEMP%\form_responses.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\form_responses.gif.non
from %TEMP%\forms_distributed.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_distributed.gif.non
from %TEMP%\main.css.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\main.css.non
from %TEMP%\corpchar.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\corpchar.txt.non
from %TEMP%\croatian.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\mac\croatian.txt.non
from %TEMP%\trash.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\trash.gif.non
from %TEMP%\courierstd-oblique.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\courierstd-oblique.otf.non
from %TEMP%\turnonnotificationintray.gif.non to %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnonnotificationintray.gif.non
from %TEMP%\zdingbat.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\adobe\zdingbat.txt.non
from %TEMP%\dexshare.spi.non to %ProgramFiles%\adobe\reader 11.0\reader\services\dexshare.spi.non
from %TEMP%\symbol.txt.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\mappings\adobe\symbol.txt.non
from %TEMP%\dexechosign.spi.non to %ProgramFiles%\adobe\reader 11.0\reader\services\dexechosign.spi.non
from %TEMP%\icudt26l.dat.non to %ProgramFiles%\adobe\reader 11.0\resource\typesupport\unicode\icu\icudt26l.dat.non
from %TEMP%\minionpro-boldit.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\minionpro-boldit.otf.non
from %TEMP%\minionpro-it.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\minionpro-it.otf.non
from %TEMP%\minionpro-regular.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\minionpro-regular.otf.non
from %TEMP%\minionpro-bold.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\minionpro-bold.otf.non
from %TEMP%\myriadpro-boldit.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\myriadpro-boldit.otf.non
from %TEMP%\myriadpro-it.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\myriadpro-it.otf.non
from %TEMP%\myriadpro-bold.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\myriadpro-bold.otf.non
from %TEMP%\myriadpro-regular.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\myriadpro-regular.otf.non
from %TEMP%\saslprepprofile_norm_bidi.spp.non to %ProgramFiles%\adobe\reader 11.0\resource\saslprep\saslprepprofile_norm_bidi.spp.non
from %TEMP%\zy______.pfb.non to %ProgramFiles%\adobe\reader 11.0\resource\font\zy______.pfb.non
from %TEMP%\zy______.pfm.non to %ProgramFiles%\adobe\reader 11.0\resource\font\pfm\zy______.pfm.non
from %TEMP%\zx______.pfm.non to %ProgramFiles%\adobe\reader 11.0\resource\font\pfm\zx______.pfm.non
from %TEMP%\sy______.pfm.non to %ProgramFiles%\adobe\reader 11.0\resource\font\pfm\sy______.pfm.non
from %TEMP%\zx______.pfb.non to %ProgramFiles%\adobe\reader 11.0\resource\font\zx______.pfb.non
from %TEMP%\sy______.pfb.non to %ProgramFiles%\adobe\reader 11.0\resource\font\sy______.pfb.non
from %TEMP%\adobepistd.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\adobepistd.otf.non
from %TEMP%\courierstd-bold.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\courierstd-bold.otf.non
from %TEMP%\courierstd.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\courierstd.otf.non
from %TEMP%\courierstd-boldoblique.otf.non to %ProgramFiles%\adobe\reader 11.0\resource\font\courierstd-boldoblique.otf.non
from %TEMP%\services.cfg.non to %ProgramFiles%\adobe\reader 11.0\reader\services\services.cfg.non
from %TEMP%\msointl.dll.idx_dll.non to %CommonProgramFiles%\microsoft shared\office14\1033\msointl.dll.idx_dll.non

Substitutes the following executable files

<Full path to file>

Substitutes the following files

%TEMP%\desktop.ini.non
%TEMP%\cavoar.exe.non
%TEMP%\cavscons.exe.non
%TEMP%\cavsn.exe.non
%TEMP%\cavsubmit.exe.non
%TEMP%\cavvl.exe.non
%TEMP%\clamscan.exe.non
%TEMP%\claw95.exe.non
%TEMP%\list.txt.non
%TEMP%\excluded.txt.non
%TEMP%\itircl55.dll.non
%TEMP%\riched20.dll.non
%TEMP%\hxdsui.dll.non
%TEMP%\hxvzui.dll.non
%CommonProgramFiles%\microsoft shared\help\1049\hxdsui.dll.non
%CommonProgramFiles%\microsoft shared\help\1050\hxvzui.dll.non
%TEMP%\msoicons.exe.non
%TEMP%\msoxev.dll.non
%TEMP%\usp10.dll.non
%TEMP%\vbajet32.dll.non
%TEMP%\wisc30.dll.non
%TEMP%\cavmud.exe.non
%TEMP%\added.txt.non
%TEMP%\cavemsrv.exe.non
%TEMP%\drvdx9.x3d.non
%TEMP%\360tray.exe.non
%TEMP%\a2cmd.exe.non
%TEMP%\a2scan.exe.non
%TEMP%\a2start.exe.non
%TEMP%\a2upd.exe.non
%TEMP%\about.exe.non
%TEMP%\nppdf32.dll.non
%TEMP%\adobeid.pdf.non
%TEMP%\qrcode.pmp.non
%TEMP%\symbol.txt.non
%TEMP%\bdwizreg.exe.non
%TEMP%\aoltbserver.exe.non
%TEMP%\armorsurf.exe.non
%TEMP%\ashdisp.exe.non
%TEMP%\ashserv.exe.non
%TEMP%\avkserv.exe.non
%TEMP%\backweb-4476822.exe.non
%TEMP%\bdagent.exe.non
%TEMP%\bdoesrv.exe.non
%TEMP%\bdss.exe.non
%TEMP%\cafix.exe.non
%TEMP%\readme.htm.non

Moves itself

from <Full path to file> to %TEMP%\svchost.exe

Changes user data files extensions (Trojan.Encoder).

Network activity

UDP

DNS ASK ip##pi.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c "%TEMP%\b.bat"' (with hidden window)
'<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 14 /TN Г«ГґГ§Г‰ГҐIГµГ¤ /TR "<Full path to file>" /F' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c "%TEMP%\b.bat"
'<SYSTEM32>\net1.exe' stop sysdown
'<SYSTEM32>\net1.exe' stop adobearmservice
'<SYSTEM32>\net1.exe' stop themes
'<SYSTEM32>\net1.exe' stop sqlbrowser
'<SYSTEM32>\net1.exe' stop sql backupmaster
'<SYSTEM32>\net1.exe' stop sqlagent$sql2008exp
'<SYSTEM32>\net1.exe' stop VeeamEndpointBackupSvc
'<SYSTEM32>\net1.exe' stop sqltelemetry$sqlexpress
'<SYSTEM32>\net1.exe' stop mikroclientwservice
'<SYSTEM32>\net1.exe' stop reportserver
'<SYSTEM32>\net1.exe' stop sqlserveragent
'<SYSTEM32>\net1.exe' stop MSSQL$MIKRO
'<SYSTEM32>\net1.exe' stop msdtc
'<SYSTEM32>\net1.exe' stop sqltelemetryvv
'<SYSTEM32>\net1.exe' stop wuauserv
'<SYSTEM32>\net1.exe' stop sysmgmthp
'<SYSTEM32>\net1.exe' stop veeamtransportsvc
'<SYSTEM32>\net1.exe' stop veeamdeploysvc
'<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 14 /TN Г«ГґГ§Г‰ГҐIГµГ¤ /TR "<Full path to file>" /F
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v SuperHidden /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" /v UseLogonCredential /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop mssqlserver
'<SYSTEM32>\powercfg.exe' -h off
'<SYSTEM32>\net1.exe' stop mssql$sqlexpress
'<SYSTEM32>\net1.exe' stop sqlwriter
'<SYSTEM32>\net1.exe' stop cpqvcagent
'<SYSTEM32>\net1.exe' stop TeamViewer
'<SYSTEM32>\net1.exe' stop klsbackup2013pro
'<SYSTEM32>\net1.exe' stop foxitreaderservice
'<SYSTEM32>\net1.exe' stop mysql
'<SYSTEM32>\net1.exe' stop mysql501
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v ClearPageFileAtShutDown /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop mssqlfdlauncher
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial