Trojan.Encoder.36918

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Bi2LJZNdn9' = '<Full path to file>'

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule group="Network Discovery" new enable=Yes

Terminates or attempts to terminate

the following user processes:

firefox.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%APPDATA%\thunderbird\profiles.ini

Modifies file system

Creates the following files

C:\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winamp\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tablet pc\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\office\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\google chrome\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\088iz84m-readme.txt
%APPDATA%\winamp\088iz84m-readme.txt
%APPDATA%\thunderbird\088iz84m-readme.txt
%APPDATA%\telegram desktop\088iz84m-readme.txt
%APPDATA%\qipguard\088iz84m-readme.txt
%APPDATA%\qip\088iz84m-readme.txt
%APPDATA%\opera software\088iz84m-readme.txt
%APPDATA%\mra\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\088iz84m-readme.txt
%APPDATA%\mozilla\088iz84m-readme.txt
%APPDATA%\mirc\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0731c4f1\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\msdn\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\media player\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\internet explorer\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\feeds\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\event viewer\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\device metadata\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\dbgclr\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\credentials\088iz84m-readme.txt
%LOCALAPPDATA%\google\crashreports\088iz84m-readme.txt
%LOCALAPPDATA%\google\chrome\088iz84m-readme.txt
%LOCALAPPDATA%\cef\user data\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\088iz84m-readme.txt
%LOCALAPPDATA%\adobe\color\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\windows\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\088iz84m-readme.txt
C:\users\default\appdata\local\microsoft\windows\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_5d5d8b7c1982ab7c66cf747e7b18b39e2441a_cab_073d8027\088iz84m-readme.txt
%LOCALAPPDATA%\adobe\acrocef\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\088iz84m-readme.txt
%LOCALAPPDATA%\adobe\acrobat\088iz84m-readme.txt
%LOCALAPPDATA%\programs\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportarchive\088iz84m-readme.txt
%APPDATA%\mail.ru\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\sessions\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\manifest\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\drm\cache\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\temp\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\upload\088iz84m-readme.txt
%APPDATA%\microsoft\088iz84m-readme.txt
%APPDATA%\media center programs\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\088iz84m-readme.txt
%APPDATA%\macromedia\088iz84m-readme.txt
%APPDATA%\identities\088iz84m-readme.txt
%APPDATA%\icqm\088iz84m-readme.txt
%APPDATA%\icq-profile\088iz84m-readme.txt
%APPDATA%\ghisler\088iz84m-readme.txt
%APPDATA%\adobe\088iz84m-readme.txt
%LOCALAPPDATA%low\sun\088iz84m-readme.txt
%LOCALAPPDATA%low\oracle\088iz84m-readme.txt
%LOCALAPPDATA%low\microsoft\088iz84m-readme.txt
%LOCALAPPDATA%low\adobe\088iz84m-readme.txt
%LOCALAPPDATA%\virtualstore\088iz84m-readme.txt
%LOCALAPPDATA%\thunderbird\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\088iz84m-readme.txt
%TEMP%\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\088iz84m-readme.txt
%LOCALAPPDATA%\opera software\088iz84m-readme.txt
%LOCALAPPDATA%\mozilla\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft help\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\088iz84m-readme.txt
%LOCALAPPDATA%\google\088iz84m-readme.txt
%LOCALAPPDATA%\cef\088iz84m-readme.txt
%LOCALAPPDATA%\applicationhistory\088iz84m-readme.txt
%LOCALAPPDATA%\adobe\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\088iz84m-readme.txt
C:\users\default\appdata\roaming\media center programs\088iz84m-readme.txt
C:\users\default\appdata\local\temp\088iz84m-readme.txt
C:\users\default\appdata\local\microsoft\088iz84m-readme.txt
%LOCALAPPDATA%\steam\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\publisher\088iz84m-readme.txt
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\windows\templates\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\windows\start menu\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\windows\sendto\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\windows\recent\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\windows\cookies\088iz84m-readme.txt
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\088iz84m-readme.txt
C:\users\default\appdata\local\microsoft\windows\<INETFILES>\088iz84m-readme.txt
C:\users\default\appdata\local\microsoft\windows\history\088iz84m-readme.txt
C:\users\default\appdata\local\microsoft\windows\gameexplorer\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\088iz84m-readme.txt
%APPDATA%\mra\update\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\tools\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\config\088iz84m-readme.txt
%APPDATA%\winamp\plugins\088iz84m-readme.txt
%APPDATA%\thunderbird\profiles\088iz84m-readme.txt
%APPDATA%\thunderbird\crash reports\088iz84m-readme.txt
%APPDATA%\telegram desktop\tdata\088iz84m-readme.txt
%APPDATA%\qip\profiles\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\help\088iz84m-readme.txt
%APPDATA%\opera software\opera stable\088iz84m-readme.txt
%LOCALAPPDATA%\adobe\acrobat\dc\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\internet explorer\recovery\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows\history\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows\gameexplorer\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows\explorer\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows\caches\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows\burn\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows\1033\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows\1024\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\office\onetconfig\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\office\groove\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\office\14.0\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\msdn\7.0\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\media player\transcoded files cache\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\media player\sync playlists\088iz84m-readme.txt
%LOCALAPPDATA%\adobe\color\profiles\088iz84m-readme.txt
%LOCALAPPDATA%\adobe\acrocef\dc\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\internet explorer\domstore\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\evw7z7yu\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\e6k79x6b\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\dp0qcmsh\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\feeds cache\3v2zgiw9\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\feeds\microsoft feeds~\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\feeds\feeds for united states~\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\device metadata\dmrccache\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\dbgclr\7.1\088iz84m-readme.txt
%LOCALAPPDATA%\google\chrome\user data\088iz84m-readme.txt
%LOCALAPPDATA%\cef\user data\widevinecdm\088iz84m-readme.txt
%LOCALAPPDATA%\cef\user data\dictionaries\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\media player\art cache\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\taskschedulerconfig\088iz84m-readme.txt
%APPDATA%\mozilla\extensions\088iz84m-readme.txt
%TEMP%\opera installer\088iz84m-readme.txt
%APPDATA%\adobe\acrobat\088iz84m-readme.txt
%LOCALAPPDATA%low\sun\java\088iz84m-readme.txt
%LOCALAPPDATA%low\oracle\java\088iz84m-readme.txt
%LOCALAPPDATA%low\microsoft\internet explorer\088iz84m-readme.txt
%LOCALAPPDATA%low\adobe\linguistics\088iz84m-readme.txt
%LOCALAPPDATA%low\adobe\acrobat\088iz84m-readme.txt
%LOCALAPPDATA%\thunderbird\updates\088iz84m-readme.txt
%LOCALAPPDATA%\thunderbird\profiles\088iz84m-readme.txt
volume{c84d25cd-f368-11e4-889d-806e6f6e6963}\system volume information\tracking.log.tmp
%TEMP%\wpdnse\088iz84m-readme.txt
%TEMP%\webinstaller\088iz84m-readme.txt
%TEMP%\temp1_fp_13.0.0.182_archive.zip\088iz84m-readme.txt
%APPDATA%\adobe\flash player\088iz84m-readme.txt
%APPDATA%\adobe\headlights\088iz84m-readme.txt
%APPDATA%\mozilla\firefox\088iz84m-readme.txt
%TEMP%\lilo.1516\088iz84m-readme.txt
%TEMP%\hsperfdata_user\088iz84m-readme.txt
%TEMP%\adobe_admlogs\088iz84m-readme.txt
%TEMP%\acrord32_sbx\088iz84m-readme.txt
%LOCALAPPDATA%\steam\htmlcache\088iz84m-readme.txt
%LOCALAPPDATA%\programs\common\088iz84m-readme.txt
%LOCALAPPDATA%\opera software\opera stable\088iz84m-readme.txt
%LOCALAPPDATA%\mozilla\updates\088iz84m-readme.txt
%LOCALAPPDATA%\mozilla\firefox\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows sidebar\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows media\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows mail\088iz84m-readme.txt
%TEMP%\low\088iz84m-readme.txt
%APPDATA%\mra\base\088iz84m-readme.txt
%APPDATA%\adobe\linguistics\088iz84m-readme.txt
%APPDATA%\microsoft\msdn\088iz84m-readme.txt
%APPDATA%\microsoft\network\088iz84m-readme.txt
%APPDATA%\microsoft\word\088iz84m-readme.txt
%APPDATA%\microsoft\windows\088iz84m-readme.txt
%APPDATA%\microsoft\uproof\088iz84m-readme.txt
%APPDATA%\microsoft\templates\088iz84m-readme.txt
%APPDATA%\microsoft\systemcertificates\088iz84m-readme.txt
%APPDATA%\microsoft\speech\088iz84m-readme.txt
%APPDATA%\microsoft\publisher building blocks\088iz84m-readme.txt
%APPDATA%\microsoft\publisher\088iz84m-readme.txt
%APPDATA%\microsoft\protect\088iz84m-readme.txt
%APPDATA%\microsoft\proof\088iz84m-readme.txt
%APPDATA%\microsoft\powerpoint\088iz84m-readme.txt
%APPDATA%\microsoft\office\088iz84m-readme.txt
%APPDATA%\mirc\scripts\088iz84m-readme.txt
%APPDATA%\adobe\logtransport2\088iz84m-readme.txt
%APPDATA%\icq-profile\base\088iz84m-readme.txt
%APPDATA%\microsoft\internet explorer\088iz84m-readme.txt
%APPDATA%\microsoft\excel\088iz84m-readme.txt
%APPDATA%\microsoft\document building blocks\088iz84m-readme.txt
%APPDATA%\microsoft\dbgclr\088iz84m-readme.txt
%APPDATA%\microsoft\crypto\088iz84m-readme.txt
%APPDATA%\microsoft\credentials\088iz84m-readme.txt
%APPDATA%\microsoft\addins\088iz84m-readme.txt
%APPDATA%\mail.ru\agent\088iz84m-readme.txt
%APPDATA%\macromedia\flash player\088iz84m-readme.txt
%APPDATA%\identities\{91255d00-95d9-49f5-8e84-7c027f5283b7}\088iz84m-readme.txt
%APPDATA%\icqm\icq\088iz84m-readme.txt
%APPDATA%\icq-profile\update\088iz84m-readme.txt
%APPDATA%\microsoft\mmc\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\mf\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\media player\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\ilscache\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\event viewer\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\ehome\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\drm\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\devicesync\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\network\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\088iz84m-readme.txt
%ALLUSERSPROFILE%\adobe\arm\088iz84m-readme.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\088iz84m-readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
%ALLUSERSPROFILE%\adobe\setup\088iz84m-readme.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\088iz84m-readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\office\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\088iz84m-readme.txt
%ALLUSERSPROFILE%\oracle\java\088iz84m-readme.txt
%ALLUSERSPROFILE%\mozilla\logs\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\wpd\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\vault\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\search\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\088iz84m-readme.txt
C:\far2\pluginsdk\headers.c\088iz84m-readme.txt
C:\far2\plugins\autowrap\088iz84m-readme.txt
%ALLUSERSPROFILE%\mozilla\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft toolkit\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft help\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\088iz84m-readme.txt
%ALLUSERSPROFILE%\adobe\088iz84m-readme.txt
%ProgramFiles%\microsoft sql server compact edition\088iz84m-readme.txt
C:\perflogs\admin\088iz84m-readme.txt
C:\msocache\all users\088iz84m-readme.txt
C:\far2\pluginsdk\088iz84m-readme.txt
C:\far2\plugins\088iz84m-readme.txt
C:\far2\fexcept\088iz84m-readme.txt
C:\far2\encyclopedia\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\088iz84m-readme.txt
C:\far2\documentation\088iz84m-readme.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\088iz84m-readme.txt
C:\users\088iz84m-readme.txt
C:\totalcmd\088iz84m-readme.txt
C:\system volume information\088iz84m-readme.txt
C:\recovery\088iz84m-readme.txt
%ALLUSERSPROFILE%\088iz84m-readme.txt
%ProgramFiles(x86)%\088iz84m-readme.txt
%ProgramFiles%\088iz84m-readme.txt
C:\perflogs\088iz84m-readme.txt
<Current directory>\088iz84m-readme.txt
C:\msocache\088iz84m-readme.txt
C:\far2\088iz84m-readme.txt
C:\$recycle.bin\088iz84m-readme.txt
C:\far2\addons\088iz84m-readme.txt
C:\far2\pluginsdk\headers.pas\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\088iz84m-readme.txt
%ALLUSERSPROFILE%\oracle\088iz84m-readme.txt
C:\far2\plugins\tmppanel\088iz84m-readme.txt
C:\far2\plugins\proclist\088iz84m-readme.txt
C:\far2\plugins\network\088iz84m-readme.txt
C:\far2\plugins\macroview\088iz84m-readme.txt
C:\far2\plugins\hlfviewer\088iz84m-readme.txt
C:\far2\plugins\ftp\088iz84m-readme.txt
C:\far2\plugins\filecase\088iz84m-readme.txt
C:\far2\plugins\farcmds\088iz84m-readme.txt
C:\far2\plugins\emenu\088iz84m-readme.txt
C:\far2\plugins\editcase\088iz84m-readme.txt
C:\far2\plugins\drawline\088iz84m-readme.txt
C:\far2\plugins\compare\088iz84m-readme.txt
C:\far2\plugins\brackets\088iz84m-readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\088iz84m-readme.txt
%ALLUSERSPROFILE%\sun\088iz84m-readme.txt
C:\far2\plugins\align\088iz84m-readme.txt
C:\far2\encyclopedia\tap\088iz84m-readme.txt
C:\far2\documentation\rus\088iz84m-readme.txt
C:\far2\documentation\eng\088iz84m-readme.txt
C:\far2\addons\xlat\088iz84m-readme.txt
C:\far2\addons\shell\088iz84m-readme.txt
C:\far2\addons\setup\088iz84m-readme.txt
C:\far2\addons\macros\088iz84m-readme.txt
C:\far2\addons\colors\088iz84m-readme.txt
%HOMEPATH%\088iz84m-readme.txt
C:\users\public\088iz84m-readme.txt
C:\users\default\088iz84m-readme.txt
C:\totalcmd\language\088iz84m-readme.txt
C:\far2\plugins\arclite\088iz84m-readme.txt
C:\system volume information\spp\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\netframework\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\088iz84m-readme.txt
%ALLUSERSPROFILE%\oracle\java\javapath\088iz84m-readme.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\profiles\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\support\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\templates\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\power efficiency diagnostics\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\gameexplorer\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\drm\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\caches\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\ait\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\temp\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\outbound\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\ringtones\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\windows\sqm\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\088iz84m-readme.txt
%HOMEPATH%\favorites\msn websites\088iz84m-readme.txt
%HOMEPATH%\favorites\windows live\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\event viewer\views\applicationviewsrootnode\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\088iz84m-readme.txt
%ALLUSERSPROFILE%\adobe\arm\s\10428\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\088iz84m-readme.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\088iz84m-readme.txt
%HOMEPATH%\favorites\links for united states\088iz84m-readme.txt
%HOMEPATH%\favorites\links\088iz84m-readme.txt
%APPDATA%\088iz84m-readme.txt
%LOCALAPPDATA%low\088iz84m-readme.txt
%LOCALAPPDATA%\088iz84m-readme.txt
C:\users\public\videos\sample videos\088iz84m-readme.txt
C:\users\public\recorded tv\sample media\088iz84m-readme.txt
C:\users\public\pictures\sample pictures\088iz84m-readme.txt
C:\users\public\music\sample music\088iz84m-readme.txt
C:\users\default\appdata\roaming\088iz84m-readme.txt
C:\users\default\appdata\local\088iz84m-readme.txt
%ALLUSERSPROFILE%\sun\java\java update\088iz84m-readme.txt
%HOMEPATH%\favorites\microsoft websites\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\network\connections\088iz84m-readme.txt
%ALLUSERSPROFILE%\sun\java\088iz84m-readme.txt
%HOMEPATH%\links\088iz84m-readme.txt
%HOMEPATH%\favorites\088iz84m-readme.txt
%HOMEPATH%\downloads\088iz84m-readme.txt
%HOMEPATH%\documents\088iz84m-readme.txt
%HOMEPATH%\desktop\088iz84m-readme.txt
%HOMEPATH%\contacts\088iz84m-readme.txt
%HOMEPATH%\appdata\088iz84m-readme.txt
C:\users\public\videos\088iz84m-readme.txt
C:\users\public\recorded tv\088iz84m-readme.txt
C:\users\public\pictures\088iz84m-readme.txt
C:\users\public\music\088iz84m-readme.txt
C:\users\public\libraries\088iz84m-readme.txt
%HOMEPATH%\pictures\088iz84m-readme.txt
C:\users\public\favorites\088iz84m-readme.txt
C:\users\public\documents\088iz84m-readme.txt
C:\users\public\desktop\088iz84m-readme.txt
C:\users\default\videos\088iz84m-readme.txt
C:\users\default\saved games\088iz84m-readme.txt
C:\users\default\pictures\088iz84m-readme.txt
C:\users\default\music\088iz84m-readme.txt
C:\users\default\links\088iz84m-readme.txt
C:\users\default\favorites\088iz84m-readme.txt
C:\users\default\downloads\088iz84m-readme.txt
C:\users\default\documents\088iz84m-readme.txt
C:\users\default\desktop\088iz84m-readme.txt
C:\users\default\appdata\088iz84m-readme.txt
C:\system volume information\spp\onlinemetadatacache\088iz84m-readme.txt
C:\users\public\downloads\088iz84m-readme.txt
%HOMEPATH%\saved games\088iz84m-readme.txt
%HOMEPATH%\music\088iz84m-readme.txt
%HOMEPATH%\searches\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\netframework\breadcrumbstore\088iz84m-readme.txt
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\8.0\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\event viewer\views\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\ehome\logs\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\drm\server\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\088iz84m-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\088iz84m-readme.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\088iz84m-readme.txt
%ALLUSERSPROFILE%\adobe\arm\s\088iz84m-readme.txt
%HOMEPATH%\videos\088iz84m-readme.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\088iz84m-readme.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\088iz84m-readme.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\088iz84m-readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\088iz84m-readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\088iz84m-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\088iz84m-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\088iz84m-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\088iz84m-readme.txt
C:\far2\plugins\ftp\lib\088iz84m-readme.txt
C:\far2\addons\xlat\russian\088iz84m-readme.txt
C:\far2\addons\colors\default_highlighting\088iz84m-readme.txt
C:\far2\addons\colors\custom_highlighting\088iz84m-readme.txt
%HOMEPATH%\voip\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows\ringtones\088iz84m-readme.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\088iz84m-readme.txt

Moves the following files

from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.088iz84m
from %APPDATA%\mirc\scripts\aliases.ini to %APPDATA%\mirc\scripts\aliases.ini.088iz84m
from %APPDATA%\mirc\scripts\popups.ini to %APPDATA%\mirc\scripts\popups.ini.088iz84m
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.088iz84m
from %APPDATA%\mra\base\mra.dbs to %APPDATA%\mra\base\mra.dbs.088iz84m
from %APPDATA%\mra\base\opt.dbs to %APPDATA%\mra\base\opt.dbs.088iz84m
from %APPDATA%\microsoft\uproof\excludedictionaryen0409.lex to %APPDATA%\microsoft\uproof\excludedictionaryen0409.lex.088iz84m
from %APPDATA%\microsoft\uproof\excludedictionaryen0809.lex to %APPDATA%\microsoft\uproof\excludedictionaryen0809.lex.088iz84m
from %APPDATA%\mra\update\languages.aff to %APPDATA%\mra\update\languages.aff.088iz84m
from %APPDATA%\mra\update\languages.hash to %APPDATA%\mra\update\languages.hash.088iz84m
from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.088iz84m
from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\bookmarks.bak.088iz84m
from %APPDATA%\opera software\opera stable\bookmarksextras to %APPDATA%\opera software\opera stable\bookmarksextras.088iz84m
from %APPDATA%\opera software\opera stable\certificate revocation lists to %APPDATA%\opera software\opera stable\certificate revocation lists.088iz84m
from %APPDATA%\mra\update\ver.txt to %APPDATA%\mra\update\ver.txt.088iz84m
from %APPDATA%\mra\update\languages.dict to %APPDATA%\mra\update\languages.dict.088iz84m
from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm.088iz84m
from %APPDATA%\microsoft\uproof\custom.dic to %APPDATA%\microsoft\uproof\custom.dic.088iz84m
from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.088iz84m
from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs.088iz84m
from %APPDATA%\icq-profile\base\opt.dbs to %APPDATA%\icq-profile\base\opt.dbs.088iz84m
from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff.088iz84m
from %APPDATA%\icq-profile\update\ver.txt to %APPDATA%\icq-profile\update\ver.txt.088iz84m
from %APPDATA%\icq-profile\update\languages.dict to %APPDATA%\icq-profile\update\languages.dict.088iz84m
from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash.088iz84m
from %APPDATA%\adobe\logtransport2\logtransport2.cfg to %APPDATA%\adobe\logtransport2\logtransport2.cfg.088iz84m
from %APPDATA%\mail.ru\agent\libvoip_x86.dll to %APPDATA%\mail.ru\agent\libvoip_x86.dll.088iz84m
from %APPDATA%\mail.ru\agent\magentsetup.exe to %APPDATA%\mail.ru\agent\magentsetup.exe.088iz84m
from %APPDATA%\mail.ru\agent\mrainplaceviewer.dll to %APPDATA%\mail.ru\agent\mrainplaceviewer.dll.088iz84m
from %APPDATA%\mail.ru\agent\sciter32.dll to %APPDATA%\mail.ru\agent\sciter32.dll.088iz84m
from %APPDATA%\mail.ru\agent\vivo.dll to %APPDATA%\mail.ru\agent\vivo.dll.088iz84m
from %APPDATA%\microsoft\mmc\taskschd to %APPDATA%\microsoft\mmc\taskschd.088iz84m
from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl.088iz84m
from %APPDATA%\mail.ru\agent\magent.exe to %APPDATA%\mail.ru\agent\magent.exe.088iz84m
from %APPDATA%\opera software\opera stable\browser.js to %APPDATA%\opera software\opera stable\browser.js.088iz84m
from %APPDATA%\opera software\opera stable\cookies-journal to %APPDATA%\opera software\opera stable\cookies-journal.088iz84m
from %APPDATA%\opera software\opera stable\cookies to %APPDATA%\opera software\opera stable\cookies.088iz84m
from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.088iz84m
from %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798 to %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798.088iz84m
from %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927 to %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927.088iz84m
from %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881 to %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881.088iz84m
from %APPDATA%\opera software\opera stable\thumbnails.db-journal to %APPDATA%\opera software\opera stable\thumbnails.db-journal.088iz84m
from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.088iz84m
from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.088iz84m
from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.088iz84m
from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.088iz84m
from %APPDATA%\opera software\opera stable\web data-journal to %APPDATA%\opera software\opera stable\web data-journal.088iz84m
from %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0 to %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0.088iz84m
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1.088iz84m
from %APPDATA%\telegram desktop\tdata\prefix to %APPDATA%\telegram desktop\tdata\prefix.088iz84m
from %APPDATA%\telegram desktop\tdata\settings0 to %APPDATA%\telegram desktop\tdata\settings0.088iz84m
from %APPDATA%\telegram desktop\tdata\shortcuts-custom.json to %APPDATA%\telegram desktop\tdata\shortcuts-custom.json.088iz84m
from %APPDATA%\telegram desktop\tdata\shortcuts-default.json to %APPDATA%\telegram desktop\tdata\shortcuts-default.json.088iz84m
from %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967 to %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967.088iz84m
from %APPDATA%\opera software\opera stable\session.dbak to %APPDATA%\opera software\opera stable\session.dbak.088iz84m
from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\siteprefs.json.088iz84m
from %APPDATA%\opera software\opera stable\session.db-journal to %APPDATA%\opera software\opera stable\session.db-journal.088iz84m
from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\favicons-journal.088iz84m
from %APPDATA%\opera software\opera stable\favorites.db-journal to %APPDATA%\opera software\opera stable\favorites.db-journal.088iz84m
from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.088iz84m
from %APPDATA%\opera software\opera stable\history provider cache to %APPDATA%\opera software\opera stable\history provider cache.088iz84m
from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.088iz84m
from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.088iz84m
from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.088iz84m
from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\login data-journal.088iz84m
from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.088iz84m
from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.088iz84m
from %APPDATA%\opera software\opera stable\origin bound certs to %APPDATA%\opera software\opera stable\origin bound certs.088iz84m
from %APPDATA%\opera software\opera stable\origin bound certs-journal to %APPDATA%\opera software\opera stable\origin bound certs-journal.088iz84m
from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.088iz84m
from %APPDATA%\opera software\opera stable\quotamanager to %APPDATA%\opera software\opera stable\quotamanager.088iz84m
from %APPDATA%\opera software\opera stable\quotamanager-journal to %APPDATA%\opera software\opera stable\quotamanager-journal.088iz84m
from %APPDATA%\telegram desktop\tdata\usertag to %APPDATA%\telegram desktop\tdata\usertag.088iz84m
from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.088iz84m
from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\winamp.ini.088iz84m
from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.088iz84m
from %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log.088iz84m
from %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log.088iz84m
from %TEMP%\dd_vcredist_x86_20151216210157.log to %TEMP%\dd_vcredist_x86_20151216210157.log.088iz84m
from %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log.088iz84m
from %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log.088iz84m
from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.088iz84m
from %TEMP%\dd_vcredist_amd64_20151216210341.log to %TEMP%\dd_vcredist_amd64_20151216210341.log.088iz84m
from %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt to %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt.088iz84m
from %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt to %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt.088iz84m
from %TEMP%\dotnetfx.log to %TEMP%\dotnetfx.log.088iz84m
from %TEMP%\dotnetfxsdk.log to %TEMP%\dotnetfxsdk.log.088iz84m
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.088iz84m
from %TEMP%\jusched.log to %TEMP%\jusched.log.088iz84m
from %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt to %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt.088iz84m
from %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt to %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt.088iz84m
from %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt.088iz84m
from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.088iz84m
from %TEMP%\aspnetsetup_00002.log to %TEMP%\aspnetsetup_00002.log.088iz84m
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceca35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceca35.dll.088iz84m
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcecompact35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcecompact35.dll.088iz84m
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceer35en.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceer35en.dll.088iz84m
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceme35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceme35.dll.088iz84m
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcese35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcese35.dll.088iz84m
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceoledb35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceoledb35.dll.088iz84m
from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.088iz84m
from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll.088iz84m
from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log.088iz84m
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.088iz84m
from %TEMP%\aspnetsetup.log to %TEMP%\aspnetsetup.log.088iz84m
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.088iz84m
from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.088iz84m
from %TEMP%\aspnetsetup_00003.log to %TEMP%\aspnetsetup_00003.log.088iz84m
from %TEMP%\adobearm.log to %TEMP%\adobearm.log.088iz84m
from %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt to %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt.088iz84m
from %TEMP%\microsoft .net framework 4.7.1 setup_20200610_200621826-msi_netfx_full_x64.msi.txt to %TEMP%\microsoft .net framework 4.7.1 setup_20200610_200621826-msi_netfx_full_x64.msi.txt.088iz84m
from %TEMP%\mirc741.exe to %TEMP%\mirc741.exe.088iz84m
from %TEMP%\msi1cfbe.log to %TEMP%\msi1cfbe.log.088iz84m
from %APPDATA%\icqm\mrainplaceviewer.dll to %APPDATA%\icqm\mrainplaceviewer.dll.088iz84m
from %APPDATA%\icqm\sciter32.dll to %APPDATA%\icqm\sciter32.dll.088iz84m
from %APPDATA%\icqm\vivo.dll to %APPDATA%\icqm\vivo.dll.088iz84m
from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.088iz84m
from %APPDATA%\mirc\urls.ini to %APPDATA%\mirc\urls.ini.088iz84m
from %APPDATA%\mirc\servers.ini to %APPDATA%\mirc\servers.ini.088iz84m
from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.088iz84m
from %APPDATA%\qipguard\chrome.dll to %APPDATA%\qipguard\chrome.dll.088iz84m
from %APPDATA%\qipguard\qipguard.exe to %APPDATA%\qipguard\qipguard.exe.088iz84m
from %APPDATA%\qipguard\qipguard_upd.exe to %APPDATA%\qipguard\qipguard_upd.exe.088iz84m
from %APPDATA%\qipguard\sqlite3.dll to %APPDATA%\qipguard\sqlite3.dll.088iz84m
from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.088iz84m
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.088iz84m
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.088iz84m
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.088iz84m
from %APPDATA%\icqm\libvoip_x86.dll to %APPDATA%\icqm\libvoip_x86.dll.088iz84m
from %APPDATA%\icqm\icq.exe to %APPDATA%\icqm\icq.exe.088iz84m
from %APPDATA%\icqm\icqsetup.exe to %APPDATA%\icqm\icqsetup.exe.088iz84m
from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.088iz84m
from %TEMP%\msic204f.log to %TEMP%\msic204f.log.088iz84m
from %TEMP%\msid38c.log to %TEMP%\msid38c.log.088iz84m
from %TEMP%\msieb217.log to %TEMP%\msieb217.log.088iz84m
from %TEMP%\msie45bf.log to %TEMP%\msie45bf.log.088iz84m
from %TEMP%\ose00000.exe to %TEMP%\ose00000.exe.088iz84m
from %TEMP%\ose00001.exe to %TEMP%\ose00001.exe.088iz84m
from %TEMP%\rgi8564.tmp to %TEMP%\rgi8564.tmp.088iz84m
from %TEMP%\rgi8564.tmp-tmp to %TEMP%\rgi8564.tmp-tmp.088iz84m
from %TEMP%\rgie195.tmp to %TEMP%\rgie195.tmp.088iz84m
from %TEMP%\rgie195.tmp-tmp to %TEMP%\rgie195.tmp-tmp.088iz84m
from %TEMP%\setupexe(20151124155624744).log to %TEMP%\setupexe(20151124155624744).log.088iz84m
from %TEMP%\setupexe(201603101200226dc).log to %TEMP%\setupexe(201603101200226dc).log.088iz84m
from %TEMP%\setupexe(20160310140634718).log to %TEMP%\setupexe(20160310140634718).log.088iz84m
from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.088iz84m
from volume{c84d25cd-f368-11e4-889d-806e6f6e6963}\system volume information\tracking.log.tmp to volume{c84d25cd-f368-11e4-889d-806e6f6e6963}\system volume information\tracking.log
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.088iz84m
from %APPDATA%\thunderbird\crash reports\installtime20150330093429 to %APPDATA%\thunderbird\crash reports\installtime20150330093429.088iz84m

Modifies the following files

C:\far2\changelog
C:\totalcmd\tcunin64.wul
C:\totalcmd\size!.txt
C:\totalcmd\register.rtf
C:\totalcmd\no.bar
C:\totalcmd\history.txt
C:\totalcmd\keyboard.txt
C:\totalcmd\descript.ion
C:\totalcmd\default.bar
C:\system volume information\tracking.log
%ProgramFiles(x86)%\desktop.ini
%ProgramFiles%\desktop.ini
C:\far2\savesettings.cmd
C:\far2\restoresettings.cmd
C:\far2\file_id.diz
C:\far2\farspa.lng
C:\far2\farrus.lng
C:\far2\farrus.hlf
C:\far2\farpol.lng
C:\far2\farhun.lng
C:\far2\farhun.hlf
C:\far2\farger.lng
C:\far2\fareng.lng
C:\far2\fareng.hlf
C:\far2\farcze.lng
C:\far2\far.map
C:\far2\clearpluginscache.cmd
C:\far2\changelog_eng
C:\totalcmd\tcuninst.wul
C:\totalcmd\totalcmd.chm

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

UDP

'localhost':50363
'localhost':57158

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule group="Network Discovery" new enable=Yes' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial