Trojan.Encoder.33514

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Creates the following files on removable media

<Drive name for removable media>:\default.bmp.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\000814251_video_01.avi.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\join.avi.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\508softwareandos.doc.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\adhd_and_obesity.docx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\scan.mov.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\dualectls.pdf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\10thingscondoms.pdf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\middaugh_keynote.pptx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\winmine.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\military_callsigns_0311.rtf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\highly_cited_2001.xlsx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\applicant.xlsx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\archer.avi.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\ituneshelpunavailable.html.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\trivial-merge.html.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\region-north-karelia.jpeg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\13.jpeg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\1189.jpg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\correct.avi.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\split.avi.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\howto-index.html.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\tree_view.html.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\adadsi.html.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\toolbar.bmp.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\tileimage.bmp.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\sdksampleunprivdeveloper.cer.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\contoso_1.cer.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\pmd.cer.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\hanni_umami_chapter.doc.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\applicantform_en.doc.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\holycrosschurchinstructions.docx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\3.jpg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\flower_trans_matte.wmv.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\sdszfo.docx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\alert.htm.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\advice_process.htm.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\browse.htm.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\garden.htm.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\trivial-merge.htm.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\about.htm.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\browse.html.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\about.html.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\dashborder_96.bmp.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\notepad.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
<Drive name for removable media>:\parnas_01.jpg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

Executes the following

'%WINDIR%\syswow64\net.exe' stop MSDTC
'%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT
'%WINDIR%\syswow64\net.exe' stop MSSQLSERVER
'%WINDIR%\syswow64\net.exe' stop vds
'%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
'%WINDIR%\syswow64\net.exe' stop SQLWriter
'%WINDIR%\syswow64\net.exe' stop SQLBrowser
'%WINDIR%\syswow64\net.exe' stop MSSQL$CONTOSO1

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\<File name>.exe
%CommonProgramFiles%\microsoft shared\office14\fltldr.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\ftprus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\java\jre1.8.0_45\bin\javaws.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\ftpeng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\acetxt.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\ftpeng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\ftpcmds_rus.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\grphflt\wpgimp32.flt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\media\cagcat10\cagcat10.mmw.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\ftpcmds.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\filecase\filecase.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\equation\eqnedt32.hlp.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\filecase\filecase.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\vsto\10.0\vstoloader.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\vba\vba7\1033\vbui6.chm.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\vba\vba7\1033\fm20.chm.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\smart tag\mofl.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\grphflt\jpegim32.flt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\proof\mswds_es.lex.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\proof\mswds_en.lex.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansdemibold.ttf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\liclua.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\document themes 14\theme effects\hardcover.eftx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\osetupui.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\document themes 14\theme effects\elemental.eftx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\document themes 14\hardcover.thmx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\lib\ftpdirlist.fll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\document themes 14\elemental.thmx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\far.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\techinfo_rus.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\ftprus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\1033\alrtintl.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\techinfo.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\1033\aceintl.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\notes_rus.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\oarpmany.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\notes.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft analysis services\as oledb\10\msolui100.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\editcase\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
D:\install.log.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\filecase\caserus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\farcmds\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\hotkeyproperties.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\hotkeyclipboard.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\hotkey.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\emenurus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\emenurus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\emenueng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\emenueng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\aceexch.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\emenudel.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\emenu.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\editcase\editcase.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\editcase\editcase.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\farftp.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\editcase\ecaserus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\editcase\ecaserus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\editcase\ecaseeng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\emenu\emenu.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\acewss.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\aceodbc.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\farcmds\farcmdseng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\farcmds\farcmds.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\msclientdatamgr\mscdm.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\help\msitss55.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\grphflt\png32.flt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\grphflt\gifimp32.flt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.flt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\osetupui.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\filecase\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\farcmds\farcmdseng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\ose.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\farcmds\farcmds.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\filecase\caseeng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\filecase\caseeng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\farcmds\farcmdsrus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\encyclopedia\tap\code.idb.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\farcmds\farcmdsrus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\farrus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\filecase\caserus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\editcase\ecaseeng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\media\cagcat10\1033\cagcat10.mml.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\omsxp32.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\smart tag\lists\basmla.xsl.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\hlfviewer\hlfviewerrus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\hlfviewer\hlfviewerrus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\smart tag\ietag.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\hlfviewer\hlfviewereng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\hlfviewer\hlfviewereng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\hlfviewer\hlfviewer.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\hlfviewer\hlfviewer.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\proof\mswds_fr.lex.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\smart tag\fstock.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\lib\progress_zema.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\lib\progress_wesha.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\lib\progress_jm.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\smart tag\fplace.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\lib\progress_farcopy.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\lib\ftpprogress.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\smart tag\fperson.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\lib\ftpprogress.fll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\hlfviewer\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\lib\ftpdirlist.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\macroview\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\macroview\macroview.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\network\netrus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\network\netrus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\network\neteng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\1033\discussion14.gta.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\network\neteng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\translat\wtsp61ms.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\network\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\macroview\macroview.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\source engine\ose.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\macroview\macroeng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\translat\msb1star.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\1033\actip10.hlp.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\translat\msb1core.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\macroview\macrorus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\textconv\wpft632.cnv.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\textconv\wpft532.cnv.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\macroview\macrorus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\macroview\macroeng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\exsec32.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\english.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\media\office14\1033\office10.mml.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\accddslm.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\acer3x.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\aceoledb.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\outlph.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwtrig20.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwdcw20.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\acexbe.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\expsrv.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\cdlmso.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\msproof7.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\msppt.olb.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\msoutl.olb.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\msocfu.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.semitrust.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\microsoft.businessdata.xml.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\mapiph.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\oisgraph.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\css7data0009.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\msoicons.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\java\jre1.8.0_45\bin\ssv.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\spanish.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\wordcnvr.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\media\office14\office10.mmw.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\document themes 14\theme effects\newsprint.eftx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\document themes 14\theme effects\composite.eftx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\document themes 14\composite.thmx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\accddsf.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\pstprx32.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\office setup controller\odeploy.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\java\jre1.8.0_45\bin\javafx_font_t2k.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\java\jre1.8.0_45\bin\glib-lite.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\java\jre1.8.0_45\bin\deploy.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\scnpst64.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\saext.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\proof\mslid.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\branding.xml.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ProgramFiles%\microsoft office\office14\sharepointprovider.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\drawline\drawrus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\drawline\drawrus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\drawline\drawline.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\ctrldel.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\altx.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\altsearch.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\altscreens.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\altmenu.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\vaxcolors.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\rodion_doroshkevich.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\descript.ion.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\nc5pal2.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\hell.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\greenmile.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\farcolors242.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\dn_like.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\descript.ion.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\import_colors.bat.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_lynx_mot.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\black_from_july.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_jumptoselectedfile.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_esc.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_del.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_ctrlshiftpgupdn.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_ctrlshiftbackslash.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_ctrlright.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_ctrlq.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_ctrlleft.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\edit_notepad.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\dialog_altdown.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_apps.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_altbs.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\openinglastfile.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\macroconsts.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\f9table.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\f9deactivatemenu.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\f3.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\edit_savefile.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_bs.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\edit_saveandexit.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_ctrlins__.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\farhun.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\farspa.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\farrus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\farpol.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\farhun.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\farger.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\fareng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\fareng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\restoresettings.cmd.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\farcze.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\clearpluginscache.cmd.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%ALLUSERSPROFILE%\prvkey2.txt.key
%ALLUSERSPROFILE%\prvkey2.txt
%WINDIR%\temp\tara45a.tmp
%WINDIR%\temp\caba459.tmp
%ALLUSERSPROFILE%\pkey.txt
%ALLUSERSPROFILE%\idk.txt
C:\far2\changelog_eng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_mousewheeltilt.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\file_id.diz.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\import_colors.bat.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\hell.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\greenmile.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\farcolors242.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\dn_like.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\descript.ion.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\descript.ion.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\savesettings.cmd.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\black_from_july.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\import_colors.bat.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\export_colors.bat.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\descript.ion.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\readme.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\ctrlf10.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_numpad.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\autowrap\wraprus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\arclite\arclite_eng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\autowrap\wrapeng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\autowrap\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\autowrap\autowrap.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\autowrap\autowrap.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\arclite\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\arclite\arclite_rus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\arclite\arclite_rus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\fexcept\setfarexceptionhandler.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\brackets\brackdel.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\align\align.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\arclite\7zs2con.sfx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\arclite\7zs2.sfx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\align\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\align\alignrus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\align\aligneng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\align\align.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\arclite\7zcon.sfx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\arclite\7zsd.sfx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\arclite\arclite_eng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\brackets\brackeng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\compare\cmprus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\compare\compare.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\drawline\drawline.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\drawline\draweng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\drawline\draweng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\drawline\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\compare\comprus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\compare\compeng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\compare\compare.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\ftp\farftp.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\brackets\brackeng.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\brackets\brackeng.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\compare\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\brackets\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\brackets\brackrus.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\brackets\brackrus.lng.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\brackets\brackrus.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\brackets\brackets.map.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\brackets\brackets.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\compare\cmpeng.hlf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\arclite\7z.sfx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\fexcept\fexcept.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_selectfromclipboard.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\shell\farhere.inf.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\shell\descript.ion.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\setup\windowsgui.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\setup\executor_cmd.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\setup\executor_4nt.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\setup\descript.ion.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\setup\default165.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\xlat\russian\altr.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\wheelscreenswitch.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\view_shiftinssearch.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\view_pgdn.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\view_nextprevfile.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\view_ctrlupdown.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\shifttab.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\shiftf1.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\shiftbs.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\panel_spacetoselect.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\macros\view_space.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\xlat\russian\apps.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\xlat\descript.ion.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\xlat\russian\ctrlr.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\fexcept\excdump.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\rus\bug_report.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\fexcept\demangle32.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\fexcept\changelog.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\encyclopedia\tap\code.bin.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\encyclopedia\tap\12_r0m.tap.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\rus\techinfo.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\rus\plugins_review.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\rus\plugins_install.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\rus\far_faq.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\rus\arc_support.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\xlat\russian\ctrlshiftx.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\eng\techinfo.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\eng\plugins_review.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\eng\plugins_install.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\eng\far_faq.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\eng\bug_report.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\documentation\eng\arc_support.txt.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\xlat\russian\qwerty.reg.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\addons\xlat\russian\descript.ion.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
C:\far2\plugins\network\network.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
%CommonProgramFiles%\microsoft shared\translat\esen\msb1esen.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg

Deletes the following files

%WINDIR%\temp\caba459.tmp
%WINDIR%\temp\tara45a.tmp

Moves the following files

from %ProgramFiles%\java\jre1.8.0_45\bin\awt.dll to %ProgramFiles%\java\jre1.8.0_45\bin\awt.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\accdds.dll to %ProgramFiles%\microsoft office\office14\accdds.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\accicons.exe to %ProgramFiles%\microsoft office\office14\accicons.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\accvdt.dll to %ProgramFiles%\microsoft office\office14\accvdt.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\graph.exe to %ProgramFiles%\microsoft office\office14\graph.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\advcmp.dic to %ProgramFiles%\microsoft office\office14\advcmp.dic.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\excelcnv.exe to %ProgramFiles%\microsoft office\office14\excelcnv.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\document themes 14\theme effects\couture.eftx to %ProgramFiles%\microsoft office\document themes 14\theme effects\couture.eftx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\groove.exe to %ProgramFiles%\microsoft office\office14\groove.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\advzip.dic to %ProgramFiles%\microsoft office\office14\advzip.dic.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\audiosearchmain.dll to %ProgramFiles%\microsoft office\office14\audiosearchmain.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\audiosearchsapife.dll to %ProgramFiles%\microsoft office\office14\audiosearchsapife.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\ipdesign.dll to %ProgramFiles%\microsoft office\office14\ipdesign.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\dbghelp.dll to %ProgramFiles%\microsoft office\office14\dbghelp.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\advtel.dic to %ProgramFiles%\microsoft office\office14\advtel.dic.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\installed_resources14.xss to %ProgramFiles%\microsoft office\office14\installed_resources14.xss.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\excel.exe to %ProgramFiles%\microsoft office\office14\excel.exe.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\document themes 14\couture.thmx to %ProgramFiles%\microsoft office\document themes 14\couture.thmx.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft analysis services\as oledb\10\msolap100.dll to %ProgramFiles%\microsoft analysis services\as oledb\10\msolap100.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\npdeployjava1.dll to %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\npdeployjava1.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar to %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar to %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar to %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\deployjava1.dll to %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\deployjava1.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\bin\jfxwebkit.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jfxwebkit.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\bin\server\jvm.dll to %ProgramFiles%\java\jre1.8.0_45\bin\server\jvm.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft analysis services\as oledb\10\msmdlocal.dll to %ProgramFiles%\microsoft analysis services\as oledb\10\msmdlocal.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft analysis services\as oledb\10\msmgdsrv.dll to %ProgramFiles%\microsoft analysis services\as oledb\10\msmgdsrv.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\emsmdb32.dll to %ProgramFiles%\microsoft office\office14\emsmdb32.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg
from %ProgramFiles%\microsoft office\office14\ipeditor.dll to %ProgramFiles%\microsoft office\office14\ipeditor.dll.[openfileyou@protonmail.com][mj-wb0916743582].snoopdogg

Modifies the following files

C:\far2\clearpluginscache.cmd
C:\far2\addons\colors\custom_highlighting\greenmile.reg
C:\far2\addons\colors\custom_highlighting\farcolors242.reg
C:\far2\addons\colors\custom_highlighting\dn_like.reg
C:\far2\addons\colors\custom_highlighting\descript.ion
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg
C:\far2\addons\colors\custom_highlighting\black_from_july.reg
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
C:\far2\addons\colors\import_colors.bat
C:\far2\addons\colors\export_colors.bat
C:\far2\addons\colors\descript.ion
C:\far2\addons\readme.txt
C:\far2\addons\descript.ion
C:\far2\fareng.hlf
C:\far2\savesettings.cmd
C:\far2\restoresettings.cmd
C:\far2\file_id.diz
C:\far2\farspa.lng
C:\far2\farrus.lng
C:\far2\farpol.lng
C:\far2\farhun.lng
C:\far2\farger.lng
C:\far2\fareng.lng
C:\far2\farcze.lng
C:\far2\changelog_eng
C:\far2\addons\colors\custom_highlighting\hell.reg
C:\far2\addons\colors\custom_highlighting\import_colors.bat

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Network activity

Connects to

'localhost':49174
'localhost':49176
'ap#.#y-ip.io':443
'r3.#.lencr.org':80
'microsoft.com':80
'94.##0.46.250':80

TCP

'localhost':49174
'localhost':49176
'localhost':49177
'ap#.#y-ip.io':443

UDP

DNS ASK ap#.#y-ip.io
DNS ASK r3.#.lencr.org
DNS ASK microsoft.com

Miscellaneous

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c net stop MSDTC
'%WINDIR%\syswow64\net1.exe' stop SQLBrowser
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser
'%WINDIR%\syswow64\net1.exe' stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall set opmode mode=disable
'%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
'%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set currentprofile state off
'%WINDIR%\syswow64\net1.exe' stop vds
'%WINDIR%\syswow64\cmd.exe' /c net stop vds
'%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLSERVER
'%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLSERVERAGENT
'%WINDIR%\syswow64\cmd.exe' /c wbadmin delete catalog -quiet
'%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled no
'%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\net1.exe' stop MSDTC
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$CONTOSO1
'%WINDIR%\syswow64\net1.exe' stop MSSQL$CONTOSO1

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial