Trojan.Encoder.32586

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%APPDATA%\thunderbird\profiles.ini
%APPDATA%\opera software\opera stable\login data
%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Modifies file system

Creates the following files

C:\far2\addons\colors\custom_highlighting\anatova.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\anatova.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\p4p79gg0\anatova.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\anatova.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\high\active\anatova.txt
%LOCALAPPDATA%\microsoft\media player\art cache\localmls\anatova.txt
%LOCALAPPDATA%\microsoft\media player\anatova.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\0005fdc0\anatova.txt
%LOCALAPPDATA%\microsoft\msdn\7.0\anatova.txt
%LOCALAPPDATA%\microsoft\office\onetconfig\anatova.txt
%LOCALAPPDATA%\microsoft\windows\1033\anatova.txt
%LOCALAPPDATA%\microsoft\windows\caches\anatova.txt
%LOCALAPPDATA%\microsoft\windows\explorer\anatova.txt
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012015112320151124\anatova.txt
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012016081820160819\anatova.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\anatova.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\anatova.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\anatova.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\anatova.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportarchive\critical_microsoft .net f_7dc4b618879ba397dd9351c1afdba8f459c4626_065d215a\anatova.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\g32ifqhj\anatova.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_4017a4527469f9d5b499a101a973ca853f881d9_cab_07087280\anatova.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\1ilya49m\anatova.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\sl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\sr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\th\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\tr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\uk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\vi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\zh_cn\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\zh_tw\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_metadata\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\gcm store\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\local storage\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\media cache\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\session storage\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\storage\ext\chrome-signin\def\gpucache\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico.md5
%LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_coobgpohoikkiipiblmjeljniedjpjpf\anatova.txt
%LOCALAPPDATA%\microsoft\dbgclr\7.1\anatova.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\anatova.txt
%LOCALAPPDATA%\microsoft\internet explorer\anatova.txt
%LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\anatova.txt
%APPDATA%\icqm\icq\html\cz\error\anatova.txt
%LOCALAPPDATA%\microsoft\windows mail\anatova.txt
%LOCALAPPDATA%low\sun\java\deployment\anatova.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\anatova.txt
%APPDATA%\adobe\acrobat\dc\jscache\anatova.txt
%APPDATA%\adobe\acrobat\dc\preferences\anatova.txt
%APPDATA%\adobe\acrobat\dc\security\anatova.txt
%APPDATA%\adobe\acrobat\dc\security\crlcache\anatova.txt
%APPDATA%\adobe\acrobat\dc\anatova.txt
%APPDATA%\adobe\logtransport2\anatova.txt
%APPDATA%\ghisler\anatova.txt
%APPDATA%\icq-profile\base\anatova.txt
%APPDATA%\icq-profile\anatova.txt
%APPDATA%\icq-profile\update\anatova.txt
%APPDATA%\icqm\icq\database\anatova.txt
%APPDATA%\icqm\icq\dll\anatova.txt
%APPDATA%\icqm\icq\fonts\anatova.txt
%APPDATA%\icqm\icq\graphics\phone\anatova.txt
%APPDATA%\icqm\icq\html\bg\error\anatova.txt
%APPDATA%\icqm\icq\html\bg\jabber\anatova.txt
%APPDATA%\icqm\icq\html\bg\loading\anatova.txt
%LOCALAPPDATA%low\oracle\java\au\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\sk\anatova.txt
%LOCALAPPDATA%low\adobe\acrobat\dc\anatova.txt
%LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\startupcache\anatova.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\new\anatova.txt
%LOCALAPPDATA%\microsoft\windows mail\stationery\anatova.txt
%LOCALAPPDATA%\microsoft\windows media\12.0\anatova.txt
%LOCALAPPDATA%\microsoft\windows sidebar\anatova.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cache2\entries\anatova.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cache2\anatova.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\anatova.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\offlinecache\anatova.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\safebrowsing\anatova.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\startupcache\anatova.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\thumbnails\anatova.txt
%LOCALAPPDATA%\opera software\opera stable\cache\anatova.txt
%LOCALAPPDATA%\steam\htmlcache\anatova.txt
%TEMP%\anatova.txt
%TEMP%\adobe_admlogs\anatova.txt
%TEMP%\opera installer\anatova.txt
%TEMP%\temp1_fp_13.0.0.182_archive.zip\fp_13.0.0.182_archive\13_0_r0_182\anatova.txt
%TEMP%\webinstaller\qnzuposrqouvfisa\anatova.txt
%LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\cache\anatova.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_43794547328c25fc9cc92c7a8cb363b440ce_06bf297f\anatova.txt
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_43794547328c25fc9cc92c7a8cb363b440ce_cab_07087203\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\se\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\nl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\da\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\de\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\el\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\en\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\en_gb\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\es\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\es_419\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\et\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\fi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\fil\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\fr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\hi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\hr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\hu\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\id\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\it\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\ja\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\ko\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\lt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\cs\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\lv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\ca\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\images\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\pl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\pt_br\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\pt_pt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ro\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ru\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\sv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\th\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\tr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\uk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\vi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\zh_cn\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\zh_tw\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_metadata\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\css\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\html\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\bg\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\da\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\ro\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\pl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\en\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\es\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\fi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\fil\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\fr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\hi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\hr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\hu\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\id\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\it\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\ja\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\ko\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\lt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\lv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\nl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\no\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\pl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\pt_br\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\pt_pt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\el\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\ru\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\de\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\cs\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\pt_br\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\pt_pt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\ro\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\ru\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\sk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\sl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\sr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\sv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\th\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\tr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\uk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\vi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\zh_cn\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\zh_tw\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_metadata\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\ar\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\bg\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\ca\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\_locales\nb\anatova.txt
%APPDATA%\icqm\icq\html\cz\jabber\anatova.txt
%APPDATA%\icqm\icq\html\cz\loading\anatova.txt
%APPDATA%\icqm\icq\html\de\error\anatova.txt
%APPDATA%\microsoft\document building blocks\1033\14\anatova.txt
%APPDATA%\microsoft\mmc\anatova.txt
%APPDATA%\microsoft\msdn\7.0\anatova.txt
%APPDATA%\microsoft\office\anatova.txt
%APPDATA%\microsoft\office\recent\anatova.txt
%APPDATA%\microsoft\protect\anatova.txt
%APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\anatova.txt
%APPDATA%\microsoft\publisher building blocks\anatova.txt
%APPDATA%\microsoft\templates\anatova.txt
%APPDATA%\microsoft\uproof\anatova.txt
%APPDATA%\microsoft\windows\cookies\anatova.txt
%APPDATA%\microsoft\windows\ietldcache\anatova.txt
%APPDATA%\microsoft\windows\libraries\anatova.txt
%APPDATA%\microsoft\windows\privacie\anatova.txt
%APPDATA%\microsoft\windows\recent\automaticdestinations\anatova.txt
%APPDATA%\microsoft\windows\recent\customdestinations\anatova.txt
%APPDATA%\microsoft\windows\sendto\anatova.txt
%APPDATA%\microsoft\windows\themes\anatova.txt
%APPDATA%\mirc\anatova.txt
%APPDATA%\microsoft\dbgclr\7.1\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\cat\anatova.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\anatova.txt
%APPDATA%\mail.ru\agent\mra\video\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\static_png\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\anatova.txt
%APPDATA%\mail.ru\agent\mra\sounds\anatova.txt
%APPDATA%\mail.ru\agent\mra\translation\anatova.txt
%APPDATA%\mail.ru\agent\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\emoji\anatova.txt
%APPDATA%\mirc\scripts\anatova.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\anatova.txt
%APPDATA%\qipguard\anatova.txt
%APPDATA%\telegram desktop\anatova.txt
%APPDATA%\telegram desktop\tdata\anatova.txt
%APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\anatova.txt
%APPDATA%\thunderbird\crash reports\anatova.txt
%APPDATA%\thunderbird\profiles\wjj9aet2.default\anatova.txt
%APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\anatova.txt
%APPDATA%\thunderbird\anatova.txt
D:\anatova.txt
%APPDATA%\winamp\anatova.txt
%HOMEPATH%\contacts\anatova.txt
%HOMEPATH%\desktop\anatova.txt
%HOMEPATH%\favorites\links\anatova.txt
%HOMEPATH%\favorites\links for united states\anatova.txt
%HOMEPATH%\favorites\microsoft websites\anatova.txt
%HOMEPATH%\favorites\msn websites\anatova.txt
%HOMEPATH%\favorites\windows live\anatova.txt
%HOMEPATH%\anatova.txt
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\anatova.txt
%APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\anatova.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\anatova.txt
%APPDATA%\mozilla\firefox\crash reports\anatova.txt
%APPDATA%\opera software\opera stable\local storage\anatova.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\anatova.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\anatova.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\anatova.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\anatova.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\anatova.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\anatova.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\anatova.txt
%APPDATA%\mozilla\firefox\anatova.txt
%APPDATA%\mra\base\anatova.txt
%APPDATA%\mra\anatova.txt
%APPDATA%\mra\update\anatova.txt
%APPDATA%\opera software\opera stable\anatova.txt
%APPDATA%\opera software\opera stable\databases\anatova.txt
%APPDATA%\opera software\opera stable\dictionaries\anatova.txt
%APPDATA%\opera software\opera stable\extension state\anatova.txt
%APPDATA%\opera software\opera stable\jump list icons\anatova.txt
%APPDATA%\opera software\opera stable\jump list iconsold\anatova.txt
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\anatova.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\anatova.txt
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\animated\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\smiles\8march\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\anatova.txt
%APPDATA%\icqm\icq\smiles\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\8march\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\animated\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\cat\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\emoji\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\koloboks\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\set03\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\set04\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\set05\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\set06\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\smiles\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\static_png\anatova.txt
%APPDATA%\icqm\icq\smiles\smiles\valentine\anatova.txt
%APPDATA%\icqm\icq\smiles\statuses\aim\anatova.txt
%APPDATA%\icqm\icq\smiles\statuses\gtalk\anatova.txt
%APPDATA%\icqm\icq\html\uz\loading\anatova.txt
%APPDATA%\icqm\icq\smiles\statuses\icq\anatova.txt
%APPDATA%\icqm\icq\html\uz\jabber\anatova.txt
%APPDATA%\icqm\icq\html\ua\loading\anatova.txt
%APPDATA%\icqm\icq\html\de\jabber\anatova.txt
%APPDATA%\icqm\icq\html\de\loading\anatova.txt
%APPDATA%\icqm\icq\html\en\error\anatova.txt
%APPDATA%\icqm\icq\html\en\jabber\anatova.txt
%APPDATA%\icqm\icq\html\en\loading\anatova.txt
%APPDATA%\icqm\icq\html\kz\error\anatova.txt
%APPDATA%\icqm\icq\html\kz\jabber\anatova.txt
%APPDATA%\icqm\icq\html\kz\loading\anatova.txt
%APPDATA%\icqm\icq\html\pt\error\anatova.txt
%APPDATA%\icqm\icq\html\pt\jabber\anatova.txt
%APPDATA%\icqm\icq\html\pt\loading\anatova.txt
%APPDATA%\icqm\icq\html\ru\error\anatova.txt
%APPDATA%\icqm\icq\html\ru\jabber\anatova.txt
%APPDATA%\icqm\icq\html\ru\loading\anatova.txt
%APPDATA%\icqm\icq\html\tr\error\anatova.txt
%APPDATA%\icqm\icq\html\tr\jabber\anatova.txt
%APPDATA%\icqm\icq\html\tr\loading\anatova.txt
%APPDATA%\icqm\icq\html\ua\error\anatova.txt
%APPDATA%\icqm\icq\html\ua\jabber\anatova.txt
%APPDATA%\icqm\icq\html\uz\error\anatova.txt
%APPDATA%\icqm\icq\smiles\statuses\jabber\anatova.txt
%APPDATA%\icqm\icq\smiles\flash\anatova.txt
%APPDATA%\icqm\icq\smiles\statuses\set01\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\kz\error\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\kz\loading\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\pt\error\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\pt\jabber\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\pt\loading\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\ru\error\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\ru\jabber\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\ru\loading\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\tr\error\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\tr\jabber\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\tr\loading\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\ua\error\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\ua\jabber\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\ua\loading\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\uz\error\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\uz\jabber\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\uz\loading\anatova.txt
%APPDATA%\mail.ru\agent\mra\smiles\flash\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\en\loading\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\en\error\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\kz\jabber\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\en\jabber\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\de\loading\anatova.txt
%APPDATA%\icqm\icq\smiles\statuses\vk\anatova.txt
%APPDATA%\icqm\icq\translation\anatova.txt
%APPDATA%\icqm\icq\video\anatova.txt
%APPDATA%\icqm\anatova.txt
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\kiks.yandex.ru\anatova.txt
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\anatova.txt
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#yastatic.net\anatova.txt
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\anatova.txt
%APPDATA%\mail.ru\agent\mra\database\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\no\anatova.txt
%APPDATA%\mail.ru\agent\mra\fonts\anatova.txt
%APPDATA%\mail.ru\agent\mra\dll\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\bg\error\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\bg\jabber\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\bg\loading\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\cz\error\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\cz\jabber\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\cz\loading\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\de\error\anatova.txt
%APPDATA%\mail.ru\agent\mra\html\de\jabber\anatova.txt
%APPDATA%\icqm\icq\sounds\anatova.txt
%APPDATA%\mail.ru\agent\mra\graphics\phone\anatova.txt
%APPDATA%\winamp\plugins\milkdrop2\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\nl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\fr\anatova.txt
%ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\anatova.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\anatova.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\anatova.txt
%ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\anatova.txt
%ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\anatova.txt
%ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\anatova.txt
%ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\anatova.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\anatova.txt
%ALLUSERSPROFILE%\sun\java\java update\anatova.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\anatova.txt
C:\users\default\anatova.txt
C:\users\public\libraries\anatova.txt
C:\users\public\music\sample music\anatova.txt
C:\users\public\pictures\sample pictures\anatova.txt
C:\users\public\recorded tv\sample media\anatova.txt
C:\users\public\videos\sample videos\anatova.txt
%LOCALAPPDATA%\adobe\acrobat\dc\anatova.txt
%LOCALAPPDATA%\adobe\acrobat\dc\cache\anatova.txt
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\anatova.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\anatova.txt
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\anatova.txt
%ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\anatova.txt
%ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0731c4f1\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_5d5d8b7c1982ab7c66cf747e7b18b39e2441a_cab_073d8027\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows defender\support\anatova.txt
%ALLUSERSPROFILE%\microsoft help\anatova.txt
%ALLUSERSPROFILE%\microsoft toolkit\anatova.txt
%ALLUSERSPROFILE%\mozilla\logs\anatova.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\anatova.txt
%ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\anatova.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\anatova.txt
%ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\anatova.txt
%ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\anatova.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\anatova.txt
%ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\anatova.txt
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\anatova.txt
%ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\anatova.txt
%ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fil\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sv\anatova.txt
%LOCALAPPDATA%\applicationhistory\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hu\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\id\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\it\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ja\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ko\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\lt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\lv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ms\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\nl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\no\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_br\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_pt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ro\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ru\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\he\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fi\anatova.txt
%LOCALAPPDATA%\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\cache\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\databases\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extension state\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ar\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\bg\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ca\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\cs\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\da\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\de\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\el\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\en_gb\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\en_us\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\es\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\es_419\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\et\anatova.txt
%LOCALAPPDATA%\adobe\color\anatova.txt
%LOCALAPPDATA%\adobe\color\profiles\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\anatova.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\anatova.txt
C:\far2\plugins\filecase\anatova.txt
C:\far2\plugins\ftp\anatova.txt
C:\far2\plugins\ftp\lib\anatova.txt
C:\far2\plugins\hlfviewer\anatova.txt
C:\far2\plugins\macroview\anatova.txt
C:\far2\plugins\network\anatova.txt
C:\far2\plugins\proclist\anatova.txt
C:\far2\plugins\tmppanel\anatova.txt
C:\far2\pluginsdk\headers.c\anatova.txt
C:\far2\pluginsdk\headers.pas\anatova.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\anatova.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\anatova.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\anatova.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\anatova.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\anatova.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\anatova.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\anatova.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\anatova.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\anatova.txt
C:\far2\plugins\farcmds\anatova.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\anatova.txt
C:\far2\plugins\emenu\anatova.txt
C:\far2\plugins\drawline\anatova.txt
C:\far2\addons\colors\default_highlighting\anatova.txt
C:\far2\addons\colors\anatova.txt
C:\far2\addons\anatova.txt
C:\far2\addons\macros\anatova.txt
C:\far2\addons\setup\anatova.txt
C:\far2\addons\shell\anatova.txt
C:\far2\addons\xlat\anatova.txt
C:\far2\addons\xlat\russian\anatova.txt
C:\far2\anatova.txt
C:\far2\documentation\eng\anatova.txt
C:\far2\documentation\rus\anatova.txt
C:\far2\encyclopedia\anatova.txt
C:\far2\encyclopedia\tap\anatova.txt
C:\far2\fexcept\anatova.txt
C:\far2\plugins\align\anatova.txt
C:\far2\plugins\arclite\anatova.txt
C:\far2\plugins\autowrap\anatova.txt
C:\far2\plugins\brackets\anatova.txt
C:\far2\plugins\compare\anatova.txt
C:\far2\plugins\editcase\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows\drm\anatova.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\anatova.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\anatova.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\anatova.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\anatova.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\anatova.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\anatova.txt
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\anatova.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\anatova.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\anatova.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\anatova.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\anatova.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\anatova.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\anatova.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows\caches\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\anatova.txt
%ALLUSERSPROFILE%\microsoft\windows\ringtones\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\anatova.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\anatova.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\anatova.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\anatova.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\anatova.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\anatova.txt
C:\totalcmd\anatova.txt
C:\totalcmd\language\anatova.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\anatova.txt
%ALLUSERSPROFILE%\adobe\arm\s\anatova.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\anatova.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\anatova.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\anatova.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\anatova.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\anatova.txt
%ALLUSERSPROFILE%\microsoft\ilscache\anatova.txt
%ALLUSERSPROFILE%\microsoft\mf\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\anatova.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\anatova.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\th\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\tr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\uk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\nl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\no\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\pl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\pt_br\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\pt_pt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ro\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ru\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\sk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\sl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\sr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\sv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\th\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\tr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\uk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\vi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\zh_cn\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\zh_tw\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_metadata\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\lv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\zh_tw\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\lt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ja\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ar\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\bg\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ca\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\cs\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\da\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\de\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\el\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\en\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\es\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\fi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\fil\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\fr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\he\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\hi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\hr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\hu\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\id\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\it\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\_locales\ko\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_metadata\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\ar\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\da\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\de\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\el\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\en_gb\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\en_us\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\es\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\es_419\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\et\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\fi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\lv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\fil\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\he\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\hi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\hu\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\id\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\it\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ja\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ko\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\lt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\cs\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\da\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\ca\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\bg\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ar\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\de\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\el\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\en\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\en_gb\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\en_us\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\es\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\es_419\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\et\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\fi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\fil\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\fr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\he\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\hi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\hr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\hu\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_metadata\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\bg\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\_locales\cs\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ca\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\zh_cn\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\vi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\uk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\it\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ja\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ko\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\lt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\lv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ms\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\nl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\no\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pt_br\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\pt_pt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ro\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ru\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\sv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\th\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\hu\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\tr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\hi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\vi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\zh_cn\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\zh_tw\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_metadata\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ar\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\bg\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\ca\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\cs\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\da\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\de\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\el\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\en_gb\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\en_us\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\es\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\es_419\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\et\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\fil\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\he\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\uk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\id\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\vi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\it\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ko\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\lt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\lv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ms\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\nl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\no\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\pl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\pt_br\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\pt_pt\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ro\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ru\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\sk\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\sl\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\sr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\sv\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\th\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\tr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\id\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\hr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ja\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\hu\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\hi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\zh_cn\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_metadata\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ar\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\bg\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ca\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\cs\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\da\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\de\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\_locales\ms\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\en_gb\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\el\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\es\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\es_419\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\et\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\eu\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\fi\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\fil\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\fr\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\he\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\zh_tw\anatova.txt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\en_us\anatova.txt
%LOCALAPPDATA%\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.1.ver0x0000000000000001.db

Modifies user data files (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet
'<SYSTEM32>\vssvc.exe'
'<SYSTEM32>\svchost.exe' -k swprv

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial