Trojan.Encoder.31154

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\tree_view.html
<Drive name for removable media>:\browse.html
<Drive name for removable media>:\parnas_01.jpeg
<Drive name for removable media>:\210252809.jpeg
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\region-north-karelia.jpeg
<Drive name for removable media>:\1189.jpg
<Drive name for removable media>:\region-north-karelia.jpg
<Drive name for removable media>:\168.jpg
<Drive name for removable media>:\scan.mov
<Drive name for removable media>:\etc6_m_1.mov
<Drive name for removable media>:\api-hashmap.html
<Drive name for removable media>:\about.html
<Drive name for removable media>:\51.mp4
<Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
<Drive name for removable media>:\asm.png
<Drive name for removable media>:\calibre.png
<Drive name for removable media>:\systisoft.pem
<Drive name for removable media>:\ck.pem
<Drive name for removable media>:\irgeek.pem
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\delongcacert.pem
<Drive name for removable media>:\server.pem
<Drive name for removable media>:\ck_ugo.pem
<Drive name for removable media>:\investmentbankca_ca8.pem
<Drive name for removable media>:\lom602.pdf
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\10thingscondoms.pdf
<Drive name for removable media>:\7790_preview.pdf
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\about.htm
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\utorrent.exe
<Drive name for removable media>:\tunpersonalca1.pem
<Drive name for removable media>:\notepad.exe
<Drive name for removable media>:\dissolveanother.png
<Drive name for removable media>:\calc.exe
<Drive name for removable media>:\tcm851ax32.exe
<Drive name for removable media>:\skypesetup.exe
<Drive name for removable media>:\dotnetfx45_full_setup.exe
<Drive name for removable media>:\garden.htm
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
<Drive name for removable media>:\block.png

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Modifies file system

Creates the following files

C:\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\filters\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\filters\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\grphflt\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\grphflt\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\help\!!! read this !!!.hta
%CommonProgramFiles%\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\help\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\ar-sa\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\ar-sa\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\bg-bg\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\bg-bg\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\cs-cz\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\equation\1033\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\euro\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\euro\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\equation\1033\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\equation\how to recover encrypted files.txt
%ProgramFiles%\clrcche\!!! read this !!!.hta
%ProgramFiles%\clrcche\how to recover encrypted files.txt
%ProgramFiles%\cmain\!!! read this !!!.hta
%ProgramFiles%\cmain\how to recover encrypted files.txt
%ProgramFiles%\cmgrdian\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\cs-cz\how to recover encrypted files.txt
%ProgramFiles%\cmgrdian\how to recover encrypted files.txt
%ProgramFiles%\cleaner3\how to recover encrypted files.txt
%CommonProgramFiles%\how to recover encrypted files.txt
%CommonProgramFiles%\designer\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\dw\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\dw\how to recover encrypted files.txt
%ProgramFiles%\clisvc\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\equation\!!! read this !!!.hta
%CommonProgramFiles%\designer\!!! read this !!!.hta
%ProgramFiles%\clisvc\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\da-dk\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\el-gr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\he-il\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\he-il\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\how to recover encrypted files.txt
%ProgramFiles%\cavuserupd\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\el-gr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\es-es\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\es-es\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\da-dk\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\de-de\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\de-de\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\et-ee\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fr-fr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fr-fr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\et-ee\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\fi-fi\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fi-fi\how to recover encrypted files.txt
%ProgramFiles%\cleaner3\!!! read this !!!.hta
%ProgramFiles%\cleaner\how to recover encrypted files.txt
%ProgramFiles%\cleaner\!!! read this !!!.hta
%ProgramFiles%\cavasm\how to recover encrypted files.txt
%ProgramFiles%\cavaud\!!! read this !!!.hta
%ProgramFiles%\cavaud\how to recover encrypted files.txt
%ProgramFiles%\cavemsrv\!!! read this !!!.hta
%ProgramFiles%\cavemsrv\how to recover encrypted files.txt
%ProgramFiles%\cavmr\!!! read this !!!.hta
%ProgramFiles%\cavscons\how to recover encrypted files.txt
%ProgramFiles%\cavmr\how to recover encrypted files.txt
%ProgramFiles%\cavmud\how to recover encrypted files.txt
%ProgramFiles%\cavoar\!!! read this !!!.hta
%ProgramFiles%\cavoar\how to recover encrypted files.txt
%ProgramFiles%\cavq\!!! read this !!!.hta
%ProgramFiles%\cavq\how to recover encrypted files.txt
%ProgramFiles%\cavapp\!!! read this !!!.hta
%ProgramFiles%\cafix\how to recover encrypted files.txt
%ProgramFiles%\cavasm\!!! read this !!!.hta
%ProgramFiles%\cafix\!!! read this !!!.hta
%ProgramFiles%\cabalmain\how to recover encrypted files.txt
%ProgramFiles%\bdsurvey\how to recover encrypted files.txt
%ProgramFiles%\bdswitch\how to recover encrypted files.txt
%ProgramFiles%\bdwizreg\!!! read this !!!.hta
%ProgramFiles%\bdwizreg\how to recover encrypted files.txt
%ProgramFiles%\blackd\!!! read this !!!.hta
%ProgramFiles%\blackd\how to recover encrypted files.txt
%ProgramFiles%\cavscons\!!! read this !!!.hta
%ProgramFiles%\blackice\!!! read this !!!.hta
%ProgramFiles%\cavmud\!!! read this !!!.hta
%ProgramFiles%\blindman\!!! read this !!!.hta
%ProgramFiles%\btini\!!! read this !!!.hta
%ProgramFiles%\btini\how to recover encrypted files.txt
%ProgramFiles%\btinint\!!! read this !!!.hta
%ProgramFiles%\btinint\how to recover encrypted files.txt
%ProgramFiles%\cabalmain\!!! read this !!!.hta
%ProgramFiles%\blackice\how to recover encrypted files.txt
%ProgramFiles%\bdswitch\!!! read this !!!.hta
%ProgramFiles%\blindman\how to recover encrypted files.txt
%ProgramFiles%\cavapp\how to recover encrypted files.txt
%ProgramFiles%\cavse\!!! read this !!!.hta
%ProgramFiles%\ccsetmgr\!!! read this !!!.hta
%ProgramFiles%\cemrep\!!! read this !!!.hta
%ProgramFiles%\cemrep\how to recover encrypted files.txt
%ProgramFiles%\chrome\!!! read this !!!.hta
%ProgramFiles%\chrome\how to recover encrypted files.txt
%ProgramFiles%\clamscan\!!! read this !!!.hta
%ProgramFiles%\ccproxy\how to recover encrypted files.txt
%ProgramFiles%\cavse\how to recover encrypted files.txt
%ProgramFiles%\ccsetmgr\how to recover encrypted files.txt
%ProgramFiles%\clamscan\how to recover encrypted files.txt
%ProgramFiles%\clamwin\how to recover encrypted files.txt
%ProgramFiles%\claw95\!!! read this !!!.hta
%ProgramFiles%\claw95\how to recover encrypted files.txt
%ProgramFiles%\claw95cf\!!! read this !!!.hta
%ProgramFiles%\claw95cf\how to recover encrypted files.txt
%ProgramFiles%\clamtray\!!! read this !!!.hta
%ProgramFiles%\clamtray\how to recover encrypted files.txt
%ProgramFiles%\clamwin\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\!!! read this !!!.hta
%ProgramFiles%\ccleaner\!!! read this !!!.hta
%ProgramFiles%\cavsn\how to recover encrypted files.txt
%ProgramFiles%\cavsub\!!! read this !!!.hta
%ProgramFiles%\cavsub\how to recover encrypted files.txt
%ProgramFiles%\cavsubmit\!!! read this !!!.hta
%ProgramFiles%\cavsubmit\how to recover encrypted files.txt
%ProgramFiles%\cavumas\!!! read this !!!.hta
%ProgramFiles%\ccleaner\how to recover encrypted files.txt
%ProgramFiles%\ccproxy\!!! read this !!!.hta
%ProgramFiles%\cavumas\how to recover encrypted files.txt
%ProgramFiles%\cavvl\!!! read this !!!.hta
%ProgramFiles%\cavvl\how to recover encrypted files.txt
%ProgramFiles%\ccapp\!!! read this !!!.hta
%ProgramFiles%\ccapp\how to recover encrypted files.txt
%ProgramFiles%\ccevtmgr\!!! read this !!!.hta
%ProgramFiles%\ccevtmgr\how to recover encrypted files.txt
%ProgramFiles%\cavsn\!!! read this !!!.hta
%ProgramFiles%\cavuserupd\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\hu-hu\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\hu-hu\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\smart tag\lists\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\source engine\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\source engine\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\stationery\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\textconv\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\textconv\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\textconv\en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\textconv\en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\smart tag\1033\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\smart tag\1033\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\smart tag\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\smart tag\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\proof\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\stationery\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\proof\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\arctic\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\arctic\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\concrete\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\concrete\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\deepblue\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\deepblue\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\echo\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\echo\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\eclipse\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\edge\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\edge\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\expeditn\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\expeditn\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\ice\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\ice\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\compass\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\boldstri\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\compass\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\axis\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\axis\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\blends\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\blends\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\!!! read this !!!.hta
%ProgramFiles%\bdsurvey\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\cascade\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\boldstri\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\breeze\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\breeze\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\canyon\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\canyon\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\capsules\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\capsules\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\cascade\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\msinfo\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\pt-pt\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\ro-ro\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\ro-ro\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\ru-ru\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\ru-ru\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\sk-sk\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\lt-lt\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\sk-sk\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\sv-se\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\sv-se\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\th-th\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\pt-br\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\pt-pt\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\pt-br\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\pl-pl\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\pl-pl\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\it-it\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\it-it\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\ja-jp\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\ja-jp\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\ko-kr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\th-th\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\ko-kr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\lv-lv\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\lv-lv\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\nb-no\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\nb-no\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\nl-nl\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\nl-nl\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\lt-lt\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\tr-tr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\tr-tr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\uk-ua\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\indust\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\msinfo\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\uk-ua\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\zh-cn\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\zh-cn\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\ink\zh-tw\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\ink\zh-tw\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\msclientdatamgr\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\msclientdatamgr\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\cultures\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\msinfo\en-us\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\msinfo\en-us\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\1033\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\1033\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\office14\cultures\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\!!! read this !!!.hta
%CommonProgramFiles%\microsoft shared\themes14\eclipse\how to recover encrypted files.txt
%ProgramFiles%\bdsubmitwiz\how to recover encrypted files.txt
%ProgramFiles%\bdmcon\!!! read this !!!.hta
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\!!! read this !!!.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\how to recover encrypted files.txt
C:\msocache\how to recover encrypted files.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\!!! read this !!!.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\!!! read this !!!.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\how to recover encrypted files.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\far2\pluginsdk\headers.c\how to recover encrypted files.txt
C:\far2\pluginsdk\headers.pas\!!! read this !!!.hta
C:\far2\pluginsdk\headers.pas\how to recover encrypted files.txt
<Current directory>\!!! read this !!!.hta
<Current directory>\how to recover encrypted files.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\!!! read this !!!.hta
C:\far2\pluginsdk\!!! read this !!!.hta
C:\msocache\all users\!!! read this !!!.hta
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\far2\pluginsdk\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\how to recover encrypted files.txt
C:\far2\pluginsdk\headers.c\!!! read this !!!.hta
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
%ProgramFiles%\a2hijackfree\how to recover encrypted files.txt
%ProgramFiles%\a2scan\!!! read this !!!.hta
%ProgramFiles%\a2scan\how to recover encrypted files.txt
%ProgramFiles%\a2service\!!! read this !!!.hta
%ProgramFiles%\a2service\how to recover encrypted files.txt
%ProgramFiles%\a2start\!!! read this !!!.hta
%ProgramFiles%\a2cmd\how to recover encrypted files.txt
%ProgramFiles%\a2start\how to recover encrypted files.txt
%ProgramFiles%\a2upd\how to recover encrypted files.txt
%ProgramFiles%\a2wizard\!!! read this !!!.hta
%ProgramFiles%\a2wizard\how to recover encrypted files.txt
%ProgramFiles%\aavshield\!!! read this !!!.hta
%ProgramFiles%\aavshield\how to recover encrypted files.txt
%ProgramFiles%\about\!!! read this !!!.hta
%ProgramFiles%\a2guard\how to recover encrypted files.txt
%ProgramFiles%\a2hijackfree\!!! read this !!!.hta
%ProgramFiles%\a2guard\!!! read this !!!.hta
%ProgramFiles%\a2cmd\!!! read this !!!.hta
C:\far2\plugins\arclite\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\!!! read this !!!.hta
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\!!! read this !!!.hta
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\!!! read this !!!.hta
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\how to recover encrypted files.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\how to recover encrypted files.txt
C:\perflogs\admin\how to recover encrypted files.txt
%ProgramFiles%\!!! read this !!!.hta
%ProgramFiles%\how to recover encrypted files.txt
%ProgramFiles%\360tray\!!! read this !!!.hta
%ProgramFiles%\360tray\how to recover encrypted files.txt
C:\perflogs\!!! read this !!!.hta
C:\perflogs\how to recover encrypted files.txt
C:\perflogs\admin\!!! read this !!!.hta
C:\far2\plugins\tmppanel\how to recover encrypted files.txt
C:\far2\plugins\tmppanel\!!! read this !!!.hta
C:\far2\plugins\proclist\how to recover encrypted files.txt
C:\far2\addons\setup\!!! read this !!!.hta
C:\far2\addons\setup\how to recover encrypted files.txt
C:\far2\addons\shell\!!! read this !!!.hta
C:\far2\addons\shell\how to recover encrypted files.txt
C:\far2\addons\xlat\!!! read this !!!.hta
C:\far2\addons\xlat\how to recover encrypted files.txt
C:\far2\encyclopedia\!!! read this !!!.hta
C:\far2\addons\xlat\russian\!!! read this !!!.hta
C:\far2\documentation\!!! read this !!!.hta
C:\far2\documentation\how to recover encrypted files.txt
C:\far2\documentation\eng\!!! read this !!!.hta
C:\far2\documentation\eng\how to recover encrypted files.txt
C:\far2\documentation\rus\!!! read this !!!.hta
C:\far2\addons\colors\default_highlighting\how to recover encrypted files.txt
C:\far2\addons\colors\default_highlighting\!!! read this !!!.hta
C:\far2\addons\macros\how to recover encrypted files.txt
C:\far2\addons\colors\custom_highlighting\how to recover encrypted files.txt
C:\far2\addons\colors\custom_highlighting\!!! read this !!!.hta
D:\$recycle.bin\!!! read this !!!.hta
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!!! read this !!!.hta
C:\$recycle.bin\!!! read this !!!.hta
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to recover encrypted files.txt
C:\$recycle.bin\how to recover encrypted files.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!!! read this !!!.hta
C:\far2\documentation\rus\how to recover encrypted files.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to recover encrypted files.txt
C:\far2\addons\xlat\russian\how to recover encrypted files.txt
C:\documents and settings\how to recover encrypted files.txt
C:\far2\how to recover encrypted files.txt
C:\far2\addons\!!! read this !!!.hta
C:\far2\addons\how to recover encrypted files.txt
C:\far2\addons\colors\!!! read this !!!.hta
C:\far2\addons\colors\how to recover encrypted files.txt
C:\documents and settings\!!! read this !!!.hta
D:\$recycle.bin\how to recover encrypted files.txt
C:\far2\!!! read this !!!.hta
C:\far2\addons\macros\!!! read this !!!.hta
C:\far2\encyclopedia\how to recover encrypted files.txt
C:\far2\plugins\emenu\how to recover encrypted files.txt
C:\far2\plugins\farcmds\how to recover encrypted files.txt
C:\far2\plugins\filecase\!!! read this !!!.hta
C:\far2\plugins\filecase\how to recover encrypted files.txt
C:\far2\plugins\ftp\!!! read this !!!.hta
C:\far2\plugins\ftp\how to recover encrypted files.txt
C:\far2\plugins\emenu\!!! read this !!!.hta
C:\far2\encyclopedia\tap\!!! read this !!!.hta
C:\far2\plugins\farcmds\!!! read this !!!.hta
C:\far2\plugins\ftp\lib\!!! read this !!!.hta
C:\far2\plugins\macroview\!!! read this !!!.hta
C:\far2\plugins\macroview\how to recover encrypted files.txt
C:\far2\plugins\network\!!! read this !!!.hta
C:\far2\plugins\network\how to recover encrypted files.txt
C:\far2\plugins\proclist\!!! read this !!!.hta
C:\far2\plugins\ftp\lib\how to recover encrypted files.txt
C:\far2\plugins\hlfviewer\!!! read this !!!.hta
C:\far2\plugins\hlfviewer\how to recover encrypted files.txt
%ProgramFiles%\a2upd\!!! read this !!!.hta
%ProgramFiles%\about\how to recover encrypted files.txt
C:\far2\plugins\drawline\how to recover encrypted files.txt
C:\far2\fexcept\!!! read this !!!.hta
C:\far2\fexcept\how to recover encrypted files.txt
C:\far2\plugins\!!! read this !!!.hta
C:\far2\plugins\how to recover encrypted files.txt
C:\far2\plugins\align\!!! read this !!!.hta
C:\far2\plugins\align\how to recover encrypted files.txt
C:\far2\plugins\editcase\!!! read this !!!.hta
C:\far2\plugins\editcase\how to recover encrypted files.txt
C:\far2\plugins\arclite\!!! read this !!!.hta
C:\far2\plugins\autowrap\how to recover encrypted files.txt
C:\far2\plugins\brackets\!!! read this !!!.hta
C:\far2\plugins\brackets\how to recover encrypted files.txt
C:\far2\plugins\compare\!!! read this !!!.hta
C:\far2\plugins\compare\how to recover encrypted files.txt
C:\far2\plugins\drawline\!!! read this !!!.hta
C:\far2\encyclopedia\tap\how to recover encrypted files.txt
C:\far2\plugins\autowrap\!!! read this !!!.hta
%ProgramFiles%\ackwin32\!!! read this !!!.hta
%ProgramFiles%\ackwin32\how to recover encrypted files.txt
%ProgramFiles%\admunch\!!! read this !!!.hta
%ProgramFiles%\avgfwsrv\how to recover encrypted files.txt
%ProgramFiles%\avginet\!!! read this !!!.hta
%ProgramFiles%\avginet\how to recover encrypted files.txt
%ProgramFiles%\avgnpdln\!!! read this !!!.hta
%ProgramFiles%\avgnpdln\how to recover encrypted files.txt
%ProgramFiles%\avgnpsvc\!!! read this !!!.hta
%ProgramFiles%\avconfig\!!! read this !!!.hta
%ProgramFiles%\avgnpsvc\how to recover encrypted files.txt
%ProgramFiles%\avgrssvc\how to recover encrypted files.txt
%ProgramFiles%\avgscan\!!! read this !!!.hta
%ProgramFiles%\avgscan\how to recover encrypted files.txt
%ProgramFiles%\avgupden\!!! read this !!!.hta
%ProgramFiles%\avgupden\how to recover encrypted files.txt
%ProgramFiles%\avgupsvc\!!! read this !!!.hta
%ProgramFiles%\avgemc\how to recover encrypted files.txt
%ProgramFiles%\avgfwsrv\!!! read this !!!.hta
%ProgramFiles%\avgemc\!!! read this !!!.hta
%ProgramFiles%\avgdiag\how to recover encrypted files.txt
%ProgramFiles%\avgdiag\!!! read this !!!.hta
%ProgramFiles%\avadmin\how to recover encrypted files.txt
%ProgramFiles%\avcenter\!!! read this !!!.hta
%ProgramFiles%\avcenter\how to recover encrypted files.txt
%ProgramFiles%\avciman\!!! read this !!!.hta
%ProgramFiles%\avciman\how to recover encrypted files.txt
%ProgramFiles%\avcmd\!!! read this !!!.hta
%ProgramFiles%\avgupsvc\how to recover encrypted files.txt
%ProgramFiles%\avgrssvc\!!! read this !!!.hta
%ProgramFiles%\avcmd\how to recover encrypted files.txt
%ProgramFiles%\avconsol\!!! read this !!!.hta
%ProgramFiles%\avconsol\how to recover encrypted files.txt
%ProgramFiles%\avgamsvr\!!! read this !!!.hta
%ProgramFiles%\avgamsvr\how to recover encrypted files.txt
%ProgramFiles%\avgcc\!!! read this !!!.hta
%ProgramFiles%\avgcc\how to recover encrypted files.txt
%ProgramFiles%\avadmin\!!! read this !!!.hta
%ProgramFiles%\avconfig\how to recover encrypted files.txt
%ProgramFiles%\avgvv\!!! read this !!!.hta
%ProgramFiles%\avgvv\how to recover encrypted files.txt
%ProgramFiles%\avgw\!!! read this !!!.hta
%ProgramFiles%\avsynmgr\how to recover encrypted files.txt
%ProgramFiles%\b2\!!! read this !!!.hta
%ProgramFiles%\b2\how to recover encrypted files.txt
%ProgramFiles%\backweb-4476822\!!! read this !!!.hta
%ProgramFiles%\backweb-4476822\how to recover encrypted files.txt
%ProgramFiles%\bdagent\!!! read this !!!.hta
%ProgramFiles%\bdagent\how to recover encrypted files.txt
%ProgramFiles%\bdmcon\how to recover encrypted files.txt
%ProgramFiles%\autotrace\how to recover encrypted files.txt
%ProgramFiles%\bdnews\!!! read this !!!.hta
%ProgramFiles%\bdnews\how to recover encrypted files.txt
%ProgramFiles%\bdoesrv\!!! read this !!!.hta
%ProgramFiles%\bdoesrv\how to recover encrypted files.txt
%ProgramFiles%\bdss\!!! read this !!!.hta
%ProgramFiles%\bdss\how to recover encrypted files.txt
%ProgramFiles%\bdsubmit\!!! read this !!!.hta
%ProgramFiles%\avsynmgr\!!! read this !!!.hta
%ProgramFiles%\avkservice\how to recover encrypted files.txt
%ProgramFiles%\avscan\how to recover encrypted files.txt
%ProgramFiles%\avkservice\!!! read this !!!.hta
%ProgramFiles%\avgw\how to recover encrypted files.txt
%ProgramFiles%\avgwizfw\!!! read this !!!.hta
%ProgramFiles%\avgwizfw\how to recover encrypted files.txt
%ProgramFiles%\avinitnt\!!! read this !!!.hta
%ProgramFiles%\avinitnt\how to recover encrypted files.txt
%ProgramFiles%\avkserv\!!! read this !!!.hta
%ProgramFiles%\avkserv\how to recover encrypted files.txt
%ProgramFiles%\bdsubmitwiz\!!! read this !!!.hta
%ProgramFiles%\avpm\how to recover encrypted files.txt
%ProgramFiles%\avkwctl\!!! read this !!!.hta
%ProgramFiles%\avkwctl\how to recover encrypted files.txt
%ProgramFiles%\avnotify\!!! read this !!!.hta
%ProgramFiles%\avnotify\how to recover encrypted files.txt
%ProgramFiles%\avpcc\!!! read this !!!.hta
%ProgramFiles%\avpcc\how to recover encrypted files.txt
%ProgramFiles%\avpm\!!! read this !!!.hta
%ProgramFiles%\avscan\!!! read this !!!.hta
%ProgramFiles%\ashmaisv\!!! read this !!!.hta
%ProgramFiles%\autotrace\!!! read this !!!.hta
%ProgramFiles%\ashwebsv\how to recover encrypted files.txt
%ProgramFiles%\anti-trojan\!!! read this !!!.hta
%ProgramFiles%\anti-trojan\how to recover encrypted files.txt
%ProgramFiles%\antivirus\!!! read this !!!.hta
%ProgramFiles%\antivirus\how to recover encrypted files.txt
%ProgramFiles%\aoltbserver\!!! read this !!!.hta
%ProgramFiles%\aoltbserver\how to recover encrypted files.txt
%ProgramFiles%\aim6\how to recover encrypted files.txt
%ProgramFiles%\armor2net\!!! read this !!!.hta
%ProgramFiles%\armorsurf\!!! read this !!!.hta
%ProgramFiles%\armorsurf\how to recover encrypted files.txt
%ProgramFiles%\ash\!!! read this !!!.hta
%ProgramFiles%\ash\how to recover encrypted files.txt
%ProgramFiles%\ashavast\!!! read this !!!.hta
%ProgramFiles%\ashavast\how to recover encrypted files.txt
%ProgramFiles%\amsn\!!! read this !!!.hta
%ProgramFiles%\amsn\how to recover encrypted files.txt
%ProgramFiles%\amon\how to recover encrypted files.txt
%ProgramFiles%\amon\!!! read this !!!.hta
%ProgramFiles%\alsvc\how to recover encrypted files.txt
%ProgramFiles%\agb5\!!! read this !!!.hta
%ProgramFiles%\agb5\how to recover encrypted files.txt
%ProgramFiles%\ageofconan\!!! read this !!!.hta
%ProgramFiles%\ageofconan\how to recover encrypted files.txt
%ProgramFiles%\ahnsd\!!! read this !!!.hta
%ProgramFiles%\ahnsd\how to recover encrypted files.txt
%ProgramFiles%\ashavsrv\!!! read this !!!.hta
%ProgramFiles%\armor2net\how to recover encrypted files.txt
%ProgramFiles%\aim6\!!! read this !!!.hta
%ProgramFiles%\aimpro\how to recover encrypted files.txt
%ProgramFiles%\airdefense\!!! read this !!!.hta
%ProgramFiles%\airdefense\how to recover encrypted files.txt
%ProgramFiles%\almon\!!! read this !!!.hta
%ProgramFiles%\almon\how to recover encrypted files.txt
%ProgramFiles%\alsvc\!!! read this !!!.hta
%ProgramFiles%\admunch\how to recover encrypted files.txt
%ProgramFiles%\aimpro\!!! read this !!!.hta
%ProgramFiles%\ashavsrv\how to recover encrypted files.txt
%ProgramFiles%\ashchest\!!! read this !!!.hta
%ProgramFiles%\ashchest\how to recover encrypted files.txt
%ProgramFiles%\ashskpcc\!!! read this !!!.hta
%ProgramFiles%\ashskpcc\how to recover encrypted files.txt
%ProgramFiles%\ashskpck\!!! read this !!!.hta
%ProgramFiles%\ashskpck\how to recover encrypted files.txt
%ProgramFiles%\ashupd\!!! read this !!!.hta
%ProgramFiles%\ashupd\how to recover encrypted files.txt
%ProgramFiles%\ashwebsv\!!! read this !!!.hta
%ProgramFiles%\ash_updatemediator\!!! read this !!!.hta
%ProgramFiles%\autostartexplorer\how to recover encrypted files.txt
%ProgramFiles%\ash_updatemediator\how to recover encrypted files.txt
%ProgramFiles%\aswregsvr\!!! read this !!!.hta
%ProgramFiles%\aswregsvr\how to recover encrypted files.txt
%ProgramFiles%\aswupdsv\!!! read this !!!.hta
%ProgramFiles%\aswupdsv\how to recover encrypted files.txt
%ProgramFiles%\autodown\!!! read this !!!.hta
%ProgramFiles%\autodown\how to recover encrypted files.txt
%ProgramFiles%\ashsimpl\how to recover encrypted files.txt
%ProgramFiles%\bdsubmit\how to recover encrypted files.txt
%ProgramFiles%\ashsimpl\!!! read this !!!.hta
%ProgramFiles%\ashlogv\how to recover encrypted files.txt
%ProgramFiles%\ashdisp\!!! read this !!!.hta
%ProgramFiles%\ashdisp\how to recover encrypted files.txt
%ProgramFiles%\ashdug\!!! read this !!!.hta
%ProgramFiles%\ashdug\how to recover encrypted files.txt
%ProgramFiles%\ashenhcd\!!! read this !!!.hta
%ProgramFiles%\ashenhcd\how to recover encrypted files.txt
%ProgramFiles%\ashlogv\!!! read this !!!.hta
%ProgramFiles%\autostartexplorer\!!! read this !!!.hta
%ProgramFiles%\ashsimp2\!!! read this !!!.hta
%ProgramFiles%\ashmaisv\how to recover encrypted files.txt
%ProgramFiles%\ashpopwz\!!! read this !!!.hta
%ProgramFiles%\ashpopwz\how to recover encrypted files.txt
%ProgramFiles%\ashquick\!!! read this !!!.hta
%ProgramFiles%\ashquick\how to recover encrypted files.txt
%ProgramFiles%\ashserv\!!! read this !!!.hta
%ProgramFiles%\ashserv\how to recover encrypted files.txt
%ProgramFiles%\ashsimp2\how to recover encrypted files.txt
%CommonProgramFiles%\microsoft shared\themes14\indust\how to recover encrypted files.txt

Moves the following files

from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\[supportc1@elude.in][id=25a1cae3]aiodlite.dll.notfound
from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\[supportc1@elude.in][id=25a1cae3]antivirus.exe.notfound
from %ProgramFiles%\anti-trojan\anti-trojan.exe to %ProgramFiles%\anti-trojan\[supportc1@elude.in][id=25a1cae3]anti-trojan.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]adobe.reader.dependencies.manifest.notfound
from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\[supportc1@elude.in][id=25a1cae3]amsn.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adelrcp.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]adelrcp.exe.notfound
from %ProgramFiles%\amon\amon.exe to %ProgramFiles%\amon\[supportc1@elude.in][id=25a1cae3]amon.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrotextextractor.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]acrotextextractor.exe.notfound
from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\[supportc1@elude.in][id=25a1cae3]alsvc.exe.notfound
from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\[supportc1@elude.in][id=25a1cae3]almon.exe.notfound
from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\[supportc1@elude.in][id=25a1cae3]airdefense.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrosup64.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]acrosup64.dll.notfound
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\[supportc1@elude.in][id=25a1cae3]aimpro.exe.notfound
from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\[supportc1@elude.in][id=25a1cae3]aim6.exe.notfound
from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\[supportc1@elude.in][id=25a1cae3]ahnsd.exe.notfound
from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\[supportc1@elude.in][id=25a1cae3]ageofconan.exe.notfound
from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\[supportc1@elude.in][id=25a1cae3]agb5.exe.notfound
from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\[supportc1@elude.in][id=25a1cae3]admunch.exe.notfound
from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\[supportc1@elude.in][id=25a1cae3]ackwin32.exe.notfound
from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\[supportc1@elude.in][id=25a1cae3]about.exe.notfound
from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\[supportc1@elude.in][id=25a1cae3]aoltbserver.exe.notfound
from %ProgramFiles%\armor2net\armor2net.exe to %ProgramFiles%\armor2net\[supportc1@elude.in][id=25a1cae3]armor2net.exe.notfound
from %ProgramFiles%\ashskpcc\ashskpcc.exe to %ProgramFiles%\ashskpcc\[supportc1@elude.in][id=25a1cae3]ashskpcc.exe.notfound
from %ProgramFiles%\armorsurf\armorsurf.exe to %ProgramFiles%\armorsurf\[supportc1@elude.in][id=25a1cae3]armorsurf.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]agmgpuoptin.ini.notfound
from %ProgramFiles%\ashsimpl\ashsimpl.exe to %ProgramFiles%\ashsimpl\[supportc1@elude.in][id=25a1cae3]ashsimpl.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agm.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]agm.dll.notfound
from %ProgramFiles%\ashsimp2\ashsimp2.exe to %ProgramFiles%\ashsimp2\[supportc1@elude.in][id=25a1cae3]ashsimp2.exe.notfound
from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\[supportc1@elude.in][id=25a1cae3]ashserv.exe.notfound
from %ProgramFiles%\ashquick\ashquick.exe to %ProgramFiles%\ashquick\[supportc1@elude.in][id=25a1cae3]ashquick.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobexmp.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]adobexmp.dll.notfound
from %ProgramFiles%\ashpopwz\ashpopwz.exe to %ProgramFiles%\ashpopwz\[supportc1@elude.in][id=25a1cae3]ashpopwz.exe.notfound
from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\[supportc1@elude.in][id=25a1cae3]ashmaisv.exe.notfound
from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\[supportc1@elude.in][id=25a1cae3]ashlogv.exe.notfound
from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\[supportc1@elude.in][id=25a1cae3]ashenhcd.exe.notfound
from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\[supportc1@elude.in][id=25a1cae3]ashdug.exe.notfound
from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\[supportc1@elude.in][id=25a1cae3]ashdisp.exe.notfound
from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\[supportc1@elude.in][id=25a1cae3]ashchest.exe.notfound
from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\[supportc1@elude.in][id=25a1cae3]ashavsrv.exe.notfound
from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\[supportc1@elude.in][id=25a1cae3]ashavast.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adoberfp.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]adoberfp.dll.notfound
from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\[supportc1@elude.in][id=25a1cae3]ash.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobelinguistic.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]adobelinguistic.dll.notfound
from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\[supportc1@elude.in][id=25a1cae3]aavshield.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobecollabsync.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]adobecollabsync.exe.notfound
from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\[supportc1@elude.in][id=25a1cae3]a2wizard.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]acrobroker.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\trackedsend.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]trackedsend.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\stamp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]stamp.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\measure.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]measure.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\home.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]home.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\fillsign.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]fillsign.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\epdf_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]epdf_rhp.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\epdf_full.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]epdf_full.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\edit_r_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]edit_r_rhp.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\edit_r_full.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]edit_r_full.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\cpdf_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]cpdf_rhp.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\cpdf_full.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]cpdf_full.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\comments.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]comments.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\combine_r_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]combine_r_rhp.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\collectsignatures.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]collectsignatures.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\certificates_r.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]certificates_r.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\appcenter_r.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]appcenter_r.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]ace.dll.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]a3dutils.dll.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\viewer.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\[supportc1@elude.in][id=25a1cae3]viewer.aapp.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportc1@elude.in][id=25a1cae3]cef.pak.notfound
from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\[supportc1@elude.in][id=25a1cae3]a2start.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportc1@elude.in][id=25a1cae3]cef_100_percent.pak.notfound
from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\[supportc1@elude.in][id=25a1cae3]a2service.exe.notfound
from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\[supportc1@elude.in][id=25a1cae3]a2scan.exe.notfound
from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\[supportc1@elude.in][id=25a1cae3]a2hijackfree.exe.notfound
from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\[supportc1@elude.in][id=25a1cae3]a2guard.exe.notfound
from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\[supportc1@elude.in][id=25a1cae3]a2cmd.exe.notfound
from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\[supportc1@elude.in][id=25a1cae3]360tray.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]acrord32res.dll.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]acrord32info.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]acrord32.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]acrord32.dll.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\libcef.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportc1@elude.in][id=25a1cae3]libcef.dll.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]acrofx32.dll.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportc1@elude.in][id=25a1cae3]snapshot_blob.bin.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrservicesupdater.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportc1@elude.in][id=25a1cae3]rdrservicesupdater.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportc1@elude.in][id=25a1cae3]rdrcef.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportc1@elude.in][id=25a1cae3]natives_blob.bin.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\locales\en-us.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\locales\[supportc1@elude.in][id=25a1cae3]en-us.pak.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportc1@elude.in][id=25a1cae3]icudtl.dat.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\[supportc1@elude.in][id=25a1cae3]cef_200_percent.pak.notfound
from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\[supportc1@elude.in][id=25a1cae3]a2upd.exe.notfound
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ahclient.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[supportc1@elude.in][id=25a1cae3]ahclient.dll.notfound

Moves itself

from <Full path to file> to <Current directory>\[supportc1@elude.in][id=25a1cae3]<File name>.exe.notfound

Modifies user data files (Trojan.Encoder).

Network activity

TCP

'localhost':49172
'localhost':49194
'localhost':49192
'pa####rdwolf.com':443
'localhost':49190
'localhost':49189
'localhost':49187
'cs##g.net':443
'localhost':49185
'localhost':49184
'localhost':49182
'ra##om.org':443
'localhost':49180
'localhost':49179
'localhost':49177
'pa####rdrandom.com':443
'localhost':49175
'localhost':49174
'localhost':49195
'ap#.##legram.org':443

UDP

DNS ASK pa####rdrandom.com
DNS ASK ra##om.org
DNS ASK cs##g.net
DNS ASK pa####rdwolf.com
DNS ASK ap#.##legram.org

Miscellaneous

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c vol C

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial