Trojan.Encoder.38787

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'vssympjgi' = '<SYSTEM32>\CMD.EXE /C START "" "%HOMEPATH%\Documents\ojpskf.exe"'

Creates or modifies the following files

%ProgramFiles%\microsoft office\office14\startup\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\startup\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\xlstart\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\xlstart\+recover+mhrvj+.txt

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Modifies file system

Creates the following files

%HOMEPATH%\documents\ojpskf.exe
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\managedobjects\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\managedobjects\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\servers\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\servers\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\components\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\components\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\components\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\certificates\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\people\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\places\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\sounds\places\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\things\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\sounds\things\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\sounds\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\toolbmps\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\toolbmps\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\sounds\people\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\forms\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\components\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\basic\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\basic\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\forms\1033\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\forms\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\forms\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\media\office14\autoshap\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\media\office14\bullets\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\media\office14\bullets\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\media\office14\lines\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\media\office14\lines\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\media\office14\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\media\office14\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\media\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\media\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\media\cagcat10\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\bibliography\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\dataservices\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\media\office14\autoshap\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\dataservices\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\bibliography\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\media\cagcat10\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\media\office14\1033\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\media\cagcat10\1033\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\media\cagcat10\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\+recover+mhrvj+.png
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\+recover+mhrvj+.txt
%ProgramFiles%\microsoft analysis services\as oledb\10\+recover+mhrvj+.png
%ProgramFiles%\microsoft analysis services\as oledb\10\+recover+mhrvj+.txt
%ProgramFiles%\microsoft analysis services\as oledb\+recover+mhrvj+.png
%ProgramFiles%\microsoft analysis services\as oledb\+recover+mhrvj+.txt
%ProgramFiles%\microsoft analysis services\+recover+mhrvj+.png
%ProgramFiles%\microsoft analysis services\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\clipart\pub60cor\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\clipart\pub60cor\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\+recover+mhrvj+.png
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\clipart\publisher\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\clipart\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\clipart\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\document themes 14\theme colors\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\document themes 14\theme colors\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\document themes 14\theme effects\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\document themes 14\theme effects\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\document themes 14\theme fonts\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\document themes 14\theme fonts\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\document themes 14\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\document themes 14\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\clipart\publisher\+recover+mhrvj+.png
%ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\3082\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\accessweb\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\accwiz\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\accwiz\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\addins\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\addins\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\bibliography\sort\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\bibliography\sort\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\bibliography\style\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\bibliography\style\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\bibliography\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\bibliography\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\borders\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\borders\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\convert\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\convert\1033\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\convert\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\convert\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\document parts\1033\14\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\document parts\1033\14\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\document parts\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\document parts\1033\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\document parts\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\document parts\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\en\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\en\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\3082\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1036\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\accessweb\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\media\office14\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\pubftscm\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\pubftscm\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\pubspapr\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\pubspapr\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\quickstyles\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\quickstyles\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1036\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\1033\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\translat\fren\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\+recover+mhrvj+.png
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\+recover+mhrvj+.png
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\+recover+mhrvj+.png
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\+recover+mhrvj+.txt
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\+recover+mhrvj+.png
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\+recover+mhrvj+.txt
%ProgramFiles%\msbuild\microsoft\+recover+mhrvj+.png
%ProgramFiles%\msbuild\microsoft\+recover+mhrvj+.txt
%ProgramFiles%\msbuild\+recover+mhrvj+.png
%ProgramFiles%\msbuild\+recover+mhrvj+.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\redistlist\+recover+mhrvj+.png
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\redistlist\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\+recover+mhrvj+.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\+recover+mhrvj+.png
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\+recover+mhrvj+.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\redistlist\+recover+mhrvj+.png
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\+recover+mhrvj+.png
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\+recover+mhrvj+.txt
%ProgramFiles%\reference assemblies\microsoft\framework\+recover+mhrvj+.png
%ProgramFiles%\reference assemblies\microsoft\framework\+recover+mhrvj+.txt
%ProgramFiles%\reference assemblies\microsoft\+recover+mhrvj+.png
%ProgramFiles%\reference assemblies\microsoft\+recover+mhrvj+.txt
%ProgramFiles%\reference assemblies\+recover+mhrvj+.png
%ProgramFiles%\reference assemblies\+recover+mhrvj+.txt
%ProgramFiles%\uninstall information\+recover+mhrvj+.png
%ProgramFiles%\uninstall information\+recover+mhrvj+.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\+recover+mhrvj+.png
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\redistlist\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\visualelements\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\visualelements\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\gmp-clearkey\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\uninstall\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\uninstall\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\+recover+mhrvj+.png
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\chrome\icons\+recover+mhrvj+.png
%ProgramFiles%\mozilla thunderbird\chrome\icons\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\chrome\+recover+mhrvj+.png
%ProgramFiles%\mozilla thunderbird\chrome\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\defaults\messenger\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\gmp-clearkey\+recover+mhrvj+.png
%ProgramFiles%\mozilla thunderbird\defaults\messenger\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\defaults\pref\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\defaults\+recover+mhrvj+.png
%ProgramFiles%\mozilla thunderbird\defaults\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\features\+recover+mhrvj+.png
%ProgramFiles%\mozilla thunderbird\features\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\fonts\+recover+mhrvj+.png
%ProgramFiles%\mozilla thunderbird\fonts\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\isp\+recover+mhrvj+.png
%ProgramFiles%\mozilla thunderbird\isp\+recover+mhrvj+.txt
%ProgramFiles%\mozilla thunderbird\uninstall\+recover+mhrvj+.png
%ProgramFiles%\mozilla thunderbird\uninstall\+recover+mhrvj+.txt
%ProgramFiles%\windows defender\en-us\+recover+mhrvj+.png
%ProgramFiles%\mozilla thunderbird\defaults\pref\+recover+mhrvj+.png
%ProgramFiles%\windows defender\en-us\+recover+mhrvj+.txt
%ProgramFiles%\windows defender\+recover+mhrvj+.png
%ProgramFiles%\windows defender\+recover+mhrvj+.txt
%ProgramFiles%\windows nt\+recover+mhrvj+.txt
%ProgramFiles%\windows photo viewer\en-us\+recover+mhrvj+.png
%ProgramFiles%\windows photo viewer\en-us\+recover+mhrvj+.txt
%ProgramFiles%\windows photo viewer\+recover+mhrvj+.png
%ProgramFiles%\windows photo viewer\+recover+mhrvj+.txt
%ProgramFiles%\windows portable devices\+recover+mhrvj+.png
%ProgramFiles%\windows portable devices\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\en-us\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\en-us\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\css\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\css\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\images\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\images\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\css\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\css\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\js\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\js\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\images\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\images\+recover+mhrvj+.txt
%ProgramFiles%\windows nt\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\+recover+mhrvj+.png
%ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\+recover+mhrvj+.png
%ProgramFiles%\windows nt\tabletextservice\en-us\+recover+mhrvj+.txt
%ProgramFiles%\windows journal\en-us\+recover+mhrvj+.png
%ProgramFiles%\windows journal\en-us\+recover+mhrvj+.txt
%ProgramFiles%\windows journal\templates\+recover+mhrvj+.png
%ProgramFiles%\windows journal\templates\+recover+mhrvj+.txt
%ProgramFiles%\windows journal\+recover+mhrvj+.png
%ProgramFiles%\windows journal\+recover+mhrvj+.txt
%ProgramFiles%\windows mail\en-us\+recover+mhrvj+.png
%ProgramFiles%\windows mail\en-us\+recover+mhrvj+.txt
%ProgramFiles%\windows mail\+recover+mhrvj+.png
%ProgramFiles%\windows mail\+recover+mhrvj+.txt
%ProgramFiles%\windows media player\en-us\+recover+mhrvj+.png
%ProgramFiles%\windows media player\en-us\+recover+mhrvj+.txt
%ProgramFiles%\windows media player\media renderer\+recover+mhrvj+.png
%ProgramFiles%\windows media player\media renderer\+recover+mhrvj+.txt
%ProgramFiles%\windows media player\network sharing\+recover+mhrvj+.png
%ProgramFiles%\windows media player\network sharing\+recover+mhrvj+.txt
%ProgramFiles%\windows media player\skins\+recover+mhrvj+.png
%ProgramFiles%\windows media player\skins\+recover+mhrvj+.txt
%ProgramFiles%\windows media player\visualizations\+recover+mhrvj+.png
%ProgramFiles%\windows media player\visualizations\+recover+mhrvj+.txt
%ProgramFiles%\windows media player\+recover+mhrvj+.png
%ProgramFiles%\windows media player\+recover+mhrvj+.txt
%ProgramFiles%\windows nt\accessories\en-us\+recover+mhrvj+.png
%ProgramFiles%\windows nt\accessories\en-us\+recover+mhrvj+.txt
%ProgramFiles%\windows nt\accessories\+recover+mhrvj+.png
%ProgramFiles%\windows nt\accessories\+recover+mhrvj+.txt
%ProgramFiles%\windows nt\tabletextservice\en-us\+recover+mhrvj+.png
%ProgramFiles%\windows nt\tabletextservice\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\fonts\+recover+mhrvj+.txt
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\distibution\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\proof\1033\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\proof\1036\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\proof\1036\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\proof\3082\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\proof\3082\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\proof\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\proof\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\pubba\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\pubba\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\pubwiz\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\pagesize\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\pubwiz\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\proof\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\queries\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\samples\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\stationery\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\stationery\1033\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\stationery\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\stationery\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\1033\access\datatype\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\1033\access\datatype\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\1033\access\part\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\queries\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\outlookautodiscover\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\samples\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\outlookautodiscover\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\onenote\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\toolicons\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\toolicons\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\xml files\space templates\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\xml files\space templates\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\xml files\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\xml files\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\infopathom\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\infopathom\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\library\analysis\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\library\analysis\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\library\solver\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\library\solver\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\library\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\library\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\media\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\media\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\onenote\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\1033\access\part\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\1033\access\wss\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\1033\access\wss\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\1033\access\+recover+mhrvj+.png
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\+recover+mhrvj+.png
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\+recover+mhrvj+.png
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\+recover+mhrvj+.png
%ProgramFiles%\microsoft sync framework\v1.0\runtime\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sync framework\v1.0\+recover+mhrvj+.png
%ProgramFiles%\microsoft sync framework\v1.0\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sync framework\+recover+mhrvj+.png
%ProgramFiles%\microsoft sync framework\+recover+mhrvj+.txt
%ProgramFiles%\microsoft synchronization services\ado.net\v1.0\+recover+mhrvj+.png
%ProgramFiles%\microsoft synchronization services\ado.net\v1.0\+recover+mhrvj+.txt
%ProgramFiles%\microsoft synchronization services\ado.net\+recover+mhrvj+.png
%ProgramFiles%\microsoft synchronization services\ado.net\+recover+mhrvj+.txt
%ProgramFiles%\microsoft synchronization services\+recover+mhrvj+.png
%ProgramFiles%\microsoft synchronization services\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\browser\features\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\browser\features\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\browser\visualelements\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\browser\visualelements\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\browser\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\browser\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\defaults\pref\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\defaults\pref\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\defaults\+recover+mhrvj+.png
%ProgramFiles%\mozilla firefox\defaults\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\distibution\+recover+mhrvj+.png
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\+recover+mhrvj+.txt
%ProgramFiles%\mozilla firefox\fonts\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\1033\access\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\1033\fax\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\1033\fax\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\14\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\1033\onenote\14\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\1033\onenote\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\1033\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\presentation designs\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\presentation designs\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\templates\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\templates\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\+recover+mhrvj+.png
%ProgramFiles%\microsoft office\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\+recover+mhrvj+.png
%ProgramFiles%\microsoft sql server compact edition\v3.5\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sql server compact edition\+recover+mhrvj+.png
%ProgramFiles%\microsoft sql server compact edition\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\+recover+mhrvj+.png
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\+recover+mhrvj+.png
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\+recover+mhrvj+.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\+recover+mhrvj+.txt
%ProgramFiles%\microsoft office\office14\pagesize\+recover+mhrvj+.txt
%ProgramFiles%\java\+recover+mhrvj+.txt
%ProgramFiles%\java\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\uk-ua\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\uk-ua\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\zh-cn\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\zh-cn\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\zh-tw\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\zh-tw\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\msclientdatamgr\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\th-th\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\msclientdatamgr\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\msinfo\en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\tr-tr\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\msinfo\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\1033\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\1033\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\cultures\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\cultures\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\msinfo\en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\sv-se\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\msinfo\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\tr-tr\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\sv-se\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\ko-kr\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\lt-lt\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\lt-lt\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\lv-lv\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\lv-lv\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\nb-no\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\nb-no\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\nl-nl\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\nl-nl\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\pl-pl\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\pl-pl\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\ja-jp\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\pt-br\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\pt-pt\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\pt-pt\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\ro-ro\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\ro-ro\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\ru-ru\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\ru-ru\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\sk-sk\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\sk-sk\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\sl-si\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\pt-br\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\ja-jp\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\proof\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\smart tag\1033\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\smart tag\1033\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\smart tag\lists\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\smart tag\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\smart tag\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\source engine\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\source engine\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\stationery\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\stationery\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\textconv\en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\textconv\en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\textconv\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\textconv\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\arctic\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\arctic\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\axis\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\axis\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\blends\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\blends\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\proof\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\ko-kr\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\it-it\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fi-fi\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\office14\+recover+mhrvj+.png
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\+recover+mhrvj+.png
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\+recover+mhrvj+.png
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\+recover+mhrvj+.png
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\msocache\all users\+recover+mhrvj+.png
C:\msocache\all users\+recover+mhrvj+.txt
C:\msocache\+recover+mhrvj+.png
C:\msocache\+recover+mhrvj+.txt
C:\perflogs\admin\+recover+mhrvj+.png
C:\perflogs\admin\+recover+mhrvj+.txt
C:\perflogs\+recover+mhrvj+.png
C:\perflogs\+recover+mhrvj+.txt
%CommonProgramFiles%\designer\+recover+mhrvj+.png
%CommonProgramFiles%\designer\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\+recover+mhrvj+.png
%HOMEPATH%\documents\+recover+file.txt
C:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\+recover+mhrvj+.txt
C:\$recycle.bin\+recover+mhrvj+.png
C:\$recycle.bin\+recover+mhrvj+.txt
C:\documents and settings\+recover+mhrvj+.png
C:\documents and settings\+recover+mhrvj+.txt
<Current directory>\+recover+mhrvj+.png
<Current directory>\+recover+mhrvj+.txt
C:\kms\+recover+mhrvj+.png
C:\kms\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\+recover+mhrvj+.png
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\+recover+mhrvj+.png
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\+recover+mhrvj+.png
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\dw\+recover+mhrvj+.png
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\dw\+recover+mhrvj+.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\equation\1033\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fr-fr\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\he-il\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\he-il\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\hr-hr\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\hu-hu\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\hu-hu\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fr-fr\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\equation\1033\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\it-it\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\et-ee\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\equation\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\euro\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\euro\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\filters\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\filters\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\grphflt\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\grphflt\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\help\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\help\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\ar-sa\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\ar-sa\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\bg-bg\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\equation\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\bg-bg\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\cs-cz\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\da-dk\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\da-dk\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\de-de\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\de-de\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\el-gr\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\el-gr\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\es-es\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\es-es\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\et-ee\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\cs-cz\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\ink\fi-fi\+recover+mhrvj+.txt
%ProgramFiles%\windows nt\tabletextservice\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\breeze\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\en-us\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\flippage\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\flippage\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\full\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\full\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\+recover+mhrvj+.png
%CommonProgramFiles%\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\en-us\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\memories\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\oldage\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\oldage\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\performance\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\performance\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\pets\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\pets\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\push\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\push\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\memories\+recover+mhrvj+.png
%CommonProgramFiles%\+recover+mhrvj+.txt
%CommonProgramFiles%\system\+recover+mhrvj+.txt
%CommonProgramFiles%\system\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\+recover+mhrvj+.txt
%CommonProgramFiles%\services\+recover+mhrvj+.png
%CommonProgramFiles%\services\+recover+mhrvj+.txt
%CommonProgramFiles%\speechengines\microsoft\+recover+mhrvj+.png
%CommonProgramFiles%\speechengines\microsoft\+recover+mhrvj+.txt
%CommonProgramFiles%\speechengines\+recover+mhrvj+.png
%CommonProgramFiles%\speechengines\+recover+mhrvj+.txt
%CommonProgramFiles%\system\ado\en-us\+recover+mhrvj+.png
%CommonProgramFiles%\system\ado\en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\system\ado\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\web server extensions\+recover+mhrvj+.png
%CommonProgramFiles%\system\ado\+recover+mhrvj+.txt
%CommonProgramFiles%\system\en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\system\msadc\en-us\+recover+mhrvj+.png
%CommonProgramFiles%\system\msadc\en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\system\msadc\+recover+mhrvj+.png
%CommonProgramFiles%\system\msadc\+recover+mhrvj+.txt
%CommonProgramFiles%\system\msmapi\1033\+recover+mhrvj+.png
%CommonProgramFiles%\system\msmapi\1033\+recover+mhrvj+.txt
%CommonProgramFiles%\system\msmapi\+recover+mhrvj+.png
%CommonProgramFiles%\system\msmapi\+recover+mhrvj+.txt
%CommonProgramFiles%\system\ole db\en-us\+recover+mhrvj+.png
%CommonProgramFiles%\system\ole db\en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\system\ole db\+recover+mhrvj+.png
%CommonProgramFiles%\system\en-us\+recover+mhrvj+.png
%CommonProgramFiles%\system\ole db\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\shatter\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\shatter\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\bin\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\amd64\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\amd64\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\applet\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\applet\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\ext\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\ext\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\images\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\images\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\jfr\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\jfr\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\management\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\management\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\security\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\security\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\lib\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\lib\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\web server extensions\14\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\bin\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\web server extensions\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\bin\server\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\sports\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\sports\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\stacking\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\stacking\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\travel\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\travel\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\videowall\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\videowall\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\vignette\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\vignette\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\dvdstyles\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\shared\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\shared\+recover+mhrvj+.txt
%ProgramFiles%\dvd maker\+recover+mhrvj+.png
%ProgramFiles%\dvd maker\+recover+mhrvj+.txt
%ProgramFiles%\internet explorer\en-us\+recover+mhrvj+.png
%ProgramFiles%\internet explorer\en-us\+recover+mhrvj+.txt
%ProgramFiles%\internet explorer\signup\+recover+mhrvj+.png
%ProgramFiles%\internet explorer\signup\+recover+mhrvj+.txt
%ProgramFiles%\internet explorer\+recover+mhrvj+.png
%ProgramFiles%\internet explorer\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\+recover+mhrvj+.txt
%ProgramFiles%\java\jre1.8.0_45\bin\plugin2\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\bin\server\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\boldstri\+recover+mhrvj+.png
%ProgramFiles%\java\jre1.8.0_45\bin\plugin2\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\ink\th-th\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\layers\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\layers\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\level\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\level\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\network\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\network\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\papyrus\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\papyrus\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\pixel\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\pixel\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\iris\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\profile\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\journal\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\quad\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\radial\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\radial\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\refined\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\refined\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\ricepapr\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\ricepapr\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\ripple\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\ripple\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\rmnsque\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\rmnsque\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\profile\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\satin\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\quad\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\journal\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\iris\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\indust\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\breeze\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\canyon\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\canyon\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\capsules\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\capsules\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\cascade\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\cascade\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\compass\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\compass\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\concrete\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\concrete\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\boldstri\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\deepblue\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\echo\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\echo\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\eclipse\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\eclipse\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\edge\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\edge\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\expeditn\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\expeditn\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\ice\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\ice\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\deepblue\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\indust\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\satin\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\sky\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\sky\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\slate\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\triedit\en-us\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\triedit\en-us\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\triedit\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\triedit\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\vba\vba7\1033\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\vba\vba7\1033\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\vba\vba7\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\vba\vba7\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\vba\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\vba\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\vc\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\vc\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\vgx\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\vgx\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\vsto\10.0\1033\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\vsto\10.0\1033\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\vsto\10.0\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\vsto\10.0\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\vsto\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\vsto\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\web folders\1033\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\web folders\1033\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\web folders\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\web folders\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\translat\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\translat\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\slate\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\sonora\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\sonora\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\spring\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\spring\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\strtedge\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\strtedge\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\studio\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\studio\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\sumipntg\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\sumipntg\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\water\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\water\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\watermar\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\watermar\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\themes14\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\themes14\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\translat\arfr\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\translat\arfr\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\translat\enes\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\translat\enes\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\translat\enfr\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\translat\enfr\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\translat\esen\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\translat\esen\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\translat\frar\+recover+mhrvj+.png
%CommonProgramFiles%\microsoft shared\translat\frar\+recover+mhrvj+.txt
%CommonProgramFiles%\microsoft shared\translat\fren\+recover+mhrvj+.txt
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\+recover+mhrvj+.txt

Sets the 'hidden' attribute to the following files

%HOMEPATH%\documents\ojpskf.exe

Modifies the following files

%CommonProgramFiles%\microsoft shared\grphflt\ms.eps
%CommonProgramFiles%\microsoft shared\themes14\layers\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\journal\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\iris\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\indust\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\ice\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\expeditn\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\edge\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\eclipse\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\echo\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\deepblue\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\concrete\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\compass\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\cascade\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\capsules\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\canyon\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\breeze\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\boldstri\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\blends\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\axis\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\arctic\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\thmbnail.png
%CommonProgramFiles%\microsoft shared\smart tag\metconv.txt
%CommonProgramFiles%\microsoft shared\grphflt\ms.png
%CommonProgramFiles%\microsoft shared\grphflt\ms.jpg
%CommonProgramFiles%\microsoft shared\themes14\level\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\network\thmbnail.png

Modifies multiple files.

Deletes itself.

Modifies user data files (Trojan.Encoder).

Network activity

Connects to

'vt##60.com':80

TCP

HTTP POST requests

http://vt##60.com/wp-content/themes/vtc360_maxf3d/ReduxFramework/ReduxCore/inc/extensions/wbc_importer/demo-data/Demo2/binarystings.php

UDP

DNS ASK dr####ybenovitz.com
DNS ASK ho##shit.in
DNS ASK st####ftheworld.org
DNS ASK hk##jsu.org
DNS ASK vt##60.com
DNS ASK gr#####ecantikan.com

Miscellaneous

Creates and executes the following

'%HOMEPATH%\documents\ojpskf.exe'
'%WINDIR%\syswow64\cmd.exe' /c DEL <Full path to file> >> NUL' (with hidden window)
'<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c DEL <Full path to file> >> NUL

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial