Trojan.PWS.Siggen1.46123

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<Virus name>.exe' = '<Full path to virus>'

Creates the following files on removable media:

<Drive name for removable media>:\Desktop.htt
<Drive name for removable media>:\%USERNAME%.wab~
<Drive name for removable media>:\%USERNAME%.wab
<Drive name for removable media>:\0007F0B7.wpl
<Drive name for removable media>:\Show Desktop.scf
<Drive name for removable media>:\Launch Internet Explorer Browser.lnk
<Drive name for removable media>:\winscp.rnd
<Drive name for removable media>:\wordpfct.wpd
<Drive name for removable media>:\winword2.doc
<Drive name for removable media>:\winword.doc
<Drive name for removable media>:\FontCache3.0.0.0.dat
<Drive name for removable media>:\ntuser.ini
<Drive name for removable media>:\wordpfct.wpg
<Drive name for removable media>:\Custom.theme
<Drive name for removable media>:\extensions.sqlite
<Drive name for removable media>:\extensions.ini
<Drive name for removable media>:\downloads.sqlite
<Drive name for removable media>:\localstore.rdf
<Drive name for removable media>:\key3.db
<Drive name for removable media>:\formhistory.sqlite
<Drive name for removable media>:\cookies.sqlite
<Drive name for removable media>:\cert8.db
<Drive name for removable media>:\bookmarks.html
<Drive name for removable media>:\profiles.ini
<Drive name for removable media>:\content-prefs.sqlite
<Drive name for removable media>:\compatibility.ini
<Drive name for removable media>:\chromeappsstore.sqlite
<Drive name for removable media>:\sndrec.wav
<Drive name for removable media>:\Windows Media Player.lnk
<Drive name for removable media>:\Remote Assistance.lnk
<Drive name for removable media>:\WMSDKNS.XML
<Drive name for removable media>:\Program Compatibility Wizard.lnk
<Drive name for removable media>:\Notepad.lnk
<Drive name for removable media>:\Command Prompt.lnk
<Drive name for removable media>:\WMSDKNS.DTD
<Drive name for removable media>:\brndlog.bak
<Drive name for removable media>:\NTUSER.DAT
<Drive name for removable media>:\Spider Solitaire.lnk
<Drive name for removable media>:\CurrentDatabase_59R.wmdb
<Drive name for removable media>:\index.dat
<Drive name for removable media>:\brndlog.txt
<Drive name for removable media>:\Synchronize.lnk
<Drive name for removable media>:\lotus.wk4
<Drive name for removable media>:\excel4.xls
<Drive name for removable media>:\excel.xls
<Drive name for removable media>:\quattro.wb2
<Drive name for removable media>:\presenta.shw
<Drive name for removable media>:\powerpnt.ppt
<Drive name for removable media>:\amipro.sam
<Drive name for removable media>:\Magnifier.lnk
<Drive name for removable media>:\Windows Explorer.lnk
<Drive name for removable media>:\Tour Windows XP.lnk
<Drive name for removable media>:\Utility Manager.lnk
<Drive name for removable media>:\On-Screen Keyboard.lnk
<Drive name for removable media>:\Narrator.lnk
<Drive name for removable media>:\Sample Pictures.lnk
<Drive name for removable media>:\Sample Music.lnk
<Drive name for removable media>:\2675456989[1]
<Drive name for removable media>:\scoopy.lnk
<Drive name for removable media>:\Local Disk (C).lnk
<Drive name for removable media>:\DrWebVirtNet.lnk
<Drive name for removable media>:\hgfs.dat
<Drive name for removable media>:\_CACHE_002_
<Drive name for removable media>:\_CACHE_001_
<Drive name for removable media>:\XUL.mfl
<Drive name for removable media>:\startupCache.4.little
<Drive name for removable media>:\_CACHE_MAP_
<Drive name for removable media>:\_CACHE_003_
<Drive name for removable media>:\scsi.lnk
<Drive name for removable media>:\changelog_eng
<Drive name for removable media>:\Shortcut to startup_local.lnk
<Drive name for removable media>:\Address Book.lnk
<Drive name for removable media>:\RestoreSettings.cmd
<Drive name for removable media>:\File_id.diz
<Drive name for removable media>:\ClearPluginsCache.cmd
<Drive name for removable media>:\Outlook Express.lnk
<Drive name for removable media>:\xxscsi.lnk
<Drive name for removable media>:\vm_shara on '.hostShared Folders' (Z).lnk
<Drive name for removable media>:\video7.0.lnk
<Drive name for removable media>:\Internet Explorer.lnk
<Drive name for removable media>:\Far.lnk
<Drive name for removable media>:\xxx_svga.lnk
<Drive name for removable media>:\Outbox.dbx
<Drive name for removable media>:\sessionstore.js
<Drive name for removable media>:\sessionstore.bak
<Drive name for removable media>:\secmod.db
<Drive name for removable media>:\bookmarks-2011-11-10.json
<Drive name for removable media>:\webappsstore.sqlite
<Drive name for removable media>:\signons.sqlite
<Drive name for removable media>:\search.sqlite
<Drive name for removable media>:\places.sqlite
<Drive name for removable media>:\permissions.sqlite
<Drive name for removable media>:\mimeTypes.rdf
<Drive name for removable media>:\search.json
<Drive name for removable media>:\prefs.js
<Drive name for removable media>:\pluginreg.dat
<Drive name for removable media>:\userChrome-example.css
<Drive name for removable media>:\IconCache.db
<Drive name for removable media>:\GDIPFONTCACHEV1.DAT
<Drive name for removable media>:\Windows.url
<Drive name for removable media>:\Offline.dbx
<Drive name for removable media>:\Inbox.dbx
<Drive name for removable media>:\Folders.dbx
<Drive name for removable media>:\Windows Media.url
<Drive name for removable media>:\Radio Station Guide.url
<Drive name for removable media>:\MSN.com.url
<Drive name for removable media>:\userContent-example.css
<Drive name for removable media>:\Windows Marketplace.url
<Drive name for removable media>:\Free Hotmail.url
<Drive name for removable media>:\Customize Links.url
<Drive name for removable media>:\pink flower.bmp
<Drive name for removable media>:\palm tree.bmp
<Drive name for removable media>:\lift-off.bmp
<Drive name for removable media>:\snowflake.bmp
<Drive name for removable media>:\skater.bmp
<Drive name for removable media>:\red flower.bmp
<Drive name for removable media>:\kick.bmp
<Drive name for removable media>:\fish.bmp
<Drive name for removable media>:\duck.bmp
<Drive name for removable media>:\drip.bmp
<Drive name for removable media>:\horses.bmp
<Drive name for removable media>:\guitar.bmp
<Drive name for removable media>:\frog.bmp
<Drive name for removable media>:\Beethoven's Symphony No. 9 (Scherzo).wma
<Drive name for removable media>:\Plylst3.wpl
<Drive name for removable media>:\Plylst2.wpl
<Drive name for removable media>:\Plylst15.wpl
<Drive name for removable media>:\Plylst6.wpl
<Drive name for removable media>:\Plylst5.wpl
<Drive name for removable media>:\Plylst4.wpl
<Drive name for removable media>:\Plylst14.wpl
<Drive name for removable media>:\Plylst10.wpl
<Drive name for removable media>:\Plylst1.wpl
<Drive name for removable media>:\New Stories (Highway Blues).wma
<Drive name for removable media>:\Plylst13.wpl
<Drive name for removable media>:\Plylst12.wpl
<Drive name for removable media>:\Plylst11.wpl
<Drive name for removable media>:\dog.bmp
<Drive name for removable media>:\Ж¤·ф.she
<Drive name for removable media>:\jedata.dll
<Drive name for removable media>:\ddel.bat
<Drive name for removable media>:\drwtsn32.log
<Drive name for removable media>:\d42cc0c3858a58db2db37658219e6400_23ef5514-3059-436f-a4a7-4cefaab20eb1
<Drive name for removable media>:\desktop.ini
<Drive name for removable media>:\<Virus name>.exe
<Drive name for removable media>:\network.pcap
<Drive name for removable media>:\DbgLog.log
<Drive name for removable media>:\boot.ini
<Drive name for removable media>:\startup_local.bat
<Drive name for removable media>:\ntldr
<Drive name for removable media>:\NTDETECT.COM
<Drive name for removable media>:\DefaultStore_59R.bin
<Drive name for removable media>:\car.bmp
<Drive name for removable media>:\butterfly.bmp
<Drive name for removable media>:\beach.bmp
<Drive name for removable media>:\dirt bike.bmp
<Drive name for removable media>:\chess.bmp
<Drive name for removable media>:\cat.bmp
<Drive name for removable media>:\ball.bmp
<Drive name for removable media>:\guest.bmp
<Drive name for removable media>:\sharedaccess.ini
<Drive name for removable media>:\UserMigratedStore_59R.bin
<Drive name for removable media>:\astronaut.bmp
<Drive name for removable media>:\airplane.bmp
<Drive name for removable media>:\%USERNAME%.bmp
<Drive name for removable media>:\Computer Management.lnk
<Drive name for removable media>:\Component Services.lnk
<Drive name for removable media>:\System Restore.lnk
<Drive name for removable media>:\Local Security Policy.lnk
<Drive name for removable media>:\Event Viewer.lnk
<Drive name for removable media>:\Data Sources (ODBC).lnk
<Drive name for removable media>:\System Information.lnk
<Drive name for removable media>:\Disk Defragmenter.lnk
<Drive name for removable media>:\Disk Cleanup.lnk
<Drive name for removable media>:\Character Map.lnk
<Drive name for removable media>:\Security Center.lnk
<Drive name for removable media>:\Scheduled Tasks.lnk
<Drive name for removable media>:\Files and Settings Transfer Wizard.lnk
<Drive name for removable media>:\Microsoft .NET Framework 1.1 Configuration.lnk
<Drive name for removable media>:\Internet Spades.lnk
<Drive name for removable media>:\Internet Reversi.lnk
<Drive name for removable media>:\Internet Hearts.lnk
<Drive name for removable media>:\Solitaire.lnk
<Drive name for removable media>:\Pinball.lnk
<Drive name for removable media>:\Minesweeper.lnk
<Drive name for removable media>:\Internet Checkers.lnk
<Drive name for removable media>:\Services.lnk
<Drive name for removable media>:\Performance.lnk
<Drive name for removable media>:\Microsoft .NET Framework 1.1 Wizards.lnk
<Drive name for removable media>:\Internet Backgammon.lnk
<Drive name for removable media>:\Hearts.lnk
<Drive name for removable media>:\Freecell.lnk
<Drive name for removable media>:\Backup.lnk
<Drive name for removable media>:\Set Program Access and Defaults.lnk
<Drive name for removable media>:\drmv2.sst
<Drive name for removable media>:\drmv2.lic
<Drive name for removable media>:\MSN.lnk
<Drive name for removable media>:\Windows Update.lnk
<Drive name for removable media>:\Windows Catalog.lnk
<Drive name for removable media>:\Winter.jpg
<Drive name for removable media>:\Plylst9.wpl
<Drive name for removable media>:\Plylst8.wpl
<Drive name for removable media>:\Plylst7.wpl
<Drive name for removable media>:\Water lilies.jpg
<Drive name for removable media>:\Sunset.jpg
<Drive name for removable media>:\Blue hills.jpg
<Drive name for removable media>:\Windows Messenger.lnk
<Drive name for removable media>:\Remote Desktop Connection.lnk
<Drive name for removable media>:\New Connection Wizard.lnk
<Drive name for removable media>:\Network Setup Wizard.lnk
<Drive name for removable media>:\Volume Control.lnk
<Drive name for removable media>:\Sound Recorder.lnk
<Drive name for removable media>:\Wireless Network Setup Wizard.lnk
<Drive name for removable media>:\Network Connections.lnk
<Drive name for removable media>:\Paint.lnk
<Drive name for removable media>:\Calculator.lnk
<Drive name for removable media>:\Windows Movie Maker.lnk
<Drive name for removable media>:\HyperTerminal.lnk
<Drive name for removable media>:\Accessibility Wizard.lnk
<Drive name for removable media>:\WordPad.lnk

Malicious functions:

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

Executes the following:

'<SYSTEM32>\taskkill.exe' /f /im explorer.exe
'<SYSTEM32>\taskkill.exe' /f /im Aver.exe
'<SYSTEM32>\rundll32.exe' fldrclnr.dll,Wizard_RunDLL
'%WINDIR%\explorer.exe'
'<SYSTEM32>\cmd.exe' /c <Current directory>\del.bat
'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
'<SYSTEM32>\cmd.exe'
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Aver.exe
'<SYSTEM32>\cmd.exe' /c <Current directory>\ddel.bat

Terminates or attempts to terminate

the following system processes:

%WINDIR%\Explorer.EXE

Searches for windows to

detect programs and games:

ClassName: '' WindowName: 'QQ.exe'

Modifies file system:

Creates the following files:

C:\eomjlf.ise_0
C:\eoxh.kug_0_0_0
C:\eo_mjlf.sfh_0
C:\eodfn_iurp_mxob.uhj_0_0_0
C:\eodfn_iurp_mxob.uhj_1_0_0
C:\eodfn_vhcdo.kug_0_0_0
C:\eo_mjlf.sfh_1
C:\epxompbet.trmjuf_1
C:\eqmtvs.weq_0_0_0_0
C:\eqmtvs.weq_1_0_0_0
C:\eph.cnq_0
C:\eph.cnq_1
C:\epxompbet.trmjuf_0
C:\enq_0y5d_0y30000_0
C:\enq_0y88_0y10000_0
C:\enq_0y88_0y20000_0
C:\enq_0y27d_0y30000_0
C:\enq_0y5d_0y10000_0
C:\enq_0y5d_0y20000_0
C:\enq_0y88_0y30000_0
C:\eodfn_iurp_Frqduhy.uhj_1_0_0
C:\eodfn_iurp_Mbrgry.uhj_0_0_0
C:\eodfn_iurp_Mbrgry.uhj_1_0_0
C:\eodfn.kug_0_0_0
C:\eodfn_db.kug_0_0_0
C:\eodfn_iurp_Frqduhy.uhj_0_0_0
C:\errnpdunv-2011-11-10.mvrq_1_0_0
C:\errnpdunv.kwpo_0_0_0
C:\errnpdunv.kwpo_1_0_0
C:\eqqmkgu.usnkvg_0_0
C:\eqqmkgu.usnkvg_1_0
C:\errnpdunv-2011-11-10.mvrq_0_0_0
C:\errw.lql_0_0_0
C:\esnw2.mjd_0
C:\esnw2.mjd_1
C:\esnw2.ttu_0
C:\ESEARCH.BAT_0
C:\esjq.cnq_0
C:\esjq.cnq_1
C:\eqnqtgg.npi_0_0
C:\eqnqtgt.fnn_0_0
C:\eqnqtgt.gpv.jte_0_0
C:\eqmtvs.weq_2_0_0_0
C:\eqmtvs.weq_3_0_0_0
C:\eqnqtgg.jnh_0_0
C:\eqnqtgt.jnh_0_0
C:\eqorcvkdknkva.kpk_1_0
C:\eqpvgpv-rtghu.usnkvg_0_0
C:\eqpvgpv-rtghu.usnkvg_1_0
C:\eqnqtgt.npi_0_0
C:\eqooqp.lct_0_0
C:\eqorcvkdknkva.kpk_0_0
C:\ejcpigu.vzv_0_0
C:\ejguu.dor_0_0
C:\ejguu.dor_1_0
C:\ejcpignqi_9_0
C:\ejcpignqi_gpi_0_0
C:\ejcpignqi_gpi_1_0
C:\ejsu cjlf.cnq_0
C:\ejtqogcrruuvqtg.usnkvg_0_0
C:\ejtqogcrruuvqtg.usnkvg_1_0
C:\EMfov.emm_0
C:\ejsu cjlf.cnq_1
C:\ejtlt.foh.ufnq_0
C:\ejtlt.svt.ufnq_0
C:\ejcpignqi_16_0
C:\ejcpignqi_17_0
C:\ejcpignqi_1_0
C:\ejcpignqi_13_0
C:\ejcpignqi_14_0
C:\ejcpignqi_15_0
C:\ejcpignqi_2_0
C:\ejcpignqi_6_0
C:\ejcpignqi_7_0
C:\ejcpignqi_8_0
C:\ejcpignqi_3_0
C:\ejcpignqi_4_0
C:\ejcpignqi_5_0
C:\enq_0y130_0y30000_0
C:\enq_0y238_0y10000_0
C:\enq_0y238_0y20000_0
C:\enq_0y124_0y30000_0
C:\enq_0y130_0y10000_0
C:\enq_0y130_0y20000_0
C:\enq_0y260_0y10000_0
C:\enq_0y278_0y30000_0
C:\enq_0y27d_0y10000_0
C:\enq_0y27d_0y20000_0
C:\enq_0y260_0y20000_0
C:\enq_0y278_0y10000_0
C:\enq_0y278_0y20000_0
C:\EMfovEoh.moh_0
C:\EMfovRvt.img_0
C:\EMfovRvt.moh_0
C:\EMfov.nbq_0
C:\EMfovDfm.sfh_0
C:\EMfovEoh.img_0
C:\emvtperi.fqt_0_0_0_0
C:\ENG_READ.TXT_0
C:\enq_0y124_0y10000_0
C:\enq_0y124_0y20000_0
C:\emvtperi.fqt_1_0_0_0
C:\encuuke.jtf_0_0
C:\ENG_NEWS.TXT_0
C:\esnw2.ttu_1
C:\Fbs.mol_0
C:\Fbs.mol_1
C:\FbsCaf.moh_0
C:\Fbs.FAQ.uyu_0
C:\Fbs.FAQ.uyu_1
C:\Fbs.fyf_0
C:\FbsCpmpsW.qbt_0
C:\FbsFuq.emm_0
C:\FbsFuq.nbq_0
C:\FbsGfs.moh_0
C:\FbsEodzdmpqfejb.sv.din_0
C:\FbsEoh.img_0
C:\FbsEoh.moh_0
C:\FARCnetRvt.img_0
C:\FARCnetRvt.moh_0
C:\FARCofu.fnn_0_0
C:\FARCnet.nbq_0
C:\FARCnetEoh.img_0
C:\FARCnetEoh.moh_0
C:\FARCofu.ocr_0_0
C:\FARCpmpst242.sfh_0
C:\FARCpmpst242.sfh_1
C:\FARHfsf.jog_0
C:\FARCofuEpi.jnh_0_0
C:\FARCofuEpi.npi_0_0
C:\FARCofuRwu.jnh_0_0
C:\fepp.fqt_1_0_0_0
C:\FEydfqu.emm_0
C:\ffgn.dcv_0_0
C:\fdwdorj-whaw.apo_0_0_0
C:\fdwdorj.apo_0_0_0
C:\fepp.fqt_0_0_0_0
C:\ffgn.dcv_1_0
C:\fghcwnv.jtf_0_0
C:\fgn.dcv_0_0
C:\fgn.dcv_1_0
C:\ffgn.dcv_2_0
C:\ffgn.dcv_3_0
C:\ffvto.kuf_0_0_0
C:\FbsPpm.moh_0
C:\FbsRvt.img_0
C:\FbsRvt.moh_0
C:\FbsHvo.img_0
C:\FbsHvo.moh_0
C:\FbsKfztW.qbt_0
C:\FbsSqb.moh_0
C:\fdw.eps_1_0_0
C:\fdwdorj-frqvroh.apo_0_0_0
C:\fdwdorj-uje.apo_0_0_0
C:\fdu.eps_0_0_0
C:\fdu.eps_1_0_0
C:\fdw.eps_0_0_0
C:\evdl.cnq_0
C:\evdl.cnq_1
C:\evgpmxi.hpp_0_0_0_0
C:\euqgorj.waw_1_0_0
C:\euqgorj.waw_2_0_0
C:\euqgorj.waw_3_0_0
C:\evgpmxi.qet_0_0_0_0
C:\evgpmxi_vyw.prk_0_0_0_0
C:\Ewfou Vjfxfs.mol_0
C:\Ewfou Vjfxfs.mol_1
C:\evgpmxi_irk.lpj_0_0_0_0
C:\evgpmxi_irk.prk_0_0_0_0
C:\evgpmxi_vyw.lpj_0_0_0_0
C:\ES_ENG.LNG_0
C:\ES_ENG.REG_0
C:\ES_RUS.HLF_0
C:\esxuto32.mph_0
C:\esxuto32.mph_1
C:\ES_ENG.HLF_0
C:\ES_RUS.LNG_0
C:\euqgorj.edn_2_0_0
C:\euqgorj.edn_3_0_0
C:\euqgorj.waw_0_0_0
C:\ES_RUS.REG_0
C:\euqgorj.edn_0_0_0
C:\euqgorj.edn_1_0_0
C:\EyuSfbsdiRfh.dqq_0
C:\eyxs.nev_0_0_0_0
C:\F3.sfh_0
C:\EyuSfbsdi.dqq_0
C:\EyuSfbsdi.iqq_0
C:\EyuSfbsdiMjy.dqq_0
C:\f42ee0e3858c58fd2fd37658219g6400_23gh5514-3059-436h-c4c7-4eghccd20gd1_0_0
C:\F9DfbdujwbufMfov.sfh_0
C:\F9Tbcmf.sfh_0
C:\FARCnet.emm_0
C:\f42ee0e3858c58fd2fd37658219g6400_23gh5514-3059-436h-c4c7-4eghccd20gd1_1_0
C:\f662ij49.ibi_0_0_0_0
C:\f662ij49.ibi_1_0_0_0
C:\Exgpv Vkgygt.npm_1_0
C:\exwwhuiob.eps_0_0_0
C:\exwwhuiob.eps_1_0_0
C:\ewxvsreyx.fqt_0_0_0_0
C:\ewxvsreyx.fqt_1_0_0_0
C:\Exgpv Vkgygt.npm_0_0
C:\EydDvnq.emm_0
C:\EyuCmjqBpbse.dqq_0
C:\EyuMfov.dqq_0
C:\EyuRfhEyq.dqq_0
C:\Eyfdvups.4NT.sfh_0
C:\Eyfdvups.CMD.sfh_0
C:\EyuCiCbtf.dqq_0
C:\ejcpignqi_12_0
C:\eftlupq.joj_112
C:\eftlupq.joj_113
C:\eftlupq.joj_114
C:\eftlupq.joj_11
C:\eftlupq.joj_110
C:\eftlupq.joj_111
C:\eftlupq.joj_115
C:\eftlupq.joj_119
C:\eftlupq.joj_12
C:\eftlupq.joj_120
C:\eftlupq.joj_116
C:\eftlupq.joj_117
C:\eftlupq.joj_118
C:\eftlupq.joj_100
C:\eftlupq.joj_101
C:\eftlupq.joj_102
C:\eftlupq.joj_0
C:\eftlupq.joj_1
C:\eftlupq.joj_10
C:\eftlupq.joj_103
C:\eftlupq.joj_107
C:\eftlupq.joj_108
C:\eftlupq.joj_109
C:\eftlupq.joj_104
C:\eftlupq.joj_105
C:\eftlupq.joj_106
C:\eftlupq.joj_136
C:\eftlupq.joj_137
C:\eftlupq.joj_138
C:\eftlupq.joj_133
C:\eftlupq.joj_134
C:\eftlupq.joj_135
C:\eftlupq.joj_139
C:\eftlupq.joj_142
C:\eftlupq.joj_143
C:\eftlupq.joj_144
C:\eftlupq.joj_14
C:\eftlupq.joj_140
C:\eftlupq.joj_141
C:\eftlupq.joj_124
C:\eftlupq.joj_125
C:\eftlupq.joj_126
C:\eftlupq.joj_121
C:\eftlupq.joj_122
C:\eftlupq.joj_123
C:\eftlupq.joj_127
C:\eftlupq.joj_130
C:\eftlupq.joj_131
C:\eftlupq.joj_132
C:\eftlupq.joj_128
C:\eftlupq.joj_129
C:\eftlupq.joj_13
C:\dwvvgthna.dor_0_0
C:\dwvvgthna.dor_1_0
C:\dxwr.mdu_0_0_0
C:\dufolwh_uxv.oqj_0_0_0
C:\dvwurqdxw.eps_0_0_0
C:\dvwurqdxw.eps_1_0_0
C:\dzcfsqvol.ise_0
C:\e662hi49.hah_1_0_0
C:\ECbtfEoh.img_0
C:\ECbtfEoh.moh_0
C:\e42dd0d3858b58ec2ec37658219f6400_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
C:\e42dd0d3858b58ec2ec37658219f6400_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1
C:\e662hi49.hah_0_0_0
C:\dtpfnqi.vzv_1_0
C:\dtpfnqi.vzv_2_0
C:\dtpfnqi.vzv_3_0
C:\dtpfnqi.dcm_2_0
C:\dtpfnqi.dcm_3_0
C:\dtpfnqi.vzv_0_0
C:\DtWgdVktvNgv.npm_0_0
C:\dufolwh_hqj.koi_0_0_0
C:\dufolwh_hqj.oqj_0_0_0
C:\dufolwh_uxv.koi_0_0_0
C:\DtWgdVktvNgv.npm_1_0
C:\dufolwh.goo_0_0_0
C:\dufolwh.pds_0_0_0
C:\Eeju.Npufqbe.sfh_0
C:\Eeju.SbwfAoeEyju.sfh_0
C:\Eeju.SbwfFjmf.sfh_0
C:\eefm.cbu_1
C:\eefm.cbu_2
C:\eefm.cbu_3
C:\EejuCbtf.emm_0
C:\efm.cbu_0
C:\efm.cbu_1
C:\efnbohmf32.emm_0
C:\EejuCbtf.nbq_0
C:\eeusn.jte_0_0
C:\efgbvmu.ise_0
C:\ect.dor_1_0
C:\ecv.dor_0_0
C:\ecv.dor_1_0
C:\ECbtfRvt.img_0
C:\ECbtfRvt.moh_0
C:\ect.dor_0_0
C:\ecvcnqi-eqpuqng.zon_0_0
C:\edoo.eps_0_0_0
C:\edoo.eps_1_0_0
C:\eefm.cbu_0
C:\ecvcnqi-tid.zon_0_0
C:\ecvcnqi-vgzv.zon_0_0
C:\ecvcnqi.zon_0_0
C:\eftlupq.joj_145
C:\eftlupq.joj_73
C:\eftlupq.joj_74
C:\eftlupq.joj_75
C:\eftlupq.joj_70
C:\eftlupq.joj_71
C:\eftlupq.joj_72
C:\eftlupq.joj_76
C:\eftlupq.joj_8
C:\eftlupq.joj_80
C:\eftlupq.joj_81
C:\eftlupq.joj_77
C:\eftlupq.joj_78
C:\eftlupq.joj_79
C:\eftlupq.joj_61
C:\eftlupq.joj_62
C:\eftlupq.joj_63
C:\eftlupq.joj_59
C:\eftlupq.joj_6
C:\eftlupq.joj_60
C:\eftlupq.joj_64
C:\eftlupq.joj_68
C:\eftlupq.joj_69
C:\eftlupq.joj_7
C:\eftlupq.joj_65
C:\eftlupq.joj_66
C:\eftlupq.joj_67
C:\eftlupq.joj_97
C:\eftlupq.joj_98
C:\eftlupq.joj_99
C:\eftlupq.joj_94
C:\eftlupq.joj_95
C:\eftlupq.joj_96
C:\egtv8.fd_0_0
C:\ejcpignqi_0_0
C:\ejcpignqi_10_0
C:\ejcpignqi_11_0
C:\egtv8.fd_1_0
C:\ehdfk.eps_0_0_0
C:\ehdfk.eps_1_0_0
C:\eftlupq.joj_85
C:\eftlupq.joj_86
C:\eftlupq.joj_87
C:\eftlupq.joj_82
C:\eftlupq.joj_83
C:\eftlupq.joj_84
C:\eftlupq.joj_88
C:\eftlupq.joj_91
C:\eftlupq.joj_92
C:\eftlupq.joj_93
C:\eftlupq.joj_89
C:\eftlupq.joj_9
C:\eftlupq.joj_90
C:\eftlupq.joj_26
C:\eftlupq.joj_27
C:\eftlupq.joj_28
C:\eftlupq.joj_23
C:\eftlupq.joj_24
C:\eftlupq.joj_25
C:\eftlupq.joj_29
C:\eftlupq.joj_32
C:\eftlupq.joj_33
C:\eftlupq.joj_34
C:\eftlupq.joj_3
C:\eftlupq.joj_30
C:\eftlupq.joj_31
C:\eftlupq.joj_149
C:\eftlupq.joj_15
C:\eftlupq.joj_16
C:\eftlupq.joj_146
C:\eftlupq.joj_147
C:\eftlupq.joj_148
C:\eftlupq.joj_17
C:\eftlupq.joj_20
C:\eftlupq.joj_21
C:\eftlupq.joj_22
C:\eftlupq.joj_18
C:\eftlupq.joj_19
C:\eftlupq.joj_2
C:\eftlupq.joj_5
C:\eftlupq.joj_50
C:\eftlupq.joj_51
C:\eftlupq.joj_47
C:\eftlupq.joj_48
C:\eftlupq.joj_49
C:\eftlupq.joj_52
C:\eftlupq.joj_56
C:\eftlupq.joj_57
C:\eftlupq.joj_58
C:\eftlupq.joj_53
C:\eftlupq.joj_54
C:\eftlupq.joj_55
C:\eftlupq.joj_38
C:\eftlupq.joj_39
C:\eftlupq.joj_4
C:\eftlupq.joj_35
C:\eftlupq.joj_36
C:\eftlupq.joj_37
C:\eftlupq.joj_40
C:\eftlupq.joj_44
C:\eftlupq.joj_45
C:\eftlupq.joj_46
C:\eftlupq.joj_41
C:\eftlupq.joj_42
C:\eftlupq.joj_43
C:\ftox2.nke_1_0
C:\ftox2.uuv_0_0
C:\ftox2.uuv_1_0
C:\ftkr.dor_0_0
C:\ftkr.dor_1_0
C:\ftox2.nke_0_0
C:\ftyvup32.nqi_0_0
C:\FuqEoh.img_0
C:\FuqEoh.moh_0
C:\FuqRvt.img_0
C:\ftyvup32.nqi_1_0
C:\FuqCnet.uyu_0
C:\FuqCnet_svt.uyu_0
C:\Fsffdfmm.mol_1
C:\fssoqevow-2011-11-10.nwsr_0_0_0_0
C:\fssoqevow-2011-11-10.nwsr_1_0_0_0
C:\Fsff Hpunbjm.vsm_0
C:\Fsff Hpunbjm.vsm_1
C:\Fsffdfmm.mol_0
C:\fssoqevow.lxqp_0_0_0_0
C:\ftfbsdi_efcvh.cbu_0
C:\Ftgg Hqvockn.wtn_0_0
C:\Ftgg Hqvockn.wtn_1_0
C:\fssoqevow.lxqp_1_0_0_0
C:\fssx.mrm_0_0_0_0
C:\ftfbsdi.emm_0
C:\fwhqnyj_jsl.qsl_0_0_0_0_0
C:\fwhqnyj_wzx.mqk_0_0_0_0_0
C:\fwhqnyj_wzx.qsl_0_0_0_0_0
C:\fwhqnyj.iqq_0_0_0_0_0
C:\fwhqnyj.rfu_0_0_0_0_0
C:\fwhqnyj_jsl.mqk_0_0_0_0_0
C:\fxywtsfzy.gru_0_0_0_0_0
C:\fydfm.ymt_2
C:\fydfm.ymt_3
C:\fydfm4.ymt_0
C:\fxywtsfzy.gru_1_0_0_0_0
C:\fydfm.ymt_0
C:\fydfm.ymt_1
C:\fvrhpsk.feo_2_0_0_0
C:\fvrhpsk.feo_3_0_0_0
C:\fvrhpsk.xbx_0_0_0_0
C:\FuqRvt.moh_0
C:\fvrhpsk.feo_0_0_0_0
C:\fvrhpsk.feo_1_0_0_0
C:\fvrhpsk.xbx_1_0_0_0
C:\FvrRwu.npi_0_0
C:\fwem.dor_0_0
C:\fwem.dor_1_0
C:\fvrhpsk.xbx_2_0_0_0
C:\fvrhpsk.xbx_3_0_0_0
C:\FvrRwu.jnh_0_0
C:\fpego_jvsq_Mcshsz.vik_1_0_0_0
C:\fpego_jvsq_nypc.vik_0_0_0_0
C:\fpego_jvsq_nypc.vik_1_0_0_0
C:\fpego_jvsq_Fsreviz.vik_0_0_0_0
C:\fpego_jvsq_Fsreviz.vik_1_0_0_0
C:\fpego_jvsq_Mcshsz.vik_0_0_0_0
C:\fpego_widep.lvh_0_0_0_0
C:\FpouCbdif3.0.0.0.ebu_0
C:\FpouCbdif3.0.0.0.ebu_1
C:\fpyi.lvh_0_0_0_0
C:\Fpmefst.ecy_0
C:\Fpmefst.ecy_1
C:\fpnkmg.jtf_0_0
C:\for_0z27e_0z20000_0_0
C:\for_0z27e_0z30000_0_0
C:\for_0z5e_0z10000_0_0
C:\for_0z278_0z20000_0_0
C:\for_0z278_0z30000_0_0
C:\for_0z27e_0z10000_0_0
C:\for_0z5e_0z20000_0_0
C:\for_0z88_0z30000_0_0
C:\fpego.lvh_0_0_0_0
C:\fpego_ec.lvh_0_0_0_0
C:\for_0z5e_0z30000_0_0
C:\for_0z88_0z10000_0_0
C:\for_0z88_0z20000_0_0
C:\froruhu.hqw.kuf_0_0_0
C:\froruhu.koi_0_0_0
C:\froruhu.oqj_0_0_0
C:\froruhh.koi_0_0_0
C:\froruhh.oqj_0_0_0
C:\froruhu.goo_0_0_0
C:\frpprq.mdu_0_0_0
C:\frqwhqw-suhiv.vtolwh_1_0_0
C:\frrnlhv.vtolwh_0_0_0
C:\frrnlhv.vtolwh_1_0_0
C:\frpsdwlelolwb.lql_0_0_0
C:\frpsdwlelolwb.lql_1_0_0
C:\frqwhqw-suhiv.vtolwh_0_0_0
C:\fqi.dor_1_0
C:\Fqnfgtu.fdz_0_0
C:\Fqnfgtu.fdz_1_0
C:\fp_nkmg.tgi_0_0
C:\fp_nkmg.tgi_1_0
C:\fqi.dor_0_0
C:\FqpvCcejg3.0.0.0.fcv_0_0
C:\frnuwt.xfr_1_0_0_0_0
C:\frnuwt.xfr_2_0_0_0_0
C:\frnuwt.xfr_3_0_0_0_0
C:\fqypnqcfu.usnkvg_0_0
C:\fqypnqcfu.usnkvg_1_0
C:\frnuwt.xfr_0_0_0_0_0
C:\fydfm4.ymt_1
C:\ghvnwrs.lql_123_0_0
C:\ghvnwrs.lql_124_0_0
C:\ghvnwrs.lql_125_0_0
C:\ghvnwrs.lql_120_0_0
C:\ghvnwrs.lql_121_0_0
C:\ghvnwrs.lql_122_0_0
C:\ghvnwrs.lql_126_0_0
C:\ghvnwrs.lql_12_0_0
C:\ghvnwrs.lql_130_0_0
C:\ghvnwrs.lql_131_0_0
C:\ghvnwrs.lql_127_0_0
C:\ghvnwrs.lql_128_0_0
C:\ghvnwrs.lql_129_0_0
C:\ghvnwrs.lql_111_0_0
C:\ghvnwrs.lql_112_0_0
C:\ghvnwrs.lql_113_0_0
C:\ghvnwrs.lql_109_0_0
C:\ghvnwrs.lql_10_0_0
C:\ghvnwrs.lql_110_0_0
C:\ghvnwrs.lql_114_0_0
C:\ghvnwrs.lql_118_0_0
C:\ghvnwrs.lql_119_0_0
C:\ghvnwrs.lql_11_0_0
C:\ghvnwrs.lql_115_0_0
C:\ghvnwrs.lql_116_0_0
C:\ghvnwrs.lql_117_0_0
C:\ghvnwrs.lql_147_0_0
C:\ghvnwrs.lql_148_0_0
C:\ghvnwrs.lql_149_0_0
C:\ghvnwrs.lql_144_0_0
C:\ghvnwrs.lql_145_0_0
C:\ghvnwrs.lql_146_0_0
C:\ghvnwrs.lql_14_0_0
C:\ghvnwrs.lql_18_0_0
C:\ghvnwrs.lql_19_0_0
C:\ghvnwrs.lql_1_0_0
C:\ghvnwrs.lql_15_0_0
C:\ghvnwrs.lql_16_0_0
C:\ghvnwrs.lql_17_0_0
C:\ghvnwrs.lql_135_0_0
C:\ghvnwrs.lql_136_0_0
C:\ghvnwrs.lql_137_0_0
C:\ghvnwrs.lql_132_0_0
C:\ghvnwrs.lql_133_0_0
C:\ghvnwrs.lql_134_0_0
C:\ghvnwrs.lql_138_0_0
C:\ghvnwrs.lql_141_0_0
C:\ghvnwrs.lql_142_0_0
C:\ghvnwrs.lql_143_0_0
C:\ghvnwrs.lql_139_0_0
C:\ghvnwrs.lql_13_0_0
C:\ghvnwrs.lql_140_0_0
C:\gbs7a.sfh_0
C:\gbs7a.uyu_0
C:\gbsdpmps.iqq_0
C:\g662jk49.jcj_1_0_0_0_0
C:\gazu.pgx_0_0_0_0_0_0
C:\gbs.nbq_0
C:\gbslfzt.iqq_0
C:\gev.fqt_0_0_0_0
C:\gev.fqt_1_0_0_0
C:\gex.fqt_0_0_0_0
C:\gbsuzqft.isd_0
C:\GDIPFONTCACHEV1.DAT_0
C:\GDIPFONTCACHEV1.DAT_1
C:\fyufotjpot.joj_0
C:\fyufotjpot.joj_1
C:\fyufotjpot.trmjuf_0
C:\fydfm4.ymt_2
C:\fydfm4.ymt_3
C:\fyqpsu_dpmpst.cbu_0
C:\fyufotjpot.trmjuf_1
C:\g42ff0f3858d58ge2ge37658219h6400_23hi5514-3059-436i-d4d7-4fhidde20he1_0_0_0
C:\g42ff0f3858d58ge2ge37658219h6400_23hi5514-3059-436i-d4d7-4fhidde20he1_1_0_0
C:\g662jk49.jcj_0_0_0_0_0
C:\fyxxivjpc.fqt_0_0_0_0
C:\fyxxivjpc.fqt_1_0_0_0
C:\fzyt.ofw_0_0_0_0_0
C:\ghvnwrs.lql_0_0_0
C:\ghvnwrs.lql_100_0_0
C:\ghvnwrs.lql_101_0_0
C:\gho.edw_0_0_0
C:\gho.edw_1_0_0
C:\ghpdqjoh32.goo_0_0_0
C:\ghvnwrs.lql_102_0_0
C:\ghvnwrs.lql_106_0_0
C:\ghvnwrs.lql_107_0_0
C:\ghvnwrs.lql_108_0_0
C:\ghvnwrs.lql_103_0_0
C:\ghvnwrs.lql_104_0_0
C:\ghvnwrs.lql_105_0_0
C:\gexepsk-xibx.bqp_0_0_0_0
C:\gexepsk.bqp_0_0_0_0
C:\gfqq.gru_0_0_0_0_0
C:\gex.fqt_1_0_0_0
C:\gexepsk-gsrwspi.bqp_0_0_0_0
C:\gexepsk-vkf.bqp_0_0_0_0
C:\gfqq.gru_1_0_0_0_0
C:\ggho.edw_3_0_0
C:\ggwup.lvg_0_0_0_0
C:\ghidxow.kug_0_0_0
C:\ggho.edw_0_0_0
C:\ggho.edw_1_0_0
C:\ggho.edw_2_0_0
C:\for_0z278_0z10000_0_0
C:\fgumvqr.kpk_25_0
C:\fgumvqr.kpk_26_0
C:\fgumvqr.kpk_27_0
C:\fgumvqr.kpk_22_0
C:\fgumvqr.kpk_23_0
C:\fgumvqr.kpk_24_0
C:\fgumvqr.kpk_28_0
C:\fgumvqr.kpk_31_0
C:\fgumvqr.kpk_32_0
C:\fgumvqr.kpk_33_0
C:\fgumvqr.kpk_29_0
C:\fgumvqr.kpk_2_0
C:\fgumvqr.kpk_30_0
C:\fgumvqr.kpk_149_0
C:\fgumvqr.kpk_14_0
C:\fgumvqr.kpk_15_0
C:\fgumvqr.kpk_146_0
C:\fgumvqr.kpk_147_0
C:\fgumvqr.kpk_148_0
C:\fgumvqr.kpk_16_0
C:\fgumvqr.kpk_1_0
C:\fgumvqr.kpk_20_0
C:\fgumvqr.kpk_21_0
C:\fgumvqr.kpk_17_0
C:\fgumvqr.kpk_18_0
C:\fgumvqr.kpk_19_0
C:\fgumvqr.kpk_49_0
C:\fgumvqr.kpk_4_0
C:\fgumvqr.kpk_50_0
C:\fgumvqr.kpk_46_0
C:\fgumvqr.kpk_47_0
C:\fgumvqr.kpk_48_0
C:\fgumvqr.kpk_51_0
C:\fgumvqr.kpk_55_0
C:\fgumvqr.kpk_56_0
C:\fgumvqr.kpk_57_0
C:\fgumvqr.kpk_52_0
C:\fgumvqr.kpk_53_0
C:\fgumvqr.kpk_54_0
C:\fgumvqr.kpk_37_0
C:\fgumvqr.kpk_38_0
C:\fgumvqr.kpk_39_0
C:\fgumvqr.kpk_34_0
C:\fgumvqr.kpk_35_0
C:\fgumvqr.kpk_36_0
C:\fgumvqr.kpk_3_0
C:\fgumvqr.kpk_43_0
C:\fgumvqr.kpk_44_0
C:\fgumvqr.kpk_45_0
C:\fgumvqr.kpk_40_0
C:\fgumvqr.kpk_41_0
C:\fgumvqr.kpk_42_0
C:\fgumvqr.kpk_113_0
C:\fgumvqr.kpk_114_0
C:\fgumvqr.kpk_115_0
C:\fgumvqr.kpk_110_0
C:\fgumvqr.kpk_111_0
C:\fgumvqr.kpk_112_0
C:\fgumvqr.kpk_116_0
C:\fgumvqr.kpk_11_0
C:\fgumvqr.kpk_120_0
C:\fgumvqr.kpk_121_0
C:\fgumvqr.kpk_117_0
C:\fgumvqr.kpk_118_0
C:\fgumvqr.kpk_119_0
C:\fgumvqr.kpk_101_0
C:\fgumvqr.kpk_102_0
C:\fgumvqr.kpk_103_0
C:\fgocping32.fnn_0_0
C:\fgumvqr.kpk_0_0
C:\fgumvqr.kpk_100_0
C:\fgumvqr.kpk_104_0
C:\fgumvqr.kpk_108_0
C:\fgumvqr.kpk_109_0
C:\fgumvqr.kpk_10_0
C:\fgumvqr.kpk_105_0
C:\fgumvqr.kpk_106_0
C:\fgumvqr.kpk_107_0
C:\fgumvqr.kpk_137_0
C:\fgumvqr.kpk_138_0
C:\fgumvqr.kpk_139_0
C:\fgumvqr.kpk_134_0
C:\fgumvqr.kpk_135_0
C:\fgumvqr.kpk_136_0
C:\fgumvqr.kpk_13_0
C:\fgumvqr.kpk_143_0
C:\fgumvqr.kpk_144_0
C:\fgumvqr.kpk_145_0
C:\fgumvqr.kpk_140_0
C:\fgumvqr.kpk_141_0
C:\fgumvqr.kpk_142_0
C:\fgumvqr.kpk_125_0
C:\fgumvqr.kpk_126_0
C:\fgumvqr.kpk_127_0
C:\fgumvqr.kpk_122_0
C:\fgumvqr.kpk_123_0
C:\fgumvqr.kpk_124_0
C:\fgumvqr.kpk_128_0
C:\fgumvqr.kpk_131_0
C:\fgumvqr.kpk_132_0
C:\fgumvqr.kpk_133_0
C:\fgumvqr.kpk_129_0
C:\fgumvqr.kpk_12_0
C:\fgumvqr.kpk_130_0
C:\fgumvqr.kpk_58_0
C:\fkdqjhorj_4_0_0
C:\fkdqjhorj_5_0_0
C:\fkdqjhorj_6_0_0
C:\fkdqjhorj_1_0_0
C:\fkdqjhorj_2_0_0
C:\fkdqjhorj_3_0_0
C:\fkdqjhorj_7_0_0
C:\fkdqjhorj_hqj_1_0_0
C:\fkdqjhv.waw_0_0_0
C:\fkhvv.eps_0_0_0
C:\fkdqjhorj_8_0_0
C:\fkdqjhorj_9_0_0
C:\fkdqjhorj_hqj_0_0_0
C:\Fjmf_je.eja_1
C:\fkdqjhorj_0_0_0
C:\fkdqjhorj_10_0_0
C:\Fjmft boe Sfuujoht Tsbotgfs Wjabse.mol_0
C:\Fjmft boe Sfuujoht Tsbotgfs Wjabse.mol_1
C:\Fjmf_je.eja_0
C:\fkdqjhorj_11_0_0
C:\fkdqjhorj_15_0_0
C:\fkdqjhorj_16_0_0
C:\fkdqjhorj_17_0_0
C:\fkdqjhorj_12_0_0
C:\fkdqjhorj_13_0_0
C:\fkdqjhorj_14_0_0
C:\for_0z124_0z10000_0_0
C:\for_0z124_0z20000_0_0
C:\for_0z124_0z30000_0_0
C:\fnwuqfsj.gru_0_0_0_0_0
C:\fnwuqfsj.gru_1_0_0_0_0
C:\fodvvlf.kug_0_0_0
C:\for_0z130_0z10000_0_0
C:\for_0z238_0z20000_0_0
C:\for_0z260_0z10000_0_0
C:\for_0z260_0z20000_0_0
C:\for_0z130_0z20000_0_0
C:\for_0z130_0z30000_0_0
C:\for_0z238_0z10000_0_0
C:\Fkngu cpf Sgvvkpiu Ttcpuhgt Wkbctf.npm_0_0
C:\Fkngu cpf Sgvvkpiu Ttcpuhgt Wkbctf.npm_1_0
C:\Fkng_kf.fkb_0_0
C:\fkhvv.eps_1_0_0
C:\FkngCcug.fnn_0_0
C:\FkngCcug.ocr_0_0
C:\Fkng_kf.fkb_1_0
C:\fkumu.twu.vgor_0_0
C:\fkurphdssvvwruh.vtolwh_0_0_0
C:\fkurphdssvvwruh.vtolwh_1_0_0
C:\fktv dkmg.dor_0_0
C:\fktv dkmg.dor_1_0
C:\fkumu.gpi.vgor_0_0
C:\fgumvqr.kpk_73_0
C:\fgumvqr.kpk_74_0
C:\fgumvqr.kpk_75_0
C:\fgumvqr.kpk_70_0
C:\fgumvqr.kpk_71_0
C:\fgumvqr.kpk_72_0
C:\fgumvqr.kpk_76_0
C:\fgumvqr.kpk_7_0
C:\fgumvqr.kpk_80_0
C:\fgumvqr.kpk_81_0
C:\fgumvqr.kpk_77_0
C:\fgumvqr.kpk_78_0
C:\fgumvqr.kpk_79_0
C:\fgumvqr.kpk_61_0
C:\fgumvqr.kpk_62_0
C:\fgumvqr.kpk_63_0
C:\fgumvqr.kpk_59_0
C:\fgumvqr.kpk_5_0
C:\fgumvqr.kpk_60_0
C:\fgumvqr.kpk_64_0
C:\fgumvqr.kpk_68_0
C:\fgumvqr.kpk_69_0
C:\fgumvqr.kpk_6_0
C:\fgumvqr.kpk_65_0
C:\fgumvqr.kpk_66_0
C:\fgumvqr.kpk_67_0
C:\fgumvqr.kpk_97_0
C:\fgumvqr.kpk_98_0
C:\fgumvqr.kpk_99_0
C:\fgumvqr.kpk_94_0
C:\fgumvqr.kpk_95_0
C:\fgumvqr.kpk_96_0
C:\fgumvqr.kpk_9_0
C:\fiegl.fqt_1_0_0_0
C:\FjmfCbtf.emm_0
C:\FjmfCbtf.nbq_0
C:\fhuw8.ge_0_0_0
C:\fhuw8.ge_1_0_0
C:\fiegl.fqt_0_0_0_0
C:\fgumvqr.kpk_85_0
C:\fgumvqr.kpk_86_0
C:\fgumvqr.kpk_87_0
C:\fgumvqr.kpk_82_0
C:\fgumvqr.kpk_83_0
C:\fgumvqr.kpk_84_0
C:\fgumvqr.kpk_88_0
C:\fgumvqr.kpk_91_0
C:\fgumvqr.kpk_92_0
C:\fgumvqr.kpk_93_0
C:\fgumvqr.kpk_89_0
C:\fgumvqr.kpk_8_0
C:\fgumvqr.kpk_90_0
C:\dtpfnqi.dcm_1_0
C:\Panel.JumpToSelectedFile.reg
C:\Panel.Lynx-mot.reg
C:\Panel.MouseWheelTilt.reg
C:\Panel.CtrlShiftPgUpDn.reg
C:\Panel.Del.reg
C:\Panel.Esc.reg
C:\Panel.Numpad.reg
C:\ShiftF1.reg
C:\ShiftTab.reg
C:\View.CtrlUpDown.reg
C:\Panel.SelectFromClipboard.reg
C:\Panel.SpaceToSelect.reg
C:\ShiftBS.reg
C:\MacroConsts.reg
C:\OpeningLastFile.reg
C:\Panel.AltBS.reg
C:\F3.reg
C:\F9DeactivateMenu.reg
C:\F9Table.reg
C:\Panel.Apps.reg
C:\Panel.CtrlQ.reg
C:\Panel.CtrlRight.reg
C:\Panel.CtrlShiftBackSlash.reg
C:\Panel.BS.reg
C:\Panel.CtrlIns...reg
C:\Panel.CtrlLeft.reg
C:\Bug.Report.txt
C:\Far.FAQ.txt
C:\Plugins.Install.txt
C:\CtrlShiftX.reg
C:\Qwerty.reg
C:\Arc.Support.txt
C:\Plugins.Review.txt
C:\ExcDump.dll
C:\FExcept.dll
C:\SetFarExceptionHandler.reg
C:\TechInfo.txt
C:\FarEncyclopedia.ru.chm
C:\demangle32.dll
C:\View.Space.reg
C:\WheelScreenSwitch.reg
C:\Default165.reg
C:\View.NextPrevFile.reg
C:\View.PgDn.reg
C:\View.ShiftInsSearch.reg
C:\Executor.4NT.reg
C:\AltR.reg
C:\Apps.reg
C:\CtrlR.reg
C:\Executor.CMD.reg
%WINDIR%GUI.reg
C:\FARHere.inf
C:\FarHun.hlf
C:\FarHun.lng
C:\FarPol.lng
C:\FarEng.hlf
C:\FarEng.lng
C:\FarGer.lng
C:\FarRus.hlf
C:\RestoreSettings.cmd
C:\SaveSettings.cmd
C:\Descript.ion
C:\FarRus.lng
C:\FarSpa.lng
C:\File_id.diz
C:\Internet Explorer.lnk
C:\Outlook Express.lnk
C:\Address Book.lnk
C:\xxscsi.lnk
C:\xxx_svga.lnk
C:\Far.lnk
C:\Shortcut to startup_local.lnk
C:\Far.exe
C:\far.map
C:\FarCze.lng
C:\changelog
C:\changelog_eng
C:\ClearPluginsCache.cmd
C:\AltMenu.reg
C:\AltScreens.reg
C:\AltSearch.reg
C:\nc5pal2.reg
C:\Rodion_Doroshkevich.reg
C:\VaxColors.reg
C:\AltX.reg
C:\Edit.Notepad.reg
C:\Edit.SaveAndExit.reg
C:\Edit.SaveFile.reg
C:\CtrlDel.reg
C:\CtrlF10.reg
C:\Dialog.AltDown.reg
C:\black_from_Fonarev.reg
C:\black_from_july.reg
C:\black_from_Myodov.reg
C:\README.TXT
C:\export_colors.bat
C:\import_colors.bat
C:\Colors_from_admin_essp_ru.reg
C:\FARColors242.reg
C:\GreenMile.reg
C:\hell.reg
C:\Colors_from_Gernichenko.reg
C:\Colors_from_Sadovoj.reg
C:\dn_like.reg
C:\7-ZipEng.hlf
C:\dnlike.hrd
C:\gray.hrd
C:\hack.hrd
C:\black.hrd
C:\blue.hrd
C:\default.hrd
C:\mirror.hrd
C:\black_ay.hrd
C:\black_sezal.hrd
C:\classic.hrd
C:\nc.hrd
C:\white.hrd
C:\xmastree.hrd
C:\gen.hrc
C:\gen.j2ee.hrc
C:\litestep.hrc
C:\proto.hrc
C:\ccsql.hrc
C:\fartypes.hrc
C:\qrm.hrc
C:\catalog-console.xml
C:\catalog-rgb.xml
C:\catalog-text.xml
C:\rare-scripts.hrc
C:\vim.hrc
C:\auto.jar
C:\ECaseEng.lng
C:\ECaseRus.hlf
C:\ECaseRus.lng
C:\DrawRus.hlf
C:\DrawRus.lng
C:\ECaseEng.hlf
C:\EditCase.dll
C:\EMenuDel.reg
C:\EMenuEng.hlf
C:\EMenuEng.lng
C:\EditCase.map
C:\EMenu.dll
C:\EMenu.map
C:\CmpEng.hlf
C:\CmpRus.hlf
C:\Compare.dll
C:\cyberpunk.hrd
C:\gray_pult.hrd
C:\ocean.hrd
C:\Compare.map
C:\DrawEng.lng
C:\DrawLine.dll
C:\DrawLine.map
C:\CompEng.lng
C:\CompRus.lng
C:\DrawEng.hlf
C:\7zS2con.sfx
C:\7zSD.sfx
C:\arclite.dll
C:\7z.sfx
C:\7zCon.sfx
C:\7zS2.sfx
C:\arclite.map
C:\arclite_rus.lng
C:\AutoWrap.dll
C:\AutoWrap.map
C:\arclite_eng.hlf
C:\arclite_eng.lng
C:\arclite_rus.hlf
C:\7-ZipRus.hlf
C:\7-ZipRus.lng
C:\7z.dll
C:\7-ZipEng.lng
C:\7-ZipFar.dll
C:\7-ZipFar64.dll
C:\7zToFar.ini
C:\Align.map
C:\AlignEng.lng
C:\AlignRus.lng
C:\far7z.reg
C:\far7z.txt
C:\Align.dll
C:\colorer.dll
C:\colorer.hlf
C:\colorer.lng
C:\README
C:\coloree.hlf
C:\coloree.lng
C:\shortcuts.reg
C:\ini.ent.hrc
C:\msg.ent.hrc
C:\php-prot.ent.hrc
C:\changes.txt
C:\colorer.ent.hrc
C:\common.jar
C:\BrackEng.hlf
C:\BrackEng.lng
C:\BrackEng.reg
C:\WrapEng.lng
C:\WrapRus.lng
C:\BrackDel.reg
C:\Brackets.dll
C:\BrackRus.reg
C:\catalog.xml
C:\LICENSE
C:\Brackets.map
C:\BrackRus.hlf
C:\BrackRus.lng
C:\vm_shara on '.hostShared Folders' (Z).lnk
%WINDIR% Messenger.lnk
%WINDIR% Movie Maker.lnk
C:\Calculator.lnk
%WINDIR% Catalog.lnk
%WINDIR% Update.lnk
C:\MSN.lnk
C:\Paint.lnk
C:\Network Connections.lnk
C:\Network Setup Wizard.lnk
C:\New Connection Wizard.lnk
C:\WordPad.lnk
C:\Accessibility Wizard.lnk
C:\HyperTerminal.lnk
C:\Plylst7.wpl
C:\Plylst8.wpl
C:\Plylst9.wpl
C:\Plylst4.wpl
C:\Plylst5.wpl
C:\Plylst6.wpl
C:\Blue hills.jpg
C:\drmv2.lic
C:\drmv2.sst
C:\Set Program Access and Defaults.lnk
C:\Sunset.jpg
C:\Water lilies.jpg
C:\Winter.jpg
C:\Event Viewer.lnk
C:\Local Security Policy.lnk
C:\Microsoft .NET Framework 1.1 Configuration.lnk
C:\Component Services.lnk
C:\Computer Management.lnk
C:\Data Sources (ODBC).lnk
C:\Microsoft .NET Framework 1.1 Wizards.lnk
C:\Hearts.lnk
C:\Internet Backgammon.lnk
C:\Internet Checkers.lnk
C:\Performance.lnk
C:\Services.lnk
C:\Freecell.lnk
C:\Volume Control.lnk
C:\Backup.lnk
C:\Character Map.lnk
C:\Remote Desktop Connection.lnk
C:\Wireless Network Setup Wizard.lnk
C:\Sound Recorder.lnk
C:\Disk Cleanup.lnk
C:\Security Center.lnk
C:\System Information.lnk
C:\System Restore.lnk
C:\Disk Defragmenter.lnk
C:\Files and Settings Transfer Wizard.lnk
C:\Scheduled Tasks.lnk
C:\guest.bmp
C:\%USERNAME%.bmp
C:\airplane.bmp
C:\DefaultStore_59R.bin
C:\UserMigratedStore_59R.bin
C:\sharedaccess.ini
C:\astronaut.bmp
C:\car.bmp
C:\cat.bmp
C:\chess.bmp
C:\ball.bmp
C:\beach.bmp
C:\butterfly.bmp
<Current directory>\del.bat
<Current directory>\ddel.bat
C:\<Virus name>.exe
<Current directory>\jedata.dll
<Current directory>\Ж¤·ф.she
<SYSTEM32>\Aver.ico
C:\ddel.bat
C:\d42cc0c3858a58db2db37658219e6400_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\drwtsn32.log
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\2675456989[1]
C:\jedata.dll
C:\Ж¤·ф.she
C:\desktop.ini
C:\New Stories (Highway Blues).wma
C:\Plylst1.wpl
C:\Plylst10.wpl
C:\skater.bmp
C:\snowflake.bmp
C:\Beethoven's Symphony No. 9 (Scherzo).wma
C:\Plylst11.wpl
C:\Plylst15.wpl
C:\Plylst2.wpl
C:\Plylst3.wpl
C:\Plylst12.wpl
C:\Plylst13.wpl
C:\Plylst14.wpl
C:\duck.bmp
C:\fish.bmp
C:\frog.bmp
C:\dirt bike.bmp
C:\dog.bmp
C:\drip.bmp
C:\guitar.bmp
C:\palm tree.bmp
C:\pink flower.bmp
C:\red flower.bmp
C:\horses.bmp
C:\kick.bmp
C:\lift-off.bmp
C:\Internet Hearts.lnk
C:\sessionstore.bak
C:\sessionstore.js
C:\signons.sqlite
C:\search.json
C:\search.sqlite
C:\secmod.db
C:\webappsstore.sqlite
C:\MSN.com.url
C:\Radio Station Guide.url
C:\Customize Links.url
C:\bookmarks-2011-11-10.json
C:\userChrome-example.css
C:\userContent-example.css
C:\extensions.ini
C:\extensions.sqlite
C:\formhistory.sqlite
C:\content-prefs.sqlite
C:\cookies.sqlite
C:\downloads.sqlite
C:\key3.db
C:\places.sqlite
C:\pluginreg.dat
C:\prefs.js
C:\localstore.rdf
C:\mimeTypes.rdf
C:\permissions.sqlite
C:\startupCache.4.little
C:\hgfs.dat
C:\2675456989[1]
C:\_CACHE_002_
C:\_CACHE_003_
C:\_CACHE_MAP_
C:\Sample Music.lnk
C:\scoopy.lnk
C:\scsi.lnk
C:\video7.0.lnk
C:\Sample Pictures.lnk
C:\DrWebVirtNet.lnk
C:\Local Disk (C).lnk
%WINDIR%.url
C:\GDIPFONTCACHEV1.DAT
C:\IconCache.db
C:\Free Hotmail.url
%WINDIR% Marketplace.url
%WINDIR% Media.url
C:\Folders.dbx
C:\urlclassifier3.sqlite
C:\XUL.mfl
C:\_CACHE_001_
C:\Inbox.dbx
C:\Offline.dbx
C:\Outbox.dbx
C:\Notepad.lnk
C:\Program Compatibility Wizard.lnk
C:\Synchronize.lnk
C:\Remote Assistance.lnk
%WINDIR% Media Player.lnk
C:\Command Prompt.lnk
C:\Tour Windows XP.lnk
C:\On-Screen Keyboard.lnk
C:\Utility Manager.lnk
C:\amipro.sam
%WINDIR% Explorer.lnk
C:\Magnifier.lnk
C:\Narrator.lnk
C:\Pinball.lnk
C:\Solitaire.lnk
C:\Spider Solitaire.lnk
C:\Internet Reversi.lnk
C:\Internet Spades.lnk
C:\Minesweeper.lnk
C:\NTUSER.DAT
C:\CurrentDatabase_59R.wmdb
C:\WMSDKNS.DTD
C:\WMSDKNS.XML
C:\brndlog.bak
C:\brndlog.txt
C:\index.dat
C:\Desktop.htt
C:\Launch Internet Explorer Browser.lnk
C:\Show Desktop.scf
C:\winscp.rnd
C:\%USERNAME%.wab
C:\%USERNAME%.wab~
C:\0007F0B7.wpl
C:\cert8.db
C:\chromeappsstore.sqlite
C:\compatibility.ini
C:\Custom.theme
C:\profiles.ini
C:\bookmarks.html
C:\powerpnt.ppt
C:\presenta.shw
C:\quattro.wb2
C:\excel.xls
C:\excel4.xls
C:\lotus.wk4
C:\sndrec.wav
C:\wordpfct.wpg
C:\ntuser.ini
C:\FontCache3.0.0.0.dat
C:\winword.doc
C:\winword2.doc
C:\wordpfct.wpd
C:\CvssfouDbubcbtf_59R.xnec_1
C:\CvssfouDbubcbtf_59R.xnec_2
C:\CvssfouDbubcbtf_59R.xnec_3
C:\cuvtqpcwv.dor_0_0
C:\cuvtqpcwv.dor_1_0
C:\CvssfouDbubcbtf_59R.xnec_0
C:\Cvtupn.uifnf_0
C:\cvuufsgmz.cnq_0
C:\cvuufsgmz.cnq_1
C:\cwvq.lct_0_0
C:\Cvtupn.uifnf_1
C:\Cvtupnjaf Ljolt.vsm_0
C:\Cvtupnjaf Ljolt.vsm_1
C:\ctenkvg.fnn_0_0
C:\ctenkvg.ocr_0_0
C:\ctenkvg_gpi.jnh_0_0
C:\csoemph.uyu_1
C:\csoemph.uyu_2
C:\csoemph.uyu_3
C:\ctenkvg_gpi.npi_0_0
C:\CusmF10.sfh_0
C:\CusmR.sfh_0
C:\CusmSijguX.sfh_0
C:\ctenkvg_twu.jnh_0_0
C:\ctenkvg_twu.npi_0_0
C:\CusmDfm.sfh_0
C:\ddtrm.isd_0
C:\Dfgbvmu165.sfh_0
C:\DfgbvmuSupsf_59R.cjo_0
C:\DchLph.mph_1
C:\dcnn.dor_0_0
C:\dcnn.dor_1_0
C:\DfgbvmuSupsf_59R.cjo_1
C:\Dftdsjqu.jpo_1
C:\Dftdsjqu.jpo_2
C:\Dftdsjqu.jpo_3
C:\dfsu8.ec_0
C:\dfsu8.ec_1
C:\Dftdsjqu.jpo_0
C:\dbs.cnq_1
C:\dbu.cnq_0
C:\dbu.cnq_1
C:\d662gh49.gzg_0_0
C:\d662gh49.gzg_1_0
C:\dbs.cnq_0
C:\Dbub Spvsdft (ODBC).mol_0
C:\dbubmph-ufyu.ynm_0
C:\dbubmph.ynm_0
C:\DchLph.mph_0
C:\Dbub Spvsdft (ODBC).mol_1
C:\dbubmph-dpotpmf.ynm_0
C:\dbubmph-shc.ynm_0
C:\Cpmpst_gspn_benjo_fttq_sv.sfh_0
C:\Cpmpst_gspn_benjo_fttq_sv.sfh_1
C:\Cpmpst_gspn_Gfsojdifolp.sfh_0
C:\cokrtq.uco_1_0
C:\cokrtq.uco_2_0
C:\cokrtq.uco_3_0
C:\Cpmpst_gspn_Gfsojdifolp.sfh_1
C:\Cpnnboe Pspnqu.mol_1
C:\Cpnnboe Pspnqu.mol_2
C:\Cpnnboe Pspnqu.mol_3
C:\Cpmpst_gspn_Sbepwpk.sfh_0
C:\Cpmpst_gspn_Sbepwpk.sfh_1
C:\Cpnnboe Pspnqu.mol_0
C:\cmbdl_gspn_kvmz.sfh_1
C:\cmbdl_gspn_Mzpepw.sfh_0
C:\cmbdl_gspn_Mzpepw.sfh_1
C:\cmbdl_gspn_Fpobsfw.sfh_0
C:\cmbdl_gspn_Fpobsfw.sfh_1
C:\cmbdl_gspn_kvmz.sfh_0
C:\cmbdl_tfabm.ise_0
C:\CnqEoh.img_0
C:\CnqRvt.img_0
C:\cokrtq.uco_0_0
C:\CmfbsPmvhjotCbdif.dne_0
C:\CmfbsPmvhjotCbdif.dne_1
C:\cmvf.ise_0
C:\Cqnqtu_htqo_Ggtpkejgpmq.tgi_1_0
C:\Cqnqtu_htqo_Scfqxql.tgi_0_0
C:\Cqnqtu_htqo_Scfqxql.tgi_1_0
C:\Cqnqtu_htqo_cfokp_guur_tw.tgi_0_0
C:\Cqnqtu_htqo_cfokp_guur_tw.tgi_1_0
C:\Cqnqtu_htqo_Ggtpkejgpmq.tgi_0_0
C:\CREGEXP.CPP_0
C:\csoemph.cbl_2
C:\csoemph.cbl_3
C:\csoemph.uyu_0
C:\CREGEXP.H_0
C:\csoemph.cbl_0
C:\csoemph.cbl_1
C:\Cpnqpofou Sfswjdft.mol_0
C:\Cpnqpofou Sfswjdft.mol_1
C:\CpnqRvt.moh_0
C:\Cpnqbsf.emm_0
C:\Cpnqbsf.nbq_0
C:\CpnqEoh.moh_0
C:\Cpnqvufs Mbobhfnfou.mol_0
C:\cpplnbslt.iunm_0
C:\cpplnbslt.iunm_1
C:\cppu.joj_0
C:\Cpnqvufs Mbobhfnfou.mol_1
C:\cpplnbslt-2011-11-10.ktpo_0
C:\cpplnbslt-2011-11-10.ktpo_1
C:\Dftdsjqu.jpo_4
C:\dncem_htqo_lwna.tgi_1_0
C:\dncem_htqo_Maqfqx.tgi_0_0
C:\dncem_htqo_Maqfqx.tgi_1_0
C:\dncem_htqo_Fqpctgx.tgi_0_0
C:\dncem_htqo_Fqpctgx.tgi_1_0
C:\dncem_htqo_lwna.tgi_0_0
C:\dncem_ugbcn.jtf_0_0
C:\dplsur.vdp_2_0_0
C:\dplsur.vdp_3_0_0
C:\dpmpsff.img_0
C:\dnwg.jtf_0_0
C:\dplsur.vdp_0_0_0
C:\dplsur.vdp_1_0_0
C:\dmp_0x27c_0x20000
C:\dmp_0x27c_0x30000
C:\dmp_0x5c_0x10000
C:\dmp_0x278_0x20000
C:\dmp_0x278_0x30000
C:\dmp_0x27c_0x10000
C:\dmp_0x5c_0x20000
C:\dmp_0x88_0x30000
C:\dncem.jtf_0_0
C:\dncem_ca.jtf_0_0
C:\dmp_0x5c_0x30000
C:\dmp_0x88_0x10000
C:\dmp_0x88_0x20000
C:\dqqv.kpk_0_0
C:\DsbxEoh.img_0
C:\DsbxEoh.moh_0
C:\dqqmoctmu-2011-11-10.luqp_1_0
C:\dqqmoctmu.jvon_0_0
C:\dqqmoctmu.jvon_1_0
C:\DsbxLjof.emm_0
C:\DsWfcVjsuNfu.mol_0
C:\DsWfcVjsuNfu.mol_1
C:\dtpfnqi.dcm_0_0
C:\DsbxLjof.nbq_0
C:\DsbxRvt.img_0
C:\DsbxRvt.moh_0
C:\dpmpsfs.img_0
C:\dpmpsfs.moh_0
C:\dpnnpo.kbs_0
C:\dpmpsff.moh_0
C:\dpmpsfs.emm_0
C:\dpmpsfs.fou.isd_0
C:\dpnqbujcjmjuz.joj_0
C:\dppljft.trmjuf_0
C:\dppljft.trmjuf_1
C:\dqqmoctmu-2011-11-10.luqp_0_0
C:\dpnqbujcjmjuz.joj_1
C:\dpoufou-qsfgt.trmjuf_0
C:\dpoufou-qsfgt.trmjuf_1
C:\dibohfmph_16
C:\dibohfmph_17
C:\dibohfmph_2
C:\dibohfmph_13
C:\dibohfmph_14
C:\dibohfmph_15
C:\dibohfmph_3
C:\dibohfmph_7
C:\dibohfmph_8
C:\dibohfmph_9
C:\dibohfmph_4
C:\dibohfmph_5
C:\dibohfmph_6
C:\Dftdsjqu.jpo_8
C:\Dftlupq.iuu_0
C:\Dftlupq.iuu_1
C:\Dftdsjqu.jpo_5
C:\Dftdsjqu.jpo_6
C:\Dftdsjqu.jpo_7
C:\dgcej.dor_0_0
C:\dibohfmph_10
C:\dibohfmph_11
C:\dibohfmph_12
C:\dgcej.dor_1_0
C:\dibohfmph_0
C:\dibohfmph_1
C:\dmp_0x124_0x20000
C:\dmp_0x124_0x30000
C:\dmp_0x130_0x10000
C:\dlusodqh.eps_1_0_0
C:\dmbttjd.ise_0
C:\dmp_0x124_0x10000
C:\dmp_0x130_0x20000
C:\dmp_0x260_0x10000
C:\dmp_0x260_0x20000
C:\dmp_0x278_0x10000
C:\dmp_0x130_0x30000
C:\dmp_0x238_0x10000
C:\dmp_0x238_0x20000
C:\diftt.cnq_0
C:\diftt.cnq_1
C:\dispnfbqqttupsf.trmjuf_0
C:\dibohfmph_foh_0
C:\dibohfmph_foh_1
C:\dibohft.uyu_0
C:\dispnfbqqttupsf.trmjuf_1
C:\Djtl Dfgsbhnfoufs.mol_0
C:\Djtl Dfgsbhnfoufs.mol_1
C:\dlusodqh.eps_0_0_0
C:\Djbmph.AmuDpxo.sfh_0
C:\Djtl Cmfbovq.mol_0
C:\Djtl Cmfbovq.mol_1
C:\cmbdl_bz.ise_0
C:\HlfViewerRus.hlf
C:\HlfViewerRus.lng
C:\MacroEng.hlf
C:\HlfViewer.map
C:\HlfViewerEng.hlf
C:\HlfViewerEng.lng
C:\MacroEng.lng
C:\MacroView.map
C:\NetEng.hlf
C:\NetEng.lng
C:\MacroRus.hlf
C:\MacroRus.lng
C:\MacroView.dll
C:\TechInfo_rus.reg
C:\ftpDirList.fll
C:\ftpDirList.map
C:\Notes.txt
C:\Notes_rus.txt
C:\TechInfo.reg
C:\ftpProgress.fll
C:\Progress_Wesha.reg
C:\Progress_ZeMA.reg
C:\HlfViewer.dll
C:\ftpProgress.map
C:\Progress_FarCopy.reg
C:\Progress_JM.reg
C:\TmpEng.hlf
C:\TmpEng.lng
C:\TmpPanel.dll
C:\shortcuts.eng.temp
C:\shortcuts.rus.reg
C:\shortcuts.rus.temp
C:\TmpPanel.map
C:\WinSCP.dll
C:\WinSCP.lng
C:\farcolor.hpp
C:\TmpRus.hlf
C:\TmpRus.lng
C:\licence
C:\Network.map
C:\ProcEng.hlf
C:\ProcEng.lng
C:\NetRus.hlf
C:\NetRus.lng
C:\Network.dll
C:\Proclist.dll
C:\disks.eng.temp
C:\disks.rus.temp
C:\shortcuts.eng.reg
C:\Proclist.map
C:\ProcRus.hlf
C:\ProcRus.lng
C:\ES_RUS.REG
C:\ESEARCH.BAT
C:\esearch_debug.bat
C:\RUS_NEWS.TXT
C:\RUS_READ.TXT
C:\ES_ENG.REG
C:\ExtChCase.cpp
C:\ExtSearch.cpp
C:\ExtSearch.hpp
C:\ExtSearchMix.cpp
C:\ExtClipBoard.cpp
C:\ExtMenu.cpp
C:\ExtRegExp.cpp
C:\HotkeyClipboard.reg
C:\HotkeyProperties.reg
C:\esearch.dll
C:\EMenuRus.hlf
C:\EMenuRus.lng
C:\Hotkey.reg
C:\ES_ENG.HLF
C:\ENG_NEWS.TXT
C:\ENG_READ.TXT
C:\REGEXPS.TXT
C:\ES_ENG.LNG
C:\ES_RUS.HLF
C:\ES_RUS.LNG
C:\FileCase.dll
C:\FileCase.map
C:\FarFtp.dll
C:\CaseEng.lng
C:\CaseRus.hlf
C:\CaseRus.lng
C:\FarFtp.map
C:\FtpEng.lng
C:\FtpRus.hlf
C:\FtpRus.lng
C:\FtpCmds.txt
C:\FtpCmds_rus.txt
C:\FtpEng.hlf
C:\CLOCALE.H
C:\CREGEXP.CPP
C:\CREGEXP.H
C:\ExtSearchReg.cpp
C:\PLUGIN.HPP
C:\CLOCALE.CPP
C:\FARCmds.dll
C:\FARCmdsRus.hlf
C:\FARCmdsRus.lng
C:\CaseEng.hlf
C:\FARCmds.map
C:\FARCmdsEng.hlf
C:\FARCmdsEng.lng
C:\farkeys.hpp
C:\BsbdlRvt.img_0
C:\BsbdlRvt.moh_0
C:\BsbdlRvt.sfh_0
C:\BsbdlEoh.sfh_0
C:\Bsbdlfut.emm_0
C:\Bsbdlfut.nbq_0
C:\bsdmjuf.emm_0
C:\bsdmjuf_svt.img_0
C:\bsdmjuf_svt.moh_0
C:\BtcemDgn.tgi_0_0
C:\bsdmjuf.nbq_0
C:\bsdmjuf_foh.img_0
C:\bsdmjuf_foh.moh_0
C:\bjsqmbof.cnq_1
C:\Bmvf ijmmt.kqh_0
C:\Bmvf ijmmt.kqh_1
C:\Bffuipwfo't Sznqipoz Np. 9 (Sdifsap).xnb_0
C:\Bffuipwfo't Sznqipoz Np. 9 (Sdifsap).xnb_1
C:\bjsqmbof.cnq_0
C:\bnjqsp.tbn_0
C:\BsbdlDfm.sfh_0
C:\BsbdlEoh.img_0
C:\BsbdlEoh.moh_0
C:\bnjqsp.tbn_1
C:\bnjqsp.tbn_2
C:\bnjqsp.tbn_3
C:\CbtfRvt.moh_0
C:\cfbdi.cnq_0
C:\cfbdi.cnq_1
C:\CbtfEoh.img_0
C:\CbtfEoh.moh_0
C:\CbtfRvt.img_0
C:\Cibsbdufs Mbq.mol_0
C:\CLOCALE.CPP_0
C:\CLOCALE.H_0
C:\cmbdl.ise_0
C:\Cibsbdufs Mbq.mol_1
C:\cktrncpg.dor_0_0
C:\cktrncpg.dor_1_0
C:\btuspobvu.cnq_1
C:\Bvh.Rfqpsu.uyu_0
C:\Bvh.Rfqpsu.uyu_1
C:\BtcemEpi.jnh_0_0
C:\BtcemEpi.npi_0_0
C:\btuspobvu.cnq_0
C:\bvup.kbs_0
C:\Cbmdvmbups.mol_1
C:\cbmm.cnq_0
C:\cbmm.cnq_1
C:\c662fg49.fyf_0
C:\c662fg49.fyf_1
C:\Cbmdvmbups.mol_0
C:\7a.tgy_0
C:\7aCpo.tgy_0
C:\7aS2.tgy_0
C:\7-ZjqRvt.moh_0
C:\7a.emm_0
C:\7a.emm_1
C:\7aS2dpo.tgy_0
C:\Addfttjcjmjuz Wjabse.mol_1
C:\Aeesftt Bppl.mol_0
C:\Aeesftt Bppl.mol_1
C:\7aSD.tgy_0
C:\7aTpFbs.joj_0
C:\Addfttjcjmjuz Wjabse.mol_0
C:\0007F0B7.xqm_0
C:\0007F0B7.xqm_1
C:\2675456989[1]_0
C:\FarColorW.pas
C:\FarKeysW.pas
C:\PluginW.pas
C:\2675456989[1]_1
C:\7-ZjqFbs.emm_0
C:\7-ZjqFbs64.emm_0
C:\7-ZjqRvt.img_0
C:\2675456989[1]_2
C:\7-ZjqEoh.img_0
C:\7-ZjqEoh.moh_0
C:\AnvSgctej.tgi_0_0
C:\Aqqt.sfh_0
C:\Asd.Svqqpsu.uyu_0
C:\AnvMgpw.tgi_0_0
C:\AnvR.tgi_0_0
C:\AnvSetggpu.tgi_0_0
C:\Asd.Svqqpsu.uyu_1
C:\Awfs.jdp_1
C:\Bbdlvq.mol_0
C:\Bbdlvq.mol_1
C:\AvupWsbq.emm_0
C:\AvupWsbq.nbq_0
C:\Awfs.jdp_0
C:\AmjhoRvt.moh_0
C:\AmuMfov.sfh_0
C:\AmuR.sfh_0
C:\Amjho.emm_0
C:\Amjho.nbq_0
C:\AmjhoEoh.moh_0
C:\AmuSdsffot.sfh_0
C:\Ankip.ocr_0_0
C:\AnkipEpi.npi_0_0
C:\AnkipRwu.npi_0_0
C:\AmuSfbsdi.sfh_0
C:\AmuX.sfh_0
C:\Ankip.fnn_0_0

Sets the 'hidden' attribute to the following files:

<Current directory>\Ж¤·ф.she
<Current directory>\jedata.dll

Network activity:

Connects to:

'us##.#zone.qq.com':80
'localhost':1037

TCP:

HTTP GET requests:

http://us##.#zone.qq.com/2675456989?pt#########

UDP:

DNS ASK us##.#zone.qq.com

Miscellaneous:

Searches for the following windows:

ClassName: 'BaseBar' WindowName: 'ChanApp'
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: '' WindowName: '360se.exe'
ClassName: 'CSCHiddenWindow' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'OleMainThreadWndClass' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: '' WindowName: 'Microsoft Internet Explorer'
ClassName: 'Progman' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: '' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial