Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\excel\xlstart\r3adm3.txt
- %APPDATA%\microsoft\word\startup\r3adm3.txt
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\508softwareandos.doc
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\thunderbird\profiles.ini
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\about.htm
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- C:\r3adm3.txt
- %APPDATA%\microsoft\network\r3adm3.txt
- %APPDATA%\microsoft\msdn\r3adm3.txt
- %APPDATA%\microsoft\mmc\r3adm3.txt
- %APPDATA%\microsoft\internet explorer\r3adm3.txt
- %APPDATA%\microsoft\excel\r3adm3.txt
- %APPDATA%\microsoft\document building blocks\r3adm3.txt
- %APPDATA%\microsoft\dbgclr\r3adm3.txt
- %APPDATA%\microsoft\crypto\r3adm3.txt
- %APPDATA%\microsoft\credentials\r3adm3.txt
- %APPDATA%\microsoft\addins\r3adm3.txt
- %APPDATA%\mail.ru\agent\r3adm3.txt
- %APPDATA%\macromedia\flash player\r3adm3.txt
- %LOCALAPPDATA%\thunderbird\profiles\r3adm3.txt
- %APPDATA%\identities\{91255d00-95d9-49f5-8e84-7c027f5283b7}\r3adm3.txt
- %APPDATA%\icq-profile\update\r3adm3.txt
- %APPDATA%\icq-profile\base\r3adm3.txt
- %APPDATA%\adobe\logtransport2\r3adm3.txt
- %APPDATA%\adobe\linguistics\r3adm3.txt
- %APPDATA%\adobe\headlights\r3adm3.txt
- %APPDATA%\adobe\flash player\r3adm3.txt
- %APPDATA%\adobe\acrobat\r3adm3.txt
- %LOCALAPPDATA%low\sun\java\r3adm3.txt
- %LOCALAPPDATA%low\oracle\java\r3adm3.txt
- %LOCALAPPDATA%low\microsoft\internet explorer\r3adm3.txt
- %LOCALAPPDATA%low\adobe\linguistics\r3adm3.txt
- %LOCALAPPDATA%low\adobe\acrobat\r3adm3.txt
- %APPDATA%\icqm\icq\r3adm3.txt
- %LOCALAPPDATA%\thunderbird\updates\r3adm3.txt
- %APPDATA%\microsoft\office\r3adm3.txt
- %APPDATA%\opera software\opera stable\r3adm3.txt
- %LOCALAPPDATA%\microsoft\dbgclr\7.1\r3adm3.txt
- %LOCALAPPDATA%\google\chrome\user data\r3adm3.txt
- %LOCALAPPDATA%\cef\user data\widevinecdm\r3adm3.txt
- %LOCALAPPDATA%\cef\user data\dictionaries\r3adm3.txt
- %LOCALAPPDATA%\adobe\color\profiles\r3adm3.txt
- %LOCALAPPDATA%\adobe\acrocef\dc\r3adm3.txt
- %LOCALAPPDATA%\adobe\acrobat\dc\r3adm3.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\r3adm3.txt
- %APPDATA%\winamp\plugins\r3adm3.txt
- %APPDATA%\thunderbird\profiles\r3adm3.txt
- %APPDATA%\thunderbird\crash reports\r3adm3.txt
- %APPDATA%\telegram desktop\tdata\r3adm3.txt
- %APPDATA%\microsoft\proof\r3adm3.txt
- %APPDATA%\microsoft\powerpoint\r3adm3.txt
- %APPDATA%\mra\update\r3adm3.txt
- %APPDATA%\mra\base\r3adm3.txt
- %APPDATA%\mozilla\firefox\r3adm3.txt
- %APPDATA%\mozilla\extensions\r3adm3.txt
- %APPDATA%\mirc\scripts\r3adm3.txt
- %APPDATA%\microsoft\word\r3adm3.txt
- %APPDATA%\microsoft\uproof\r3adm3.txt
- %APPDATA%\microsoft\systemcertificates\r3adm3.txt
- %APPDATA%\microsoft\speech\r3adm3.txt
- %APPDATA%\microsoft\publisher building blocks\r3adm3.txt
- %APPDATA%\microsoft\publisher\r3adm3.txt
- %APPDATA%\microsoft\protect\r3adm3.txt
- %APPDATA%\qip\profiles\r3adm3.txt
- %LOCALAPPDATA%\microsoft\feeds\feeds for united states~\r3adm3.txt
- %LOCALAPPDATA%\microsoft\device metadata\dmrccache\r3adm3.txt
- %LOCALAPPDATA%\opera software\opera stable\r3adm3.txt
- %APPDATA%\adobe\r3adm3.txt
- %APPDATA%\mra\r3adm3.txt
- %APPDATA%\mozilla\r3adm3.txt
- %APPDATA%\mirc\r3adm3.txt
- %APPDATA%\microsoft\r3adm3.txt
- %APPDATA%\media center programs\r3adm3.txt
- %APPDATA%\mail.ru\r3adm3.txt
- %APPDATA%\macromedia\r3adm3.txt
- %APPDATA%\identities\r3adm3.txt
- %APPDATA%\icqm\r3adm3.txt
- %APPDATA%\icq-profile\r3adm3.txt
- %APPDATA%\ghisler\r3adm3.txt
- %APPDATA%\opera software\r3adm3.txt
- %APPDATA%\qip\r3adm3.txt
- %LOCALAPPDATA%\programs\common\r3adm3.txt
- %LOCALAPPDATA%low\microsoft\r3adm3.txt
- %LOCALAPPDATA%low\adobe\r3adm3.txt
- %LOCALAPPDATA%\virtualstore\r3adm3.txt
- %LOCALAPPDATA%\thunderbird\r3adm3.txt
- %LOCALAPPDATA%\steam\r3adm3.txt
- %LOCALAPPDATA%\programs\r3adm3.txt
- %LOCALAPPDATA%\opera software\r3adm3.txt
- %LOCALAPPDATA%\mozilla\r3adm3.txt
- %LOCALAPPDATA%\microsoft help\r3adm3.txt
- %LOCALAPPDATA%\microsoft\r3adm3.txt
- %LOCALAPPDATA%\google\r3adm3.txt
- %LOCALAPPDATA%low\oracle\r3adm3.txt
- %LOCALAPPDATA%\steam\htmlcache\r3adm3.txt
- %APPDATA%\qipguard\r3adm3.txt
- %LOCALAPPDATA%\microsoft\credentials\r3adm3.txt
- %LOCALAPPDATA%\microsoft\dbgclr\r3adm3.txt
- %LOCALAPPDATA%\mozilla\firefox\r3adm3.txt
- %LOCALAPPDATA%\microsoft\taskschedulerconfig\r3adm3.txt
- %LOCALAPPDATA%\microsoft\publisher\r3adm3.txt
- %LOCALAPPDATA%\microsoft\office\r3adm3.txt
- %LOCALAPPDATA%\microsoft\msdn\r3adm3.txt
- %LOCALAPPDATA%\microsoft\media player\r3adm3.txt
- %LOCALAPPDATA%\microsoft\internet explorer\r3adm3.txt
- %LOCALAPPDATA%\microsoft\feeds cache\r3adm3.txt
- %LOCALAPPDATA%\microsoft\feeds\r3adm3.txt
- %LOCALAPPDATA%\microsoft\event viewer\r3adm3.txt
- %LOCALAPPDATA%\microsoft\device metadata\r3adm3.txt
- %LOCALAPPDATA%\mozilla\updates\r3adm3.txt
- %APPDATA%\telegram desktop\r3adm3.txt
- %APPDATA%\thunderbird\r3adm3.txt
- %LOCALAPPDATA%\google\chrome\r3adm3.txt
- %LOCALAPPDATA%\cef\user data\r3adm3.txt
- %LOCALAPPDATA%\adobe\color\r3adm3.txt
- %LOCALAPPDATA%\adobe\acrocef\r3adm3.txt
- %LOCALAPPDATA%\adobe\acrobat\r3adm3.txt
- C:\users\default\appdata\roaming\microsoft\internet explorer\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\r3adm3.txt
- %APPDATA%\winamp\r3adm3.txt
- %LOCALAPPDATA%\google\crashreports\r3adm3.txt
- C:\users\default\downloads\r3adm3.txt
- %LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\r3adm3.txt
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\r3adm3.txt
- %LOCALAPPDATA%\google\chrome\user data\caps\r3adm3.txt
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\p4p79gg0\r3adm3.txt
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\g32ifqhj\r3adm3.txt
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\1ilya49m\r3adm3.txt
- %LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\r3adm3.txt
- %LOCALAPPDATA%\microsoft\device metadata\dmrccache\downloads\r3adm3.txt
- %LOCALAPPDATA%\google\chrome\user data\widevinecdm\r3adm3.txt
- %LOCALAPPDATA%\google\chrome\user data\swiftshader\r3adm3.txt
- %LOCALAPPDATA%\google\chrome\user data\pnacl\r3adm3.txt
- %LOCALAPPDATA%\google\chrome\user data\pepperflash\r3adm3.txt
- %LOCALAPPDATA%\google\chrome\user data\evwhitelist\r3adm3.txt
- %LOCALAPPDATA%\google\chrome\user data\default\r3adm3.txt
- %LOCALAPPDATA%\microsoft\media player\art cache\localmls\r3adm3.txt
- %LOCALAPPDATA%\microsoft\internet explorer\recovery\high\r3adm3.txt
- %APPDATA%\opera software\opera stable\jump list icons\r3adm3.txt
- %LOCALAPPDATA%\adobe\acrobat\dc\cache\r3adm3.txt
- %APPDATA%\winamp\plugins\ml\r3adm3.txt
- %APPDATA%\winamp\plugins\milkdrop2\r3adm3.txt
- %APPDATA%\thunderbird\profiles\wjj9aet2.default\r3adm3.txt
- %APPDATA%\telegram desktop\tdata\dumps\r3adm3.txt
- %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\r3adm3.txt
- %APPDATA%\qip\profiles\logs\r3adm3.txt
- %APPDATA%\opera software\opera stable\sync extension settings\r3adm3.txt
- %APPDATA%\opera software\opera stable\storage\r3adm3.txt
- %APPDATA%\opera software\opera stable\local storage\r3adm3.txt
- %APPDATA%\opera software\opera stable\jump list iconsold\r3adm3.txt
- %LOCALAPPDATA%\adobe\acrobat\dc\toolssearchcacherdr\r3adm3.txt
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\r3adm3.txt
- %LOCALAPPDATA%\microsoft\office\groove\system\r3adm3.txt
- %APPDATA%\opera software\opera stable\extension state\r3adm3.txt
- %APPDATA%\icqm\icq\html\ru\r3adm3.txt
- %APPDATA%\icqm\icq\html\pt\r3adm3.txt
- %APPDATA%\icqm\icq\html\kz\r3adm3.txt
- %APPDATA%\icqm\icq\html\en\r3adm3.txt
- %APPDATA%\icqm\icq\html\de\r3adm3.txt
- %APPDATA%\icqm\icq\html\cz\r3adm3.txt
- %APPDATA%\icqm\icq\html\bg\r3adm3.txt
- %APPDATA%\icqm\icq\graphics\phone\r3adm3.txt
- %APPDATA%\adobe\flash player\assetcache\reehzff2\r3adm3.txt
- %APPDATA%\adobe\acrobat\dc\security\r3adm3.txt
- %APPDATA%\adobe\acrobat\dc\preferences\r3adm3.txt
- %LOCALAPPDATA%\microsoft\media player\sync playlists\en-us\r3adm3.txt
- %APPDATA%\icqm\icq\html\tr\r3adm3.txt
- %APPDATA%\adobe\acrobat\dc\jscache\r3adm3.txt
- %LOCALAPPDATA%low\sun\java\deployment\security\r3adm3.txt
- %LOCALAPPDATA%low\sun\java\deployment\cache\r3adm3.txt
- %LOCALAPPDATA%low\adobe\linguistics\userdictionaries\adobe custom dictionary\r3adm3.txt
- %LOCALAPPDATA%low\adobe\acrobat\dc\search\r3adm3.txt
- %LOCALAPPDATA%low\adobe\acrobat\dc\assets\r3adm3.txt
- %LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\startupcache\r3adm3.txt
- %LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\cache2\r3adm3.txt
- %LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\cache\r3adm3.txt
- %LOCALAPPDATA%\mozilla\updates\e7cf176e110c211b\updates\r3adm3.txt
- %LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\r3adm3.txt
- %LOCALAPPDATA%\microsoft\office\groove\user\r3adm3.txt
- %APPDATA%\adobe\acrobat\dc\forms\r3adm3.txt
- %APPDATA%\adobe\acrobat\dc\collab\r3adm3.txt
- %APPDATA%\opera software\opera stable\dictionaries\r3adm3.txt
- %APPDATA%\opera software\opera stable\databases\r3adm3.txt
- %APPDATA%\adobe\flash player\assetcache\r3adm3.txt
- %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\r3adm3.txt
- %LOCALAPPDATA%low\sun\java\deployment\r3adm3.txt
- %LOCALAPPDATA%low\oracle\java\au\r3adm3.txt
- %LOCALAPPDATA%low\microsoft\internet explorer\services\r3adm3.txt
- %LOCALAPPDATA%low\adobe\linguistics\userdictionaries\r3adm3.txt
- %LOCALAPPDATA%low\adobe\acrobat\dc\r3adm3.txt
- %LOCALAPPDATA%\thunderbird\updates\8216c80c92c4e828\r3adm3.txt
- %LOCALAPPDATA%\thunderbird\profiles\wjj9aet2.default\r3adm3.txt
- %LOCALAPPDATA%\opera software\opera stable\cache\r3adm3.txt
- %LOCALAPPDATA%\mozilla\updates\e7cf176e110c211b\r3adm3.txt
- %APPDATA%\adobe\flash player\nativecache\r3adm3.txt
- %LOCALAPPDATA%\mozilla\firefox\profiles\r3adm3.txt
- %LOCALAPPDATA%\microsoft\office\groove\r3adm3.txt
- %LOCALAPPDATA%\microsoft\office\14.0\r3adm3.txt
- %LOCALAPPDATA%\microsoft\msdn\7.0\r3adm3.txt
- %LOCALAPPDATA%\microsoft\media player\transcoded files cache\r3adm3.txt
- %LOCALAPPDATA%\microsoft\media player\sync playlists\r3adm3.txt
- %LOCALAPPDATA%\microsoft\media player\art cache\r3adm3.txt
- %LOCALAPPDATA%\microsoft\internet explorer\recovery\r3adm3.txt
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\r3adm3.txt
- %LOCALAPPDATA%\microsoft\feeds cache\evw7z7yu\r3adm3.txt
- %LOCALAPPDATA%\microsoft\feeds cache\e6k79x6b\r3adm3.txt
- %LOCALAPPDATA%\microsoft\feeds cache\dp0qcmsh\r3adm3.txt
- %LOCALAPPDATA%\microsoft\feeds cache\3v2zgiw9\r3adm3.txt
- %LOCALAPPDATA%\microsoft\office\onetconfig\r3adm3.txt
- %APPDATA%\adobe\logtransport2\logs\r3adm3.txt
- %APPDATA%\icq-profile\update\splash_banner\r3adm3.txt
- %APPDATA%\adobe\acrobat\dc\r3adm3.txt
- %APPDATA%\icqm\icq\database\r3adm3.txt
- %APPDATA%\mozilla\firefox\profiles\r3adm3.txt
- %APPDATA%\mail.ru\agent\mra\r3adm3.txt
- %APPDATA%\mozilla\firefox\crash reports\r3adm3.txt
- %APPDATA%\microsoft\systemcertificates\request\r3adm3.txt
- %APPDATA%\microsoft\systemcertificates\my\r3adm3.txt
- %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\r3adm3.txt
- %APPDATA%\microsoft\office\recent\r3adm3.txt
- %APPDATA%\microsoft\network\connections\r3adm3.txt
- %APPDATA%\microsoft\msdn\7.0\r3adm3.txt
- %APPDATA%\microsoft\internet explorer\quick launch\r3adm3.txt
- %APPDATA%\microsoft\document building blocks\1033\r3adm3.txt
- %APPDATA%\microsoft\dbgclr\7.1\r3adm3.txt
- %APPDATA%\microsoft\crypto\rsa\r3adm3.txt
- %APPDATA%\microsoft\crypto\keys\r3adm3.txt
- %APPDATA%\macromedia\flash player\macromedia.com\r3adm3.txt
- %APPDATA%\mra\update\splash_banner\r3adm3.txt
- %APPDATA%\macromedia\flash player\#sharedobjects\r3adm3.txt
- %APPDATA%\icqm\icq\video\r3adm3.txt
- %APPDATA%\icqm\icq\translation\r3adm3.txt
- %APPDATA%\icqm\icq\sounds\r3adm3.txt
- %APPDATA%\icqm\icq\smiles\r3adm3.txt
- %APPDATA%\icqm\icq\skin_cache\r3adm3.txt
- %APPDATA%\icqm\icq\skin\r3adm3.txt
- %APPDATA%\icqm\icq\html\r3adm3.txt
- %APPDATA%\icqm\icq\graphics\r3adm3.txt
- %APPDATA%\icqm\icq\fonts\r3adm3.txt
- %APPDATA%\icqm\icq\dll\r3adm3.txt
- %LOCALAPPDATA%\cef\r3adm3.txt
- %LOCALAPPDATA%low\sun\r3adm3.txt
- %LOCALAPPDATA%\applicationhistory\r3adm3.txt
- %LOCALAPPDATA%\adobe\r3adm3.txt
- C:\users\default\appdata\roaming\microsoft\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\drm\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\office\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\network\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\netframework\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\mf\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\media player\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\ilscache\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\identitycrl\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\event viewer\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\ehome\r3adm3.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\search\r3adm3.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\dbgclr\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\crypto\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\assistance\r3adm3.txt
- %ALLUSERSPROFILE%\adobe\setup\r3adm3.txt
- %ALLUSERSPROFILE%\adobe\arm\r3adm3.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\r3adm3.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\r3adm3.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\r3adm3.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\r3adm3.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\r3adm3.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\device stage\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\devicesync\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\r3adm3.txt
- %ALLUSERSPROFILE%\sun\java\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\r3adm3.txt
- C:\users\default\appdata\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\vault\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\wpd\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\r3adm3.txt
- %ALLUSERSPROFILE%\oracle\java\r3adm3.txt
- %ALLUSERSPROFILE%\mozilla\logs\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\wwansvc\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\r3adm3.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\r3adm3.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\r3adm3.txt
- C:\users\default\desktop\r3adm3.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\r3adm3.txt
- %ALLUSERSPROFILE%\sun\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\r3adm3.txt
- %ALLUSERSPROFILE%\oracle\r3adm3.txt
- %ALLUSERSPROFILE%\mozilla\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft toolkit\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft help\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\r3adm3.txt
- %ALLUSERSPROFILE%\adobe\r3adm3.txt
- C:\perflogs\admin\r3adm3.txt
- C:\msocache\all users\r3adm3.txt
- C:\users\default\r3adm3.txt
- C:\far2\pluginsdk\r3adm3.txt
- C:\far2\fexcept\r3adm3.txt
- C:\far2\encyclopedia\r3adm3.txt
- C:\far2\documentation\r3adm3.txt
- C:\far2\addons\r3adm3.txt
- <Current directory>\r3adm3.txt
- C:\users\r3adm3.txt
- C:\totalcmd\r3adm3.txt
- C:\recovery\r3adm3.txt
- %ALLUSERSPROFILE%\r3adm3.txt
- C:\perflogs\r3adm3.txt
- C:\msocache\r3adm3.txt
- C:\far2\r3adm3.txt
- C:\far2\plugins\r3adm3.txt
- C:\users\public\r3adm3.txt
- C:\totalcmd\language\r3adm3.txt
- %HOMEPATH%\r3adm3.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\r3adm3.txt
- C:\far2\plugins\editcase\r3adm3.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\r3adm3.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\r3adm3.txt
- C:\far2\pluginsdk\headers.pas\r3adm3.txt
- C:\far2\pluginsdk\headers.c\r3adm3.txt
- C:\far2\plugins\proclist\r3adm3.txt
- C:\far2\plugins\network\r3adm3.txt
- C:\far2\plugins\macroview\r3adm3.txt
- C:\far2\plugins\hlfviewer\r3adm3.txt
- C:\far2\plugins\ftp\r3adm3.txt
- C:\far2\plugins\filecase\r3adm3.txt
- C:\far2\plugins\farcmds\r3adm3.txt
- C:\far2\plugins\emenu\r3adm3.txt
- C:\far2\plugins\drawline\r3adm3.txt
- C:\far2\addons\colors\r3adm3.txt
- C:\far2\plugins\compare\r3adm3.txt
- C:\far2\plugins\brackets\r3adm3.txt
- C:\far2\plugins\autowrap\r3adm3.txt
- C:\far2\plugins\arclite\r3adm3.txt
- C:\far2\plugins\align\r3adm3.txt
- C:\far2\encyclopedia\tap\r3adm3.txt
- C:\far2\documentation\rus\r3adm3.txt
- C:\far2\documentation\eng\r3adm3.txt
- C:\far2\addons\xlat\r3adm3.txt
- C:\far2\addons\shell\r3adm3.txt
- C:\far2\addons\setup\r3adm3.txt
- C:\far2\addons\macros\r3adm3.txt
- %APPDATA%\icqm\icq\html\ua\r3adm3.txt
- %LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\r3adm3.txt
- C:\users\default\documents\r3adm3.txt
- C:\users\public\recorded tv\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\rac\statedata\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\r3adm3.txt
- %ALLUSERSPROFILE%\adobe\arm\s\10428\r3adm3.txt
- %HOMEPATH%\favorites\msn websites\r3adm3.txt
- %HOMEPATH%\favorites\microsoft websites\r3adm3.txt
- %HOMEPATH%\favorites\links for united states\r3adm3.txt
- %HOMEPATH%\favorites\links\r3adm3.txt
- %APPDATA%\r3adm3.txt
- %LOCALAPPDATA%low\r3adm3.txt
- %LOCALAPPDATA%\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\r3adm3.txt
- C:\users\public\videos\sample videos\r3adm3.txt
- C:\users\public\pictures\sample pictures\r3adm3.txt
- C:\users\public\music\sample music\r3adm3.txt
- C:\users\default\appdata\roaming\r3adm3.txt
- C:\users\default\appdata\local\r3adm3.txt
- %ALLUSERSPROFILE%\sun\java\java update\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\r3adm3.txt
- %ALLUSERSPROFILE%\oracle\java\javapath\r3adm3.txt
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\r3adm3.txt
- C:\users\public\recorded tv\sample media\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\rac\r3adm3.txt
- C:\users\default\appdata\roaming\media center programs\r3adm3.txt
- C:\users\default\appdata\local\microsoft\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\r3adm3.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\search\data\applications\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\event viewer\views\applicationviewsrootnode\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\search\data\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\rac\publisheddata\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\rac\outbound\r3adm3.txt
- C:\users\public\videos\r3adm3.txt
- %HOMEPATH%\searches\r3adm3.txt
- %HOMEPATH%\saved games\r3adm3.txt
- %HOMEPATH%\pictures\r3adm3.txt
- %HOMEPATH%\music\r3adm3.txt
- %HOMEPATH%\links\r3adm3.txt
- %HOMEPATH%\favorites\r3adm3.txt
- %HOMEPATH%\downloads\r3adm3.txt
- %HOMEPATH%\documents\r3adm3.txt
- %HOMEPATH%\desktop\r3adm3.txt
- %HOMEPATH%\contacts\r3adm3.txt
- %HOMEPATH%\appdata\r3adm3.txt
- %HOMEPATH%\videos\r3adm3.txt
- %HOMEPATH%\voip\r3adm3.txt
- C:\far2\addons\colors\custom_highlighting\r3adm3.txt
- C:\users\public\music\r3adm3.txt
- C:\users\public\libraries\r3adm3.txt
- C:\users\public\favorites\r3adm3.txt
- C:\users\public\downloads\r3adm3.txt
- C:\users\public\documents\r3adm3.txt
- C:\users\public\desktop\r3adm3.txt
- C:\users\default\videos\r3adm3.txt
- C:\users\default\saved games\r3adm3.txt
- C:\users\default\pictures\r3adm3.txt
- C:\users\default\music\r3adm3.txt
- C:\users\default\links\r3adm3.txt
- C:\users\public\pictures\r3adm3.txt
- C:\far2\addons\colors\default_highlighting\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\r3adm3.txt
- C:\far2\plugins\ftp\lib\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\crypto\keys\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\network\downloader\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\network\connections\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\netframework\breadcrumbstore\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\8.0\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\event viewer\views\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\ehome\logs\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\drm\server\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\device stage\device\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\dbgclr\7.1\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\crypto\dss\r3adm3.txt
- C:\far2\addons\xlat\russian\r3adm3.txt
- %ALLUSERSPROFILE%\microsoft\assistance\client\r3adm3.txt
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\r3adm3.txt
- %ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\r3adm3.txt
- %ALLUSERSPROFILE%\adobe\arm\s\r3adm3.txt
- %ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\r3adm3.txt
- %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\r3adm3.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\r3adm3.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\r3adm3.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\r3adm3.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\r3adm3.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\r3adm3.txt
- C:\users\default\favorites\r3adm3.txt
- %APPDATA%\icqm\icq\html\uz\r3adm3.txt
Moves the following files
- from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\devochka.swf to %APPDATA%\icqm\icq\smiles\flash\devochka.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf to %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\drako_love.swf to %APPDATA%\icqm\icq\smiles\flash\drako_love.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf to %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf to %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf to %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\duh.swf to %APPDATA%\icqm\icq\smiles\flash\duh.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\gangsta.swf to %APPDATA%\icqm\icq\smiles\flash\gangsta.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\guby.swf to %APPDATA%\icqm\icq\smiles\flash\guby.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\information.swf to %APPDATA%\icqm\icq\smiles\flash\information.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\boo.swf to %APPDATA%\icqm\icq\smiles\flash\boo.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\joy.swf to %APPDATA%\icqm\icq\smiles\flash\joy.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\serdze.swf to %APPDATA%\icqm\icq\smiles\flash\serdze.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\chillout.swf to %APPDATA%\icqm\icq\smiles\flash\chillout.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\canthearu.swf to %APPDATA%\icqm\icq\smiles\flash\canthearu.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf to %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf to %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf to %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf to %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\krizis.swf to %APPDATA%\icqm\icq\smiles\flash\krizis.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\laugh.swf to %APPDATA%\icqm\icq\smiles\flash\laugh.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\likeu.swf to %APPDATA%\icqm\icq\smiles\flash\likeu.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\mad dog.swf to %APPDATA%\icqm\icq\smiles\flash\mad dog.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\missyou.swf to %APPDATA%\icqm\icq\smiles\flash\missyou.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\rosy.swf to %APPDATA%\icqm\icq\smiles\flash\rosy.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\kisses.swf to %APPDATA%\icqm\icq\smiles\flash\kisses.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf to %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf.yfsek
- from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf to %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite.yfsek
- from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage.yfsek
- from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage.yfsek
- from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal.yfsek
- from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal.yfsek
- from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\beback.swf to %APPDATA%\icqm\icq\smiles\flash\beback.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\bodun.swf to %APPDATA%\icqm\icq\smiles\flash\bodun.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\beer.swf to %APPDATA%\icqm\icq\smiles\flash\beer.swf.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js to %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite.yfsek
- from %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini.yfsek
- from %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini.yfsek
- from %APPDATA%\adobe\acrobat\dc\jscache\globdata to %APPDATA%\adobe\acrobat\dc\jscache\globdata.yfsek
- from %APPDATA%\adobe\acrobat\dc\jscache\globsettings to %APPDATA%\adobe\acrobat\dc\jscache\globsettings.yfsek
- from %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata to %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\akitaka.swf to %APPDATA%\icqm\icq\smiles\flash\akitaka.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\angel.swf to %APPDATA%\icqm\icq\smiles\flash\angel.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf to %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite.yfsek
- from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\skratch.swf to %APPDATA%\icqm\icq\smiles\flash\skratch.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\sorry.swf to %APPDATA%\icqm\icq\smiles\flash\sorry.swf.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cookies.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cookies.sqlite.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\permissions.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\permissions.sqlite.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\content-prefs.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\content-prefs.sqlite.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\places.sqlite-shm to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\places.sqlite-shm.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\places.sqlite-wal to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\places.sqlite-wal.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json.yfsek
- from %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx to %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json.yfsek
- from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.yfsek
- from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.yfsek
- from %APPDATA%\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl to %APPDATA%\adobe\acrobat\dc\security\crlcache\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.yfsek
- from %APPDATA%\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl to %APPDATA%\adobe\acrobat\dc\security\crlcache\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.yfsek
- from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\current to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\current.yfsek
- from %APPDATA%\icqm\icq\sounds\no_answer.wav to %APPDATA%\icqm\icq\sounds\no_answer.wav.yfsek
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4.yfsek
- from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old.yfsek
- from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\places.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\places.sqlite.yfsek
- from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webappsstore.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webappsstore.sqlite.yfsek
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\sobaka.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\smeh.swf to %APPDATA%\icqm\icq\smiles\flash\smeh.swf.yfsek
- from %APPDATA%\mail.ru\agent\mra\video\video.swf to %APPDATA%\mail.ru\agent\mra\video\video.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\tank.swf to %APPDATA%\icqm\icq\smiles\flash\tank.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf to %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf.yfsek
- from %APPDATA%\icqm\icq\smiles\smiles\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\s008.gif.yfsek
- from %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_en.csv.yfsek
- from %APPDATA%\mail.ru\agent\mra\database\citylist_kz.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_kz.csv.yfsek
- from %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ru.csv.yfsek
- from %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_tr.csv.yfsek
- from %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_ua.csv.yfsek
- from %APPDATA%\mail.ru\agent\mra\database\citylist_uz.csv to %APPDATA%\mail.ru\agent\mra\database\citylist_uz.csv.yfsek
- from %APPDATA%\mail.ru\agent\mra\fonts\segoesc.ttf to %APPDATA%\mail.ru\agent\mra\fonts\segoesc.ttf.yfsek
- from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\83aa4cc77f591dfc2374580bbd95f6ba_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\83aa4cc77f591dfc2374580bbd95f6ba_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf.yfsek
- from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.yfsek
- from %APPDATA%\mail.ru\agent\mra\smiles\skin.txt to %APPDATA%\mail.ru\agent\mra\smiles\skin.txt.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\conference.wav to %APPDATA%\mail.ru\agent\mra\sounds\conference.wav.yfsek
- from %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf to %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\letter.wav to %APPDATA%\mail.ru\agent\mra\sounds\letter.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\error.wav to %APPDATA%\mail.ru\agent\mra\sounds\error.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav to %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\message.wav to %APPDATA%\mail.ru\agent\mra\sounds\message.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav to %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\ring.wav to %APPDATA%\mail.ru\agent\mra\sounds\ring.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav to %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\start.wav to %APPDATA%\mail.ru\agent\mra\sounds\start.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav to %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\auth.wav to %APPDATA%\mail.ru\agent\mra\sounds\auth.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\busy.wav to %APPDATA%\mail.ru\agent\mra\sounds\busy.wav.yfsek
- from %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav.yfsek
- from %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp.yfsek
- from %APPDATA%\opera software\opera stable\cookies to %APPDATA%\opera software\opera stable\cookies.yfsek
- from %APPDATA%\mra\update\languages.hash to %APPDATA%\mra\update\languages.hash.yfsek
- from %APPDATA%\opera software\opera stable\cookies-journal to %APPDATA%\opera software\opera stable\cookies-journal.yfsek
- from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.yfsek
- from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\favicons-journal.yfsek
- from %APPDATA%\opera software\opera stable\favorites.db-journal to %APPDATA%\opera software\opera stable\favorites.db-journal.yfsek
- from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.yfsek
- from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.yfsek
- from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.yfsek
- from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.yfsek
- from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\login data-journal.yfsek
- from %APPDATA%\opera software\opera stable\history provider cache to %APPDATA%\opera software\opera stable\history provider cache.yfsek
- from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.yfsek
- from %APPDATA%\opera software\opera stable\browser.js to %APPDATA%\opera software\opera stable\browser.js.yfsek
- from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.yfsek
- from %APPDATA%\opera software\opera stable\bookmarksextras to %APPDATA%\opera software\opera stable\bookmarksextras.yfsek
- from %APPDATA%\opera software\opera stable\quotamanager to %APPDATA%\opera software\opera stable\quotamanager.yfsek
- from %APPDATA%\opera software\opera stable\quotamanager-journal to %APPDATA%\opera software\opera stable\quotamanager-journal.yfsek
- from %APPDATA%\opera software\opera stable\origin bound certs to %APPDATA%\opera software\opera stable\origin bound certs.yfsek
- from %APPDATA%\opera software\opera stable\session.db-journal to %APPDATA%\opera software\opera stable\session.db-journal.yfsek
- from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\siteprefs.json.yfsek
- from %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967 to %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967.yfsek
- from %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798 to %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798.yfsek
- from %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927 to %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927.yfsek
- from %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881 to %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881.yfsek
- from %APPDATA%\opera software\opera stable\session.dbak to %APPDATA%\opera software\opera stable\session.dbak.yfsek
- from %APPDATA%\opera software\opera stable\thumbnails.db-journal to %APPDATA%\opera software\opera stable\thumbnails.db-journal.yfsek
- from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.yfsek
- from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.yfsek
- from %APPDATA%\opera software\opera stable\origin bound certs-journal to %APPDATA%\opera software\opera stable\origin bound certs-journal.yfsek
- from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.yfsek
- from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.yfsek
- from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.yfsek
- from %APPDATA%\microsoft\mmc\taskschd to %APPDATA%\microsoft\mmc\taskschd.yfsek
- from %APPDATA%\mirc\urls.ini to %APPDATA%\mirc\urls.ini.yfsek
- from %APPDATA%\mirc\servers.ini to %APPDATA%\mirc\servers.ini.yfsek
- from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.yfsek
- from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.yfsek
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.yfsek
- from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.yfsek
- from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\winamp.ini.yfsek
- from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.yfsek
- from %APPDATA%\adobe\logtransport2\logtransport2.cfg to %APPDATA%\adobe\logtransport2\logtransport2.cfg.yfsek
- from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs.yfsek
- from %APPDATA%\icq-profile\base\opt.dbs to %APPDATA%\icq-profile\base\opt.dbs.yfsek
- from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff.yfsek
- from %APPDATA%\icq-profile\update\languages.dict to %APPDATA%\icq-profile\update\languages.dict.yfsek
- from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\bookmarks.bak.yfsek
- from %APPDATA%\opera software\opera stable\web data-journal to %APPDATA%\opera software\opera stable\web data-journal.yfsek
- from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.yfsek
- from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.yfsek
- from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.yfsek
- from %APPDATA%\microsoft\uproof\custom.dic to %APPDATA%\microsoft\uproof\custom.dic.yfsek
- from %APPDATA%\microsoft\uproof\excludedictionaryen0409.lex to %APPDATA%\microsoft\uproof\excludedictionaryen0409.lex.yfsek
- from %APPDATA%\microsoft\uproof\excludedictionaryen0809.lex to %APPDATA%\microsoft\uproof\excludedictionaryen0809.lex.yfsek
- from %APPDATA%\mirc\scripts\popups.ini to %APPDATA%\mirc\scripts\popups.ini.yfsek
- from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.yfsek
- from %APPDATA%\mra\base\mra.dbs to %APPDATA%\mra\base\mra.dbs.yfsek
- from %APPDATA%\mra\base\opt.dbs to %APPDATA%\mra\base\opt.dbs.yfsek
- from %APPDATA%\mirc\scripts\aliases.ini to %APPDATA%\mirc\scripts\aliases.ini.yfsek
- from %APPDATA%\mra\update\languages.aff to %APPDATA%\mra\update\languages.aff.yfsek
- from %APPDATA%\mra\update\languages.dict to %APPDATA%\mra\update\languages.dict.yfsek
- from %APPDATA%\mra\update\ver.txt to %APPDATA%\mra\update\ver.txt.yfsek
- from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash.yfsek
- from %APPDATA%\icq-profile\update\ver.txt to %APPDATA%\icq-profile\update\ver.txt.yfsek
- from %APPDATA%\opera software\opera stable\certificate revocation lists to %APPDATA%\opera software\opera stable\certificate revocation lists.yfsek
- from %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0 to %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\857f1812-3b8b-41fd-99c5-09d06e6d1983 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\857f1812-3b8b-41fd-99c5-09d06e6d1983.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\ae597e89-6b58-4713-b543-846c970a2b49 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\ae597e89-6b58-4713-b543-846c970a2b49.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\24a81978-4594-42c5-80e9-bcd9abebab41 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\24a81978-4594-42c5-80e9-bcd9abebab41.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\b9ed44f4-c00d-45f3-9d18-c556a9a58c43 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\b9ed44f4-c00d-45f3-9d18-c556a9a58c43.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\c7b67a78-937a-4582-b937-2c95a22e1fcf to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\c7b67a78-937a-4582-b937-2c95a22e1fcf.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d524265f-dddf-4bb6-9b50-623f924971ba to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d524265f-dddf-4bb6-9b50-623f924971ba.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\bd5b067d-34b5-40ef-9a93-eff9fd1771a3 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\bd5b067d-34b5-40ef-9a93-eff9fd1771a3.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\preferred to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\preferred.yfsek
- from %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819 to %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\f8401b27-0c7a-4d0f-80a5-9679c6328419 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\f8401b27-0c7a-4d0f-80a5-9679c6328419.yfsek
- from %APPDATA%\opera software\opera stable\databases\databases.db-journal to %APPDATA%\opera software\opera stable\databases\databases.db-journal.yfsek
- from %APPDATA%\opera software\opera stable\extension state\000006.ldb to %APPDATA%\opera software\opera stable\extension state\000006.ldb.yfsek
- from %APPDATA%\opera software\opera stable\extension state\000007.log to %APPDATA%\opera software\opera stable\extension state\000007.log.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\5fea2324-401c-4a67-adf5-81a4571f8b7d to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\5fea2324-401c-4a67-adf5-81a4571f8b7d.yfsek
- from %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\9a5de8c5-f1f1-4a14-bd2a-9a24fc199001 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\9a5de8c5-f1f1-4a14-bd2a-9a24fc199001.yfsek
- from %APPDATA%\opera software\opera stable\extension state\current to %APPDATA%\opera software\opera stable\extension state\current.yfsek
- from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\manifest-000001.yfsek
- from %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp to %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list icons\514d.tmp to %APPDATA%\opera software\opera stable\jump list icons\514d.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list icons\516e.tmp to %APPDATA%\opera software\opera stable\jump list icons\516e.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list icons\529f.tmp to %APPDATA%\opera software\opera stable\jump list icons\529f.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list icons\524f.tmp to %APPDATA%\opera software\opera stable\jump list icons\524f.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp.yfsek
- from %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp.yfsek
- from %APPDATA%\opera software\opera stable\extension state\000003.ldb to %APPDATA%\opera software\opera stable\extension state\000003.ldb.yfsek
- from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\log.yfsek
- from %APPDATA%\opera software\opera stable\extension state\log.old to %APPDATA%\opera software\opera stable\extension state\log.old.yfsek
- from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\2365fd05-48cb-42f9-a388-5fd82ffd2512 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\2365fd05-48cb-42f9-a388-5fd82ffd2512.yfsek
- from %APPDATA%\icqm\icq\video\video.swf to %APPDATA%\icqm\icq\video\video.swf.yfsek
- from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1.yfsek
- from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.yfsek
- from %APPDATA%\telegram desktop\tdata\settings0 to %APPDATA%\telegram desktop\tdata\settings0.yfsek
- from %APPDATA%\telegram desktop\tdata\shortcuts-default.json to %APPDATA%\telegram desktop\tdata\shortcuts-default.json.yfsek
- from %APPDATA%\telegram desktop\tdata\usertag to %APPDATA%\telegram desktop\tdata\usertag.yfsek
- from %APPDATA%\thunderbird\crash reports\installtime20150330093429 to %APPDATA%\thunderbird\crash reports\installtime20150330093429.yfsek
- from %APPDATA%\telegram desktop\tdata\shortcuts-custom.json to %APPDATA%\telegram desktop\tdata\shortcuts-custom.json.yfsek
- from %APPDATA%\adobe\acrobat\dc\tmdocs.sav to %APPDATA%\adobe\acrobat\dc\tmdocs.sav.yfsek
- from %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav to %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav.yfsek
- from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv.yfsek
- from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv.yfsek
- from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv.yfsek
- from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv.yfsek
- from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv.yfsek
- from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv.yfsek
- from %APPDATA%\telegram desktop\tdata\prefix to %APPDATA%\telegram desktop\tdata\prefix.yfsek
- from %APPDATA%\icqm\icq\fonts\segoesc.ttf to %APPDATA%\icqm\icq\fonts\segoesc.ttf.yfsek
- from %APPDATA%\icqm\icq\sounds\voiceend.wav to %APPDATA%\icqm\icq\sounds\voiceend.wav.yfsek
- from %APPDATA%\icqm\icq\smiles\skin.txt to %APPDATA%\icqm\icq\smiles\skin.txt.yfsek
- from %APPDATA%\icqm\icq\sounds\auth.mp3 to %APPDATA%\icqm\icq\sounds\auth.mp3.yfsek
- from %APPDATA%\icqm\icq\sounds\busy.mp3 to %APPDATA%\icqm\icq\sounds\busy.mp3.yfsek
- from %APPDATA%\icqm\icq\sounds\call_in.wav to %APPDATA%\icqm\icq\sounds\call_in.wav.yfsek
- from %APPDATA%\icqm\icq\sounds\error.wav to %APPDATA%\icqm\icq\sounds\error.wav.yfsek
- from %APPDATA%\icqm\icq\sounds\letter.wav to %APPDATA%\icqm\icq\sounds\letter.wav.yfsek
- from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001 to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001.yfsek
- from %APPDATA%\icqm\icq\sounds\message.mp3 to %APPDATA%\icqm\icq\sounds\message.mp3.yfsek
- from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.yfsek
- from %APPDATA%\icqm\icq\sounds\otprav.wav to %APPDATA%\icqm\icq\sounds\otprav.wav.yfsek
- from %APPDATA%\icqm\icq\sounds\ring.mp3 to %APPDATA%\icqm\icq\sounds\ring.mp3.yfsek
- from %APPDATA%\icqm\icq\sounds\start.wav to %APPDATA%\icqm\icq\sounds\start.wav.yfsek
- from %APPDATA%\icqm\icq\sounds\conference.mp3 to %APPDATA%\icqm\icq\sounds\conference.mp3.yfsek
- from %APPDATA%\icqm\icq\sounds\test_sound.wav to %APPDATA%\icqm\icq\sounds\test_sound.wav.yfsek
- from %APPDATA%\icqm\icq\sounds\otprav.mp3 to %APPDATA%\icqm\icq\sounds\otprav.mp3.yfsek
- from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.yfsek
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '<LOCALNET>.70.0':445
- '<LOCALNET>.70.161':445
- '<LOCALNET>.70.162':445
- '<LOCALNET>.70.163':445
- '<LOCALNET>.70.164':445
- '<LOCALNET>.70.165':445
- '<LOCALNET>.70.166':445
- '<LOCALNET>.70.167':445
- '<LOCALNET>.70.168':445
- '<LOCALNET>.70.169':445
- '<LOCALNET>.70.170':445
- '<LOCALNET>.70.171':445
- '<LOCALNET>.70.172':445
- '<LOCALNET>.70.173':445
- '<LOCALNET>.70.175':445
- '<LOCALNET>.70.189':445
- '<LOCALNET>.70.176':445
- '<LOCALNET>.70.177':445
- '<LOCALNET>.70.178':445
- '<LOCALNET>.70.179':445
- '<LOCALNET>.70.180':445
- '<LOCALNET>.70.181':445
- '<LOCALNET>.70.182':445
- '<LOCALNET>.70.183':445
- '<LOCALNET>.70.184':445
- '<LOCALNET>.70.185':445
- '<LOCALNET>.70.186':445
- '<LOCALNET>.70.187':445
- '<LOCALNET>.70.188':445
- '<LOCALNET>.70.160':445
- '<LOCALNET>.70.174':445
- '<LOCALNET>.70.159':445
- '<LOCALNET>.70.142':445
- '<LOCALNET>.70.129':445
- '<LOCALNET>.70.130':445
- '<LOCALNET>.70.131':445
- '<LOCALNET>.70.132':445
- '<LOCALNET>.70.133':445
- '<LOCALNET>.70.134':445
- '<LOCALNET>.70.135':445
- '<LOCALNET>.70.136':445
- '<LOCALNET>.70.137':445
- '<LOCALNET>.70.138':445
- '<LOCALNET>.70.139':445
- '<LOCALNET>.70.140':445
- '<LOCALNET>.70.141':445
- '<LOCALNET>.70.143':445
- '<LOCALNET>.70.157':445
- '<LOCALNET>.70.144':445
- '<LOCALNET>.70.145':445
- '<LOCALNET>.70.146':445
- '<LOCALNET>.70.147':445
- '<LOCALNET>.70.148':445
- '<LOCALNET>.70.149':445
- '<LOCALNET>.70.150':445
- '<LOCALNET>.70.151':445
- '<LOCALNET>.70.152':445
- '<LOCALNET>.70.153':445
- '<LOCALNET>.70.154':445
- '<LOCALNET>.70.155':445
- '<LOCALNET>.70.156':445
- '<LOCALNET>.70.158':445
- '<LOCALNET>.70.207':445
- '<LOCALNET>.70.253':445
- '<LOCALNET>.70.192':445
- '<LOCALNET>.70.225':445
- '<LOCALNET>.70.226':445
- '<LOCALNET>.70.227':445
- '<LOCALNET>.70.228':445
- '<LOCALNET>.70.229':445
- '<LOCALNET>.70.230':445
- '<LOCALNET>.70.231':445
- '<LOCALNET>.70.232':445
- '<LOCALNET>.70.233':445
- '<LOCALNET>.70.234':445
- '<LOCALNET>.70.235':445
- '<LOCALNET>.70.236':445
- '<LOCALNET>.70.237':445
- '<LOCALNET>.70.239':445
- '<LOCALNET>.70.191':445
- '<LOCALNET>.70.240':445
- '<LOCALNET>.70.241':445
- '<LOCALNET>.70.242':445
- '<LOCALNET>.70.243':445
- '<LOCALNET>.70.244':445
- '<LOCALNET>.70.245':445
- '<LOCALNET>.70.246':445
- '<LOCALNET>.70.247':445
- '<LOCALNET>.70.248':445
- '<LOCALNET>.70.249':445
- '<LOCALNET>.70.250':445
- '<LOCALNET>.70.251':445
- '<LOCALNET>.70.252':445
- '<LOCALNET>.70.224':445
- '<LOCALNET>.70.128':445
- '<LOCALNET>.70.223':445
- '<LOCALNET>.70.206':445
- '<LOCALNET>.70.193':445
- '<LOCALNET>.70.194':445
- '<LOCALNET>.70.195':445
- '<LOCALNET>.70.196':445
- '<LOCALNET>.70.197':445
- '<LOCALNET>.70.198':445
- '<LOCALNET>.70.199':445
- '<LOCALNET>.70.200':445
- '<LOCALNET>.70.201':445
- '<LOCALNET>.70.202':445
- '<LOCALNET>.70.203':445
- '<LOCALNET>.70.204':445
- '<LOCALNET>.70.205':445
- '<LOCALNET>.70.190':445
- '<LOCALNET>.70.221':445
- '<LOCALNET>.70.208':445
- '<LOCALNET>.70.209':445
- '<LOCALNET>.70.210':445
- '<LOCALNET>.70.211':445
- '<LOCALNET>.70.212':445
- '<LOCALNET>.70.213':445
- '<LOCALNET>.70.214':445
- '<LOCALNET>.70.215':445
- '<LOCALNET>.70.216':445
- '<LOCALNET>.70.217':445
- '<LOCALNET>.70.218':445
- '<LOCALNET>.70.219':445
- '<LOCALNET>.70.220':445
- '<LOCALNET>.70.222':445
- '<LOCALNET>.70.238':445
- '<LOCALNET>.70.127':445
- '<LOCALNET>.70.110':445
- '<LOCALNET>.70.33':445
- '<LOCALNET>.70.34':445
- '<LOCALNET>.70.35':445
- '<LOCALNET>.70.36':445
- '<LOCALNET>.70.37':445
- '<LOCALNET>.70.38':445
- '<LOCALNET>.70.39':445
- '<LOCALNET>.70.40':445
- '<LOCALNET>.70.41':445
- '<LOCALNET>.70.42':445
- '<LOCALNET>.70.43':445
- '<LOCALNET>.70.44':445
- '<LOCALNET>.70.45':445
- '<LOCALNET>.70.47':445
- '<LOCALNET>.70.61':445
- '<LOCALNET>.70.48':445
- '<LOCALNET>.70.49':445
- '<LOCALNET>.70.50':445
- '<LOCALNET>.70.51':445
- '<LOCALNET>.70.52':445
- '<LOCALNET>.70.53':445
- '<LOCALNET>.70.54':445
- '<LOCALNET>.70.55':445
- '<LOCALNET>.70.56':445
- '<LOCALNET>.70.57':445
- '<LOCALNET>.70.58':445
- '<LOCALNET>.70.59':445
- '<LOCALNET>.70.60':445
- '<LOCALNET>.70.32':445
- '<LOCALNET>.70.46':445
- '<LOCALNET>.70.31':445
- '<LOCALNET>.70.14':445
- '<LOCALNET>.70.1':445
- '<LOCALNET>.70.2':445
- '<LOCALNET>.70.3':445
- '<LOCALNET>.70.4':445
- '<LOCALNET>.70.5':445
- '<LOCALNET>.70.6':445
- '<LOCALNET>.70.7':445
- '<LOCALNET>.70.8':445
- '<LOCALNET>.70.9':445
- '<LOCALNET>.70.10':445
- '<LOCALNET>.70.11':445
- '<LOCALNET>.70.12':445
- '<LOCALNET>.70.13':445
- '<LOCALNET>.70.15':445
- '<LOCALNET>.70.29':445
- '<LOCALNET>.70.16':445
- '<LOCALNET>.70.17':445
- '<LOCALNET>.70.18':445
- '<LOCALNET>.70.19':445
- '<LOCALNET>.70.20':445
- '<LOCALNET>.70.21':445
- '<LOCALNET>.70.22':445
- '<LOCALNET>.70.23':445
- '<LOCALNET>.70.24':445
- '<LOCALNET>.70.25':445
- '<LOCALNET>.70.26':445
- '<LOCALNET>.70.27':445
- '<LOCALNET>.70.28':445
- '<LOCALNET>.70.30':445
- '<LOCALNET>.70.79':445
- '<LOCALNET>.70.125':445
- '<LOCALNET>.70.64':445
- '<LOCALNET>.70.97':445
- '<LOCALNET>.70.98':445
- '<LOCALNET>.70.99':445
- '<LOCALNET>.70.100':445
- '<LOCALNET>.70.101':445
- '<LOCALNET>.70.102':445
- '<LOCALNET>.70.103':445
- '<LOCALNET>.70.104':445
- '<LOCALNET>.70.105':445
- '<LOCALNET>.70.106':445
- '<LOCALNET>.70.107':445
- '<LOCALNET>.70.108':445
- '<LOCALNET>.70.109':445
- '<LOCALNET>.70.111':445
- '<LOCALNET>.70.63':445
- '<LOCALNET>.70.112':445
- '<LOCALNET>.70.113':445
- '<LOCALNET>.70.114':445
- '<LOCALNET>.70.115':445
- '<LOCALNET>.70.116':445
- '<LOCALNET>.70.117':445
- '<LOCALNET>.70.118':445
- '<LOCALNET>.70.119':445
- '<LOCALNET>.70.120':445
- '<LOCALNET>.70.121':445
- '<LOCALNET>.70.122':445
- '<LOCALNET>.70.123':445
- '<LOCALNET>.70.124':445
- '<LOCALNET>.70.96':445
- '<LOCALNET>.70.126':445
- '<LOCALNET>.70.95':445
- '<LOCALNET>.70.78':445
- '<LOCALNET>.70.65':445
- '<LOCALNET>.70.66':445
- '<LOCALNET>.70.67':445
- '<LOCALNET>.70.68':445
- '<LOCALNET>.70.69':445
- '<LOCALNET>.70.70':445
- '<LOCALNET>.70.71':445
- '<LOCALNET>.70.72':445
- '<LOCALNET>.70.73':445
- '<LOCALNET>.70.74':445
- '<LOCALNET>.70.75':445
- '<LOCALNET>.70.76':445
- '<LOCALNET>.70.77':445
- '<LOCALNET>.70.62':445
- '<LOCALNET>.70.93':445
- '<LOCALNET>.70.80':445
- '<LOCALNET>.70.81':445
- '<LOCALNET>.70.82':445
- '<LOCALNET>.70.83':445
- '<LOCALNET>.70.84':445
- '<LOCALNET>.70.85':445
- '<LOCALNET>.70.86':445
- '<LOCALNET>.70.87':445
- '<LOCALNET>.70.88':445
- '<LOCALNET>.70.89':445
- '<LOCALNET>.70.90':445
- '<LOCALNET>.70.91':445
- '<LOCALNET>.70.92':445
- '<LOCALNET>.70.94':445
- '<LOCALNET>.70.254':445
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
