Trojan.Encoder.37358

Technical Information

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\sdszfo.docx

Modifies file system

Creates the following files

C:\far2\changelog.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav audio (x64).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\ffdshow vfw interface.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\ffdshow vfw interface (x64).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\directvobsub.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\directvobsub (x64).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\media player classic.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\codec tweak tool.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\visit java.com.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\get help.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\configure java.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\check for updates.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\about java.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\gameexplorer.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\windows powershell modules.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\task scheduler.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\windows firewall with advanced security.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav audio.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav splitter (x64).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\create recovery disc.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\backup and restore center.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\uninstall k-lite codec pack.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\tools\win7dsfiltertweaker.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\tools\mediainfo.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\tools\haali muxer.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\tools\graphstudionext.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\help\frequently asked questions.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\services.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\xvid vfw.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\x264 vfw (x86).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\x264 vfw (x64).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\reset to recommended settings.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav video.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav video (x64).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav splitter.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\system configuration.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\security configuration management.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\documentation.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer reports.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\system information.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\resource monitor.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\disk cleanup.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\dfrgui.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\character map.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\speech recognition.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\wordpad.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\welcome center.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sync center.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sticky notes.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sound recorder.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\snipping tool.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\remote desktop connection.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\paint.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\shapecollector.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\print management.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\computer management.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\data sources (odbc).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\performance monitor.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 wizards.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 configuration.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\memory diagnostics tool.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\iscsi initiator.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\event viewer.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\tools\graphstudionext (x64).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\remote assistance.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\system restore.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise (x86).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell (x86).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\windows journal.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\tabtip.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\component services.lnk.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile21.bmp.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\overview.lnk.edm
%HOMEPATH%\desktop\telegram.lnk.edm
%HOMEPATH%\desktop\qip 2012.lnk.edm
%HOMEPATH%\desktop\mail.ru agent.lnk.edm
%HOMEPATH%\desktop\icq.lnk.edm
C:\users\public\music\sample music\sleep away.mp3.edm
C:\users\public\music\sample music\maid with the flaxen hair.mp3.edm
C:\users\public\music\sample music\kalimba.mp3.edm
C:\users\public\desktop\winamp.lnk.edm
C:\users\public\desktop\steam.lnk.edm
C:\users\public\desktop\opera.lnk.edm
C:\users\public\desktop\mozilla thunderbird.lnk.edm
C:\users\public\desktop\mozilla firefox.lnk.edm
C:\users\public\desktop\mirc.lnk.edm
C:\users\public\desktop\google chrome.lnk.edm
C:\users\public\desktop\acrobat reader dc.lnk.edm
%HOMEPATH%\desktop\total commander 64 bit.lnk.edm
%HOMEPATH%\favorites\links\web slice gallery.url.edm
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.edm
%HOMEPATH%\favorites\links for united states\usa.gov.url.edm
%HOMEPATH%\links\desktop.lnk.edm
%HOMEPATH%\favorites\windows live\windows live spaces.url.edm
%HOMEPATH%\favorites\windows live\windows live mail.url.edm
%HOMEPATH%\favorites\windows live\windows live gallery.url.edm
%HOMEPATH%\favorites\windows live\get windows live.url.edm
%HOMEPATH%\favorites\msn websites\msnbc news.url.edm
%HOMEPATH%\favorites\msn websites\msn.url.edm
%ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\networkprojection.lnk.edm
%HOMEPATH%\favorites\msn websites\msn entertainment.url.edm
%HOMEPATH%\favorites\msn websites\msn autos.url.edm
%HOMEPATH%\favorites\microsoft websites\microsoft store.url.edm
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url.edm
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url.edm
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.edm
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url.edm
%HOMEPATH%\favorites\msn websites\msn money.url.edm
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\task scheduler.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5cc2.tmp.werinternalmetadata.xml.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winamp\what's new.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 upload center.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 language preferences.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft clip organizer.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\digital certificate for vba projects.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft word 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft sharepoint workspace 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft publisher 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft powerpoint 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft outlook 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft onenote 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft infopath filler 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft infopath designer 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft excel 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft access 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\ircintro help.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\mirc help.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\mirc.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\readme.txt.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txt.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winamp\winamp.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winamp\winamp (safe mode).lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\dmi8538.tmp.log.xml.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\tools.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\steam.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\steam support center.url.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\microsoft sharepoint workspace 2010.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\uninstall qip 2012.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\qip 2012.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\qip 2012 on the web.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\versions.txt.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winamp\uninstall winamp.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office picture manager.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\mobility center.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\math input panel.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\displayswitch.lnk.edm
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml.edm
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml.edm
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml.edm
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml.edm
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml.edm
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.edm
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.edm
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.edm
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.edm
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml.edm
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.edm
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.xml.edm
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\setup.xml.edm
%ALLUSERSPROFILE%\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.edm
C:\totalcmd\size!.txt.edm
C:\totalcmd\keyboard.txt.edm
C:\totalcmd\history.txt.edm
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml.edm
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.xml.edm
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.edm
C:\far2\plugins\ftp\ftpcmds.txt.edm
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml.edm
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml.edm
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml.edm
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml.edm
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml.edm
%HOMEPATH%\links\downloads.lnk.edm
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.edm
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.edm
C:\far2\documentation\rus\techinfo.txt.edm
C:\far2\documentation\rus\plugins_review.txt.edm
C:\far2\documentation\rus\plugins_install.txt.edm
C:\far2\documentation\rus\far_faq.txt.edm
C:\far2\documentation\rus\bug_report.txt.edm
C:\far2\documentation\rus\arc_support.txt.edm
C:\far2\documentation\eng\techinfo.txt.edm
C:\far2\documentation\eng\plugins_review.txt.edm
C:\far2\documentation\eng\plugins_install.txt.edm
C:\far2\documentation\eng\far_faq.txt.edm
C:\far2\documentation\eng\bug_report.txt.edm
C:\far2\documentation\eng\arc_support.txt.edm
C:\far2\addons\readme.txt.edm
C:\far2\changelog_eng.edm
C:\far2\plugins\align\changelog.edm
C:\far2\plugins\arclite\changelog.edm
C:\far2\fexcept\changelog.edm
C:\far2\plugins\autowrap\changelog.edm
C:\far2\plugins\tmppanel\changelog.edm
C:\far2\plugins\brackets\changelog.edm
C:\far2\plugins\proclist\changelog.edm
C:\far2\plugins\network\changelog.edm
C:\far2\plugins\macroview\changelog.edm
C:\far2\plugins\hlfviewer\changelog.edm
C:\far2\plugins\ftp\notes_rus.txt.edm
C:\far2\plugins\ftp\notes.txt.edm
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.edm
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.edm
C:\far2\plugins\ftp\changelog.edm
C:\far2\plugins\filecase\changelog.edm
C:\far2\plugins\farcmds\changelog.edm
C:\far2\plugins\emenu\changelog.edm
C:\far2\plugins\editcase\changelog.edm
C:\far2\plugins\drawline\changelog.edm
C:\far2\plugins\compare\changelog.edm
C:\far2\plugins\ftp\ftpcmds_rus.txt.edm
%HOMEPATH%\favorites\msn websites\msn sports.url.edm
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.edm
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.edm
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 05.wma.edm
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 04.wma.edm
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 03.wma.edm
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 02.wma.edm
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 01.wma.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile44.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile43.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile42.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile41.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile40.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile39.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile38.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile37.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile36.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile35.bmp.edm
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 06.wma.edm
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 07.wma.edm
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 08.wma.edm
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 09.wma.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile33.bmp.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\calculator.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\xps viewer.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows media player.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows fax and scan.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows dvd maker.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sidebar.lnk.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile34.bmp.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pidgin.lnk.edm
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla firefox.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\media center.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\acrobat reader dc.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\windows update.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\default programs.lnk.edm
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 10.wma.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\opera.lnk.edm
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.edm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla thunderbird.lnk.edm
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile10.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.edm
%ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xml.edm
%ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xml.edm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\resource.xml.edm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.edm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\resource.xml.edm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.edm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.edm
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.edm
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.edm
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.edm
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.edm
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile11.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile12.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile13.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile14.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile31.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile29.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile28.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile27.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile26.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile25.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile24.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile32.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile23.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile30.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile20.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile19.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile18.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile17.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile16.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile15.bmp.edm
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile22.bmp.edm
%HOMEPATH%\links\recentplaces.lnk.edm

Modifies the following files

C:\far2\changelog
C:\far2\plugins\ftp\ftpcmds.txt
C:\far2\plugins\ftp\changelog
C:\far2\plugins\filecase\changelog
C:\far2\plugins\farcmds\changelog
C:\far2\plugins\emenu\changelog
C:\far2\plugins\editcase\changelog
C:\far2\plugins\drawline\changelog
C:\far2\plugins\compare\changelog
C:\far2\plugins\brackets\changelog
C:\far2\plugins\autowrap\changelog
C:\far2\plugins\arclite\changelog
C:\far2\plugins\align\changelog
C:\far2\fexcept\changelog
C:\far2\documentation\rus\techinfo.txt
C:\far2\documentation\rus\plugins_review.txt
C:\far2\documentation\rus\plugins_install.txt
C:\far2\documentation\rus\far_faq.txt
C:\far2\documentation\rus\bug_report.txt
C:\far2\documentation\rus\arc_support.txt
C:\far2\documentation\eng\techinfo.txt
C:\far2\documentation\eng\plugins_review.txt
C:\far2\documentation\eng\plugins_install.txt
C:\far2\documentation\eng\far_faq.txt
C:\far2\documentation\eng\bug_report.txt
C:\far2\documentation\eng\arc_support.txt
C:\far2\addons\readme.txt
C:\far2\changelog_eng
C:\far2\plugins\ftp\ftpcmds_rus.txt
C:\far2\plugins\ftp\notes.txt

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial