Trojan.Encoder.29920

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'unlock' = '"c:\How To Restore Files.hta"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'searchfiles' = '%WINDIR%\searchfiles.exe'
[<HKLM>\Software\Classes\.HR_R\shell\open\command] '' = '%WINDIR%\SysWow64\mshta.exe "c:\How To Restore Files.hta"'

Infects the following executable files

%CommonProgramFiles(x86)%\microsoft shared\office14\csi.dll id-+hy8i9weivplxplk.hr_r
%ProgramFiles(x86)%\k-lite codec pack\icaros\32-bit\avcodec-ics-56.dll id-+hy8i9weivplxplk.hr_r

Creates the following files on removable media

<Drive name for removable media>:\how to restore files.hta
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\delete.avi

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\taskhost.exe
%WINDIR%\syswow64\vssadmin.exe
%WINDIR%\syswow64\werfault.exe

the following user processes:

iexplore.exe
firefox.exe

Modifies file system

Creates the following files

%WINDIR%\searchfiles.exe
%CommonProgramFiles(x86)%\system\ado\how to restore files.hta
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\how to restore files.hta
%APPDATA%\microsoft\msdn\7.0\how to restore files.hta
%APPDATA%\microsoft\dbgclr\7.1\how to restore files.hta
%APPDATA%\mozilla\firefox\crash reports\how to restore files.hta
%APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\how to restore files.hta
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\how to restore files.hta
C:\totalcmd\language\how to restore files.hta
%APPDATA%\microsoft\office\recent\how to restore files.hta
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\how to restore files.hta
%ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\how to restore files.hta
C:\users\public\pictures\how to restore files.hta
C:\users\public\downloads\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\msinfo\en-us\how to restore files.hta
C:\users\public\documents\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\web server extensions\14\bin\how to restore files.hta
%PROGRAMDATA%\microsoft\crypto\rsa\s-1-5-18\how to restore files.hta
%PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\how to restore files.hta
C:\users\public\libraries\how to restore files.hta
C:\users\all users\mozilla\logs\maintenanceservice-install.log id-+hy8i9weivplxplk.hr_r
C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log id-+hy8i9weivplxplk.hr_r
C:\users\public\videos\how to restore files.hta
C:\users\all users\microsoft\ilscache\imcrcache.xml id-+hy8i9weivplxplk.hr_r
%CommonProgramFiles(x86)%\java\java update\how to restore files.hta
C:\users\all users\microsoft\mf\pending.grl id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft\identitycrl\ppcrlui.dll id-+hy8i9weivplxplk.hr_r
%APPDATA%\microsoft\protect\how to restore files.hta
C:\users\public\music\how to restore files.hta
%APPDATA%\microsoft\mmc\how to restore files.hta
%ProgramFiles%\ashavsrv\how to restore files.hta
%ProgramFiles%\a2upd\how to restore files.hta
%ProgramFiles%\a2guard\how to restore files.hta
%ProgramFiles%\ashdug\how to restore files.hta
%ProgramFiles%\ashenhcd\how to restore files.hta
%ProgramFiles%\ashchest\how to restore files.hta
%ProgramFiles%\about\how to restore files.hta
%ProgramFiles%\a2wizard\how to restore files.hta
%ProgramFiles%\amsn\how to restore files.hta
%ProgramFiles%\a2start\how to restore files.hta
%ProgramFiles%\a2scan\how to restore files.hta
%ProgramFiles%\ashdisp\how to restore files.hta
%ProgramFiles%\ashavast\how to restore files.hta
%ProgramFiles%\ash\how to restore files.hta
%APPDATA%\microsoft\uproof\how to restore files.hta
%ProgramFiles%\alsvc\how to restore files.hta
%ProgramFiles%\aim6\how to restore files.hta
%ProgramFiles%\ahnsd\how to restore files.hta
%ProgramFiles%\admunch\how to restore files.hta
%ProgramFiles%\agb5\how to restore files.hta
%ProgramFiles%\amon\how to restore files.hta
%ProgramFiles%\almon\how to restore files.hta
%PROGRAMDATA%\microsoft\user account pictures\default pictures\how to restore files.hta
%APPDATA%\mozilla\firefox\how to restore files.hta
%ProgramFiles(x86)%\steam\amf\how to restore files.hta
%APPDATA%\microsoft\office\how to restore files.hta
%APPDATA%\microsoft\publisher building blocks\how to restore files.hta
%APPDATA%\microsoft\templates\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\portal\1033\how to restore files.hta
%ProgramFiles(x86)%\windows defender\en-us\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\textconv\wksconv\how to restore files.hta
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh id-+hy8i9weivplxplk.hr_r
C:\users\all users\ntuser.pol id-+hy8i9weivplxplk.hr_r
%ProgramFiles(x86)%\windows sidebar\en-us\how to restore files.hta
%ProgramFiles(x86)%\internet explorer\signup\how to restore files.hta
%CommonProgramFiles(x86)%\system\en-us\how to restore files.hta
C:\users\all users\microsoft\office\documentrepository.ico id-+hy8i9weivplxplk.hr_r
%CommonProgramFiles(x86)%\system\ado\en-us\how to restore files.hta
C:\users\all users\microsoft\office\mysharepoints.ico id-+hy8i9weivplxplk.hr_r
C:\far2\addons\colors\how to restore files.hta
C:\users\all users\microsoft\office\mysite.ico id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft\office\sharepointportalsite.ico id-+hy8i9weivplxplk.hr_r
%TEMP%\how to restore files.hta
%PROGRAMDATA%\microsoft\crypto\keys\how to restore files.hta
%ProgramFiles(x86)%\winamp\system\how to restore files.hta
%ProgramFiles(x86)%\qip 2012\protos\social\how to restore files.hta
%CommonProgramFiles(x86)%\system\msadc\how to restore files.hta
%ProgramFiles(x86)%\steam\config\how to restore files.hta
%APPDATA%\microsoft\internet explorer\quick launch\how to restore files.hta
%ProgramFiles(x86)%\steam\graphics\how to restore files.hta
<LS_APPDATA>low\microsoft\internet explorer\services\how to restore files.hta
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\how to restore files.hta
%PROGRAMDATA%\microsoft\network\downloader\how to restore files.hta
C:\users\all users\microsoft\office\sharepointteamsite.ico id-+hy8i9weivplxplk.hr_r
<LS_APPDATA>\msfree inc\how to restore files.hta
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn id-+hy8i9weivplxplk.hr_r
%CommonProgramFiles(x86)%\microsoft shared\vc\amd64\how to restore files.hta
C:\users\all users\microsoft help\hx.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw id-+hy8i9weivplxplk.hr_r
%CommonProgramFiles(x86)%\microsoft shared\vsta\appinfodocument\how to restore files.hta
C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\hx_1033_mvalidator.hxd id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.dexplore.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw id-+hy8i9weivplxplk.hr_r
%ProgramFiles(x86)%\google\update\1.3.26.9\how to restore files.hta
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw id-+hy8i9weivplxplk.hr_r
%CommonProgramFiles(x86)%\microsoft shared\vba\vba6\how to restore files.hta
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.excel.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.graph.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.groove.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.infopath.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.msouc.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.mspub.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.mstore.14.1033.hxn id-+hy8i9weivplxplk.hr_r
C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd id-+hy8i9weivplxplk.hr_r
%ProgramFiles%\aavshield\how to restore files.hta
%APPDATA%\microsoft\document building blocks\1033\14\how to restore files.hta
%ProgramFiles%\a2service\how to restore files.hta
%ProgramFiles%\aoltbserver\how to restore files.hta
%PROGRAMDATA%\how to restore files.hta
%PROGRAMDATA%\microsoft toolkit\how to restore files.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\vgx\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\portal\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\msinfo\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\vc\how to restore files.hta
C:\users\default\how to restore files.hta
C:\users\public\desktop\how to restore files.hta
C:\users\public\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\vs7debug\how to restore files.hta
%CommonProgramFiles(x86)%\adobe\helpcfg\en_us\how to restore files.hta
%ProgramFiles(x86)%\windows media player\how to restore files.hta
%ProgramFiles(x86)%\windows mail\how to restore files.hta
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\how to restore files.hta
%ProgramFiles(x86)%\k-lite codec pack\icons\how to restore files.hta
%ProgramFiles(x86)%\msbuild\how to restore files.hta
%CommonProgramFiles(x86)%\system\how to restore files.hta
%ProgramFiles(x86)%\windows defender\how to restore files.hta
%ProgramFiles(x86)%\qip 2012\how to restore files.hta
%ProgramFiles(x86)%\opera\how to restore files.hta
%ProgramFiles(x86)%\google\update\how to restore files.hta
<LS_APPDATA>\how to restore files.hta
%PROGRAMDATA%\microsoft\user account pictures\how to restore files.hta
%ProgramFiles(x86)%\k-lite codec pack\info\how to restore files.hta
%ProgramFiles%\ackwin32\how to restore files.hta
%CommonProgramFiles(x86)%\services\how to restore files.hta
%ProgramFiles(x86)%\k-lite codec pack\icaros\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\information retrieval\how to restore files.hta
C:\far2\how to restore files.hta
C:\how to restore files.hta
<Current directory>\how to restore files.hta
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to restore files.hta
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to restore files.hta
%ProgramFiles(x86)%\how to restore files.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\how to restore files.hta
%ProgramFiles(x86)%\internet explorer\how to restore files.hta
%ProgramFiles(x86)%\k-lite codec pack\how to restore files.hta
C:\users\how to restore files.hta
C:\totalcmd\how to restore files.hta
%CommonProgramFiles(x86)%\adobe\arm\1.0\how to restore files.hta
%HOMEPATH%\how to restore files.hta
%ProgramFiles(x86)%\winamp\how to restore files.hta
%ProgramFiles(x86)%\windows portable devices\how to restore files.hta
%ProgramFiles(x86)%\mozilla firefox\how to restore files.hta
%ProgramFiles(x86)%\mozilla thunderbird\how to restore files.hta
%ProgramFiles(x86)%\steam\how to restore files.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\how to restore files.hta
%ProgramFiles(x86)%\microsoft office\office14\how to restore files.hta
%ProgramFiles(x86)%\microsoft office\office14\1033\how to restore files.hta
%ProgramFiles(x86)%\mirc\how to restore files.hta
%ProgramFiles(x86)%\internet explorer\en-us\how to restore files.hta
%ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\msdn\how to restore files.hta
%ProgramFiles(x86)%\mirc\defaults\how to restore files.hta
%CommonProgramFiles(x86)%\steam\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\dao\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\office14\how to restore files.hta
%ProgramFiles(x86)%\microsoft office\office10\how to restore files.hta
%ProgramFiles(x86)%\qip 2012\core\how to restore files.hta
%ProgramFiles(x86)%\k-lite codec pack\filters\how to restore files.hta
%ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\how to restore files.hta
%ProgramFiles(x86)%\k-lite codec pack\tools\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\vsto\how to restore files.hta
%ProgramFiles(x86)%\windows media player\media renderer\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\stationery\how to restore files.hta
%APPDATA%\mirc\how to restore files.hta
%HOMEPATH%\downloads\how to restore files.hta
%APPDATA%\qipguard\how to restore files.hta
%APPDATA%\icq-profile\how to restore files.hta
%APPDATA%\winamp\how to restore files.hta
%PROGRAMDATA%\microsoft\ilscache\how to restore files.hta
%PROGRAMDATA%\microsoft\mf\how to restore files.hta
%APPDATA%\thunderbird\how to restore files.hta
%ProgramFiles(x86)%\opera\assets\how to restore files.hta
%PROGRAMDATA%\microsoft\identitycrl\how to restore files.hta
%ProgramFiles%\a2cmd\how to restore files.hta
%ProgramFiles%\360tray\how to restore files.hta
%ProgramFiles%\ashlogv\how to restore files.hta
%ProgramFiles%\airdefense\how to restore files.hta
%ProgramFiles%\ageofconan\how to restore files.hta
%ProgramFiles%\armorsurf\how to restore files.hta
%ProgramFiles%\armor2net\how to restore files.hta
%ProgramFiles%\a2hijackfree\how to restore files.hta
%ProgramFiles%\anti-trojan\how to restore files.hta
%PROGRAMDATA%\microsoft\office\how to restore files.hta
%ProgramFiles(x86)%\qip 2012\langs\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\office10\how to restore files.hta
C:\far2\addons\how to restore files.hta
%APPDATA%\mra\how to restore files.hta
%HOMEPATH%\desktop\how to restore files.hta
%HOMEPATH%\music\how to restore files.hta
%HOMEPATH%\contacts\how to restore files.hta
%HOMEPATH%\favorites\how to restore files.hta
%HOMEPATH%\documents\how to restore files.hta
<LS_APPDATA>\applicationhistory\how to restore files.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\how to restore files.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\how to restore files.hta
%ProgramFiles(x86)%\windows media player\en-us\how to restore files.hta
%APPDATA%\icqm\how to restore files.hta
%APPDATA%\mail.ru\agent\how to restore files.hta
%APPDATA%\telegram desktop\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\msenv\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\vs7debug\1033\how to restore files.hta
%ProgramFiles(x86)%\opera\29.0.1795.47\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\office14\1033\how to restore files.hta
%ProgramFiles%\how to restore files.hta
%HOMEPATH%\links\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\help\how to restore files.hta
%ProgramFiles(x86)%\k-lite codec pack\icaros\32-bit\how to restore files.hta
%ProgramFiles(x86)%\windows sidebar\how to restore files.hta
%ProgramFiles(x86)%\pidgin\how to restore files.hta
%ProgramFiles(x86)%\windows photo viewer\how to restore files.hta
%CommonProgramFiles(x86)%\px storage engine\how to restore files.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\how to restore files.hta
%APPDATA%\ghisler\how to restore files.hta
%ProgramFiles%\aimpro\how to restore files.hta
%ProgramFiles%\antivirus\how to restore files.hta
%PROGRAMDATA%\microsoft help\how to restore files.hta

Moves the following files

from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini id-+hy8i9weivplxplk.hr_r
from %TEMP%\dotnetfxsdk.log to %TEMP%\dotnetfxsdk.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\dotnetfx.log to %TEMP%\dotnetfx.log id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\aacdec.w5s to %ProgramFiles(x86)%\winamp\system\aacdec.w5s id-+hy8i9weivplxplk.hr_r
from %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt to %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt id-+hy8i9weivplxplk.hr_r
from %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt to %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt id-+hy8i9weivplxplk.hr_r
from %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\dd_vcredist_x86_20151216210157.log to %TEMP%\dd_vcredist_x86_20151216210157.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\dd_vcredist_amd64_20151216210341.log to %TEMP%\dd_vcredist_amd64_20151216210341.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt id-+hy8i9weivplxplk.hr_r
from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt id-+hy8i9weivplxplk.hr_r
from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\aspnetsetup.log to %TEMP%\aspnetsetup.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\adobearm_notlocked.log to %TEMP%\adobearm_notlocked.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\adobearm.log to %TEMP%\adobearm.log id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\unins000.exe to %ProgramFiles(x86)%\qip 2012\unins000.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\unins000.dat id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\internet explorer\signup\install.ins to %ProgramFiles(x86)%\internet explorer\signup\install.ins id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_en-gb.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_en-gb.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_el.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_el.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_de.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_de.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_da.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_da.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_cs.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_cs.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_ca.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_ca.dll id-+hy8i9weivplxplk.hr_r
from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\natives_blob.bin to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\natives_blob.bin id-+hy8i9weivplxplk.hr_r
from %TEMP%\jusched.log to %TEMP%\jusched.log id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\jpeg.w5s to %ProgramFiles(x86)%\winamp\system\jpeg.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\jnetlib.w5s to %ProgramFiles(x86)%\winamp\system\jnetlib.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\h264.wbm to %ProgramFiles(x86)%\winamp\system\h264.wbm id-+hy8i9weivplxplk.hr_r
from %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215.html to %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215.html id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\h264.w5s to %ProgramFiles(x86)%\winamp\system\h264.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\gracenote.w5s to %ProgramFiles(x86)%\winamp\system\gracenote.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\gif.w5s to %ProgramFiles(x86)%\winamp\system\gif.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\filereader.w5s to %ProgramFiles(x86)%\winamp\system\filereader.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\f263.wbm to %ProgramFiles(x86)%\winamp\system\f263.wbm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\f263.w5s to %ProgramFiles(x86)%\winamp\system\f263.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\dlmgr.w5s to %ProgramFiles(x86)%\winamp\system\dlmgr.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\devices.w5s to %ProgramFiles(x86)%\winamp\system\devices.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\bmp.w5s to %ProgramFiles(x86)%\winamp\system\bmp.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\protos\social\social_uk.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_uk.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_bn.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_bn.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\protos\social\social.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\protos\social\social_pt.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_pt.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\protos\social\social_kk.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_kk.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\protos\social\social_fr.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_fr.dll id-+hy8i9weivplxplk.hr_r
from %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt to %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\auth.w5s to %ProgramFiles(x86)%\winamp\system\auth.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\protos\social\social_es.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_es.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\protos\social\social_de.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_de.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\albumart.w5s to %ProgramFiles(x86)%\winamp\system\albumart.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\alac.wbm to %ProgramFiles(x86)%\winamp\system\alac.wbm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\protos\social\social_cz.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_cz.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\alac.w5s to %ProgramFiles(x86)%\winamp\system\alac.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\adpcm.wbm to %ProgramFiles(x86)%\winamp\system\adpcm.wbm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\adpcm.w5s to %ProgramFiles(x86)%\winamp\system\adpcm.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\aacdec.wbm to %ProgramFiles(x86)%\winamp\system\aacdec.wbm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\protos\social\social_ru.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_ru.dll id-+hy8i9weivplxplk.hr_r
from %TEMP%\microsoft .net framework 4.5 setup_20150506_155317844.html to %TEMP%\microsoft .net framework 4.5 setup_20150506_155317844.html id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_bg.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_bg.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_ar.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_ar.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_am.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdateres_am.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\update-settings.ini to %ProgramFiles(x86)%\mozilla firefox\update-settings.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\wow_helper.exe to %ProgramFiles(x86)%\mozilla firefox\wow_helper.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\webapprt-stub.exe to %ProgramFiles(x86)%\mozilla firefox\webapprt-stub.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\thunderbird.exe to %ProgramFiles(x86)%\mozilla thunderbird\thunderbird.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_child.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_child.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\webapp-uninstaller.exe to %ProgramFiles(x86)%\mozilla firefox\webapp-uninstaller.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\voucher.bin to %ProgramFiles(x86)%\mozilla firefox\voucher.bin id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\updater.ini to %ProgramFiles(x86)%\mozilla firefox\updater.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\softokn3.dll to %ProgramFiles(x86)%\mozilla thunderbird\softokn3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\softokn3.chk to %ProgramFiles(x86)%\mozilla thunderbird\softokn3.chk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\removed-files to %ProgramFiles(x86)%\mozilla thunderbird\removed-files id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\precomplete to %ProgramFiles(x86)%\mozilla thunderbird\precomplete id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\plugin-container.exe to %ProgramFiles(x86)%\mozilla thunderbird\plugin-container.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\platform.ini to %ProgramFiles(x86)%\mozilla thunderbird\platform.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\mp4v.w5s to %ProgramFiles(x86)%\winamp\system\mp4v.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\update-settings.ini to %ProgramFiles(x86)%\mozilla thunderbird\update-settings.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\softokn3.dll to %ProgramFiles(x86)%\mozilla firefox\softokn3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\softokn3.chk to %ProgramFiles(x86)%\mozilla firefox\softokn3.chk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\sandboxbroker.dll to %ProgramFiles(x86)%\mozilla firefox\sandboxbroker.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\removed-files to %ProgramFiles(x86)%\mozilla firefox\removed-files id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\precomplete to %ProgramFiles(x86)%\mozilla firefox\precomplete id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\plugin-hang-ui.exe to %ProgramFiles(x86)%\mozilla firefox\plugin-hang-ui.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\plugin-container.exe to %ProgramFiles(x86)%\mozilla firefox\plugin-container.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\platform.ini to %ProgramFiles(x86)%\mozilla firefox\platform.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\omni.ja to %ProgramFiles(x86)%\mozilla firefox\omni.ja id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\omni.ja to %ProgramFiles(x86)%\mozilla thunderbird\omni.ja id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\nssdbm3.dll to %ProgramFiles(x86)%\mozilla firefox\nssdbm3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\nssdbm3.dll to %ProgramFiles(x86)%\mozilla thunderbird\nssdbm3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\nssdbm3.chk to %ProgramFiles(x86)%\mozilla firefox\nssdbm3.chk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\updater.exe to %ProgramFiles(x86)%\mozilla firefox\updater.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\protos\social\social_sk.dll to %ProgramFiles(x86)%\qip 2012\protos\social\social_sk.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\updater.exe to %ProgramFiles(x86)%\mozilla thunderbird\updater.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\xul.dll to %ProgramFiles(x86)%\mozilla thunderbird\xul.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\updater.ini to %ProgramFiles(x86)%\mozilla thunderbird\updater.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\goopdate.dll to %ProgramFiles(x86)%\google\update\1.3.26.9\goopdate.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdatewebplugin.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdatewebplugin.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdatesetup.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdatesetup.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdateondemand.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdateondemand.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdatehelper.msi to %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdatehelper.msi id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdatecomregistershell64.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdatecomregistershell64.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdatebroker.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdatebroker.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdate.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdate.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\googlecrashhandler64.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googlecrashhandler64.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\1.3.26.9\googlecrashhandler.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googlecrashhandler.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\xinput1_3.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\xinput1_3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\widevinecdmadapter.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\widevinecdmadapter.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\snapshot_blob.bin to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\snapshot_blob.bin id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\wsenable.exe to %ProgramFiles(x86)%\mozilla thunderbird\wsenable.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\secondarytile.png to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\secondarytile.png id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\xul.dll to %ProgramFiles(x86)%\mozilla firefox\xul.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\nacl_irt_x86_64.nexe to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\nacl_irt_x86_64.nexe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\nacl_irt_x86_32.nexe to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\nacl_irt_x86_32.nexe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\nacl64.exe to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\nacl64.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\metro_driver.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\metro_driver.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\libglesv2.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\libglesv2.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\libexif.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\libexif.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\libegl.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\libegl.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\icudtl.dat to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\icudtl.dat id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\ffmpegsumo.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\ffmpegsumo.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\delegate_execute.exe to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\delegate_execute.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\d3dcompiler_47.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\d3dcompiler_47.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_watcher.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_watcher.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_elf.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_elf.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\resources.pak to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\resources.pak id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\achievementbg_recent.tga to %ProgramFiles(x86)%\steam\graphics\achievementbg_recent.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\1033\vviewres.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\vviewres.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovronbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottomleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovronbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottom.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovrofftopright.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftopright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovrofftopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftopleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovrofftop.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftop.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovroffright.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovroffleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovroffbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffbottomright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovroffbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffbottomleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovroffbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffbottom.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndistopright.tga to %ProgramFiles(x86)%\steam\graphics\btndistopright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndistopleft.tga to %ProgramFiles(x86)%\steam\graphics\btndistopleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndistop.tga to %ProgramFiles(x86)%\steam\graphics\btndistop.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndisright.tga to %ProgramFiles(x86)%\steam\graphics\btndisright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndisbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btndisbottomright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovronleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovronleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndisbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btndisbottomleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndisbottom.tga to %ProgramFiles(x86)%\steam\graphics\btndisbottom.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobecollabsync.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobecollabsync.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndeftopright.tga to %ProgramFiles(x86)%\steam\graphics\btndeftopright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndeftopleft.tga to %ProgramFiles(x86)%\steam\graphics\btndeftopleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndeftop.tga to %ProgramFiles(x86)%\steam\graphics\btndeftop.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndefright.tga to %ProgramFiles(x86)%\steam\graphics\btndefright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndefleft.tga to %ProgramFiles(x86)%\steam\graphics\btndefleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adelrcp.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adelrcp.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndefbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btndefbottomright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrotextextractor.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrotextextractor.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndefbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btndefbottomleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndisleft.tga to %ProgramFiles(x86)%\steam\graphics\btndisleft.tga id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini to %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovronright.tga to %ProgramFiles(x86)%\steam\graphics\btnovronright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\1033\stsupld.intl.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\stsupld.intl.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\1033\stsucres.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\stsucres.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\1033\ocltint.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\ocltint.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\1033\mapishellr.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\mapishellr.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office10\ucscribe.dll to %ProgramFiles(x86)%\microsoft office\office10\ucscribe.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office10\trigram.lex to %ProgramFiles(x86)%\microsoft office\office10\trigram.lex id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office10\thdic.lex to %ProgramFiles(x86)%\microsoft office\office10\thdic.lex id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office10\seqchk10.dll to %ProgramFiles(x86)%\microsoft office\office10\seqchk10.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office10\saext.dll to %ProgramFiles(x86)%\microsoft office\office10\saext.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\1033\grooveintlresource.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\grooveintlresource.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx to %APPDATA%\microsoft\document building blocks\1033\14\built-in building blocks.dotx id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnstdtopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnstdtopleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnstdtop.tga to %ProgramFiles(x86)%\steam\graphics\btnstdtop.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btndefbottom.tga to %ProgramFiles(x86)%\steam\graphics\btndefbottom.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovronbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottomright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnstdbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnstdbottomright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnstdbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnstdbottomleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnstdbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnstdbottom.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnseltopright.tga to %ProgramFiles(x86)%\steam\graphics\btnseltopright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnseltopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnseltopleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnseltop.tga to %ProgramFiles(x86)%\steam\graphics\btnseltop.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnselright.tga to %ProgramFiles(x86)%\steam\graphics\btnselright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnselleft.tga to %ProgramFiles(x86)%\steam\graphics\btnselleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnselbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottomright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnselbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottomleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnselbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottom.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovrontopright.tga to %ProgramFiles(x86)%\steam\graphics\btnovrontopright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovrontopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovrontopleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobelinguistic.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobelinguistic.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnstdleft.tga to %ProgramFiles(x86)%\steam\graphics\btnstdleft.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnovrontop.tga to %ProgramFiles(x86)%\steam\graphics\btnovrontop.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrosup64.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrosup64.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\bigpicturebg.tga to %ProgramFiles(x86)%\steam\graphics\bigpicturebg.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\bg_security_wizard.tga to %ProgramFiles(x86)%\steam\graphics\bg_security_wizard.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\playlist.w5s to %ProgramFiles(x86)%\winamp\system\playlist.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\vp6.wbm to %ProgramFiles(x86)%\winamp\system\vp6.wbm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\vp6.w5s to %ProgramFiles(x86)%\winamp\system\vp6.w5s id-+hy8i9weivplxplk.hr_r
from %TEMP%\msi1cfbe.log to %TEMP%\msi1cfbe.log id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\vlb.wbm to %ProgramFiles(x86)%\winamp\system\vlb.wbm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\vlb.w5s to %ProgramFiles(x86)%\winamp\system\vlb.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\unicodetaskbarfix.w5s to %ProgramFiles(x86)%\winamp\system\unicodetaskbarfix.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\timer.w5s to %ProgramFiles(x86)%\winamp\system\timer.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\theora.wbm to %ProgramFiles(x86)%\winamp\system\theora.wbm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\theora.w5s to %ProgramFiles(x86)%\winamp\system\theora.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\tagz.w5s to %ProgramFiles(x86)%\winamp\system\tagz.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\primo.w5s to %ProgramFiles(x86)%\winamp\system\primo.w5s id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\pcm.wbm to %ProgramFiles(x86)%\winamp\system\pcm.wbm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\pcm.w5s to %ProgramFiles(x86)%\winamp\system\pcm.w5s id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk to %APPDATA%\microsoft\internet explorer\quick launch\winamp.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk to %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\ombrowser.w5s to %ProgramFiles(x86)%\winamp\system\ombrowser.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\mp4v.wbm to %ProgramFiles(x86)%\winamp\system\mp4v.wbm id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk to %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk id-+hy8i9weivplxplk.hr_r
from %TEMP%\mirc741.exe to %TEMP%\mirc741.exe id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk to %APPDATA%\microsoft\internet explorer\quick launch\mail.ru agent.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk id-+hy8i9weivplxplk.hr_r
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20150506_155226438.html to %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20150506_155226438.html id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk to %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\png.w5s to %ProgramFiles(x86)%\winamp\system\png.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\nssdbm3.chk to %ProgramFiles(x86)%\mozilla thunderbird\nssdbm3.chk id-+hy8i9weivplxplk.hr_r
from %TEMP%\msic204f.log to %TEMP%\msic204f.log id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\xml.w5s to %ProgramFiles(x86)%\winamp\system\xml.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\vp8.wbm to %ProgramFiles(x86)%\winamp\system\vp8.wbm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\bg_security_code_entry.tga to %ProgramFiles(x86)%\steam\graphics\bg_security_code_entry.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\beta_hover.tga to %ProgramFiles(x86)%\steam\graphics\beta_hover.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\beta.tga to %ProgramFiles(x86)%\steam\graphics\beta.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\avatar_64blank.tga to %ProgramFiles(x86)%\steam\graphics\avatar_64blank.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\avatar_32blank.tga to %ProgramFiles(x86)%\steam\graphics\avatar_32blank.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\avatar_184blank.tga to %ProgramFiles(x86)%\steam\graphics\avatar_184blank.tga id-+hy8i9weivplxplk.hr_r
from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\avatarborderonline.tga to %ProgramFiles(x86)%\steam\graphics\avatarborderonline.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\avatarborderoffline.tga to %ProgramFiles(x86)%\steam\graphics\avatarborderoffline.tga id-+hy8i9weivplxplk.hr_r
from %TEMP%\wallpaper.bmp to %TEMP%\wallpaper.bmp id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\avatarborderingame.tga to %ProgramFiles(x86)%\steam\graphics\avatarborderingame.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\wasabi2.w5s to %ProgramFiles(x86)%\winamp\system\wasabi2.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\avatarbordergolden.tga to %ProgramFiles(x86)%\steam\graphics\avatarbordergolden.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\vp8.w5s to %ProgramFiles(x86)%\winamp\system\vp8.w5s id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\achievementbg.tga to %ProgramFiles(x86)%\steam\graphics\achievementbg.tga id-+hy8i9weivplxplk.hr_r
from %TEMP%\setupexe(20160310140634718).log to %TEMP%\setupexe(20160310140634718).log id-+hy8i9weivplxplk.hr_r
from %TEMP%\setupexe(201603101200226dc).log to %TEMP%\setupexe(201603101200226dc).log id-+hy8i9weivplxplk.hr_r
from %TEMP%\setupexe(20151124155624744).log to %TEMP%\setupexe(20151124155624744).log id-+hy8i9weivplxplk.hr_r
from %TEMP%\rgie195.tmp-tmp to %TEMP%\rgie195.tmp-tmp id-+hy8i9weivplxplk.hr_r
from %TEMP%\rgie195.tmp to %TEMP%\rgie195.tmp id-+hy8i9weivplxplk.hr_r
from %TEMP%\ose00001.exe to %TEMP%\ose00001.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe id-+hy8i9weivplxplk.hr_r
from %TEMP%\ose00000.exe to %TEMP%\ose00000.exe id-+hy8i9weivplxplk.hr_r
from %TEMP%\msieb217.log to %TEMP%\msieb217.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\msie45bf.log to %TEMP%\msie45bf.log id-+hy8i9weivplxplk.hr_r
from %TEMP%\msid38c.log to %TEMP%\msid38c.log id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\system\xspf.w5s to %ProgramFiles(x86)%\winamp\system\xspf.w5s id-+hy8i9weivplxplk.hr_r
from %TEMP%\user.bmp to %TEMP%\user.bmp id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\graphics\btnstdright.tga to %ProgramFiles(x86)%\steam\graphics\btnstdright.tga id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolui100.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolui100.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome.dll to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\d3dcompiler_43.dll to %ProgramFiles(x86)%\mozilla thunderbird\d3dcompiler_43.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\crashreporter.ini to %ProgramFiles(x86)%\mozilla thunderbird\crashreporter.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\crashreporter.exe to %ProgramFiles(x86)%\mozilla thunderbird\crashreporter.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\breakpadinjector.dll to %ProgramFiles(x86)%\mozilla thunderbird\breakpadinjector.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\blocklist.xml to %ProgramFiles(x86)%\mozilla thunderbird\blocklist.xml id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\application.ini to %ProgramFiles(x86)%\mozilla thunderbird\application.ini id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\mmc\taskschd to %APPDATA%\microsoft\mmc\taskschd id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\templates\normal.dotm to %APPDATA%\microsoft\templates\normal.dotm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\amf\mcl-windesktop64.dll to %ProgramFiles(x86)%\steam\amf\mcl-windesktop64.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\amf\mcl-windesktop32.dll to %ProgramFiles(x86)%\steam\amf\mcl-windesktop32.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\amf\amf-core-windesktop64.dll to %ProgramFiles(x86)%\steam\amf\amf-core-windesktop64.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\publisher building blocks\contentstore.xml to %APPDATA%\microsoft\publisher building blocks\contentstore.xml id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\amf\amf-core-windesktop32.dll to %ProgramFiles(x86)%\steam\amf\amf-core-windesktop32.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\amf\amf-component-vce-windesktop64.dll to %ProgramFiles(x86)%\steam\amf\amf-component-vce-windesktop64.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\amf\amf-component-vce-windesktop32.dll to %ProgramFiles(x86)%\steam\amf\amf-component-vce-windesktop32.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\elevatorps.dll to %ProgramFiles(x86)%\winamp\elevatorps.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\amf\amf-component-vc-windesktop64.dll to %ProgramFiles(x86)%\steam\amf\amf-component-vc-windesktop64.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\amf\amf-component-vc-windesktop32.dll to %ProgramFiles(x86)%\steam\amf\amf-component-vc-windesktop32.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\opera\assets\150x150logo.scale-100.png to %ProgramFiles(x86)%\opera\assets\150x150logo.scale-100.png id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\langs\czech.dll to %ProgramFiles(x86)%\qip 2012\langs\czech.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini id-+hy8i9weivplxplk.hr_r
from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3 id-+hy8i9weivplxplk.hr_r
from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\windows sidebar\settings.ini to %ProgramFiles(x86)%\windows sidebar\settings.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\almon.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\amon\amon.exe to %ProgramFiles%\amon\amon.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\agb5.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\admunch.exe id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\mso1033.acl to %APPDATA%\microsoft\office\mso1033.acl id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\libavresample-2.dll to %ProgramFiles(x86)%\steam\libavresample-2.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\libavformat-56.dll to %ProgramFiles(x86)%\steam\libavformat-56.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\libavcodec-56.dll to %ProgramFiles(x86)%\steam\libavcodec-56.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\icuuc.dll to %ProgramFiles(x86)%\steam\icuuc.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\icui18n.dll to %ProgramFiles(x86)%\steam\icui18n.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\gameoverlayui.exe to %ProgramFiles(x86)%\steam\gameoverlayui.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\gameoverlayrenderer64.dll to %ProgramFiles(x86)%\steam\gameoverlayrenderer64.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\gameoverlayrenderer.dll to %ProgramFiles(x86)%\steam\gameoverlayrenderer.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\dbghelp.dll to %ProgramFiles(x86)%\steam\dbghelp.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\d3dcompiler_46_64.dll to %ProgramFiles(x86)%\steam\d3dcompiler_46_64.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\d3dcompiler_46.dll to %ProgramFiles(x86)%\steam\d3dcompiler_46.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\cserhelper.dll to %ProgramFiles(x86)%\steam\cserhelper.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\crashhandler64.dll to %ProgramFiles(x86)%\steam\crashhandler64.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\crashhandler.dll to %ProgramFiles(x86)%\steam\crashhandler.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\ahnsd.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\elevator.exe to %ProgramFiles(x86)%\winamp\elevator.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\zlib.dll to %ProgramFiles(x86)%\winamp\zlib.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\winampa.exe to %ProgramFiles(x86)%\winamp\winampa.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\winamp.exe to %ProgramFiles(x86)%\winamp\winamp.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\uninstwa.exe to %ProgramFiles(x86)%\winamp\uninstwa.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\tataki.dll to %ProgramFiles(x86)%\winamp\tataki.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\pxsdkpls.dll to %ProgramFiles(x86)%\winamp\pxsdkpls.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\nxlite.dll to %ProgramFiles(x86)%\winamp\nxlite.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\nsutil.dll to %ProgramFiles(x86)%\winamp\nsutil.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\nde.dll to %ProgramFiles(x86)%\winamp\nde.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\libsndfile.dll to %ProgramFiles(x86)%\winamp\libsndfile.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\libmp4v2.dll to %ProgramFiles(x86)%\winamp\libmp4v2.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\libflac.dll to %ProgramFiles(x86)%\winamp\libflac.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\appoverlay64.dll to %ProgramFiles(x86)%\steam\appoverlay64.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\jnetlib.dll to %ProgramFiles(x86)%\winamp\jnetlib.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\aim6.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\alsvc.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\ash.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\update\googleupdate.exe to %ProgramFiles(x86)%\google\update\googleupdate.exe id-+hy8i9weivplxplk.hr_r
from %APPDATA%\mail.ru\agent\libvoip_x86.dll to %APPDATA%\mail.ru\agent\libvoip_x86.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\pidgin\exchndl.dll to %ProgramFiles(x86)%\pidgin\exchndl.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\opera\29.0.1795.47\d3dcompiler_47.dll to %ProgramFiles(x86)%\opera\29.0.1795.47\d3dcompiler_47.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\aimpro.exe id-+hy8i9weivplxplk.hr_r
from %APPDATA%\icqm\icq.exe to %APPDATA%\icqm\icq.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\icons\config.ico to %ProgramFiles(x86)%\k-lite codec pack\icons\config.ico id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\core\bass.dll to %ProgramFiles(x86)%\qip 2012\core\bass.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office10\msostyle.dll to %ProgramFiles(x86)%\microsoft office\office10\msostyle.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\1033\bhointl.dll to %ProgramFiles(x86)%\microsoft office\office14\1033\bhointl.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\libavutil-54.dll to %ProgramFiles(x86)%\steam\libavutil-54.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\ackwin32.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\contents.rtf to %ProgramFiles(x86)%\k-lite codec pack\info\contents.rtf id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\appoverlay.dll to %ProgramFiles(x86)%\steam\appoverlay.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\authzax.dll to %ProgramFiles(x86)%\microsoft office\office14\authzax.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\winamp\burnlib.dll to %ProgramFiles(x86)%\winamp\burnlib.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\qip 2012\qip.exe to %ProgramFiles(x86)%\qip 2012\qip.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\accessiblemarshal.dll to %ProgramFiles(x86)%\mozilla thunderbird\accessiblemarshal.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\avcodec-ics-56.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\avcodec-ics-56.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mirc\defaults\mirc.ini to %ProgramFiles(x86)%\mirc\defaults\mirc.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\unins000.dat id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\accessiblemarshal.dll to %ProgramFiles(x86)%\mozilla firefox\accessiblemarshal.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\mra\installerlang.xml to %APPDATA%\mra\installerlang.xml id-+hy8i9weivplxplk.hr_r
from %APPDATA%\icq-profile\installerlang.xml to %APPDATA%\icq-profile\installerlang.xml id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\ashavsrv.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\ashavast.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\ashdisp.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\a2scan.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\a2start.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\amsn.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\about.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\ashchest.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\ashenhcd.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\ashdug.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\a2guard.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\a2upd.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\icaros\32-bit\avcodec-ics-56.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\32-bit\avcodec-ics-56.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\aavshield.exe id-+hy8i9weivplxplk.hr_r
from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\aoltbserver.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\anti-trojan\anti-trojan.exe to %ProgramFiles%\anti-trojan\anti-trojan.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\a2hijackfree.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\armor2net\armor2net.exe to %ProgramFiles%\armor2net\armor2net.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\armorsurf\armorsurf.exe to %ProgramFiles%\armorsurf\armorsurf.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\ageofconan.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\airdefense.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\ashlogv.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\360tray.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe id-+hy8i9weivplxplk.hr_r
from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dcompiler_43.dll to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dcompiler_43.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\a2service.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\icarosthumbnailprovider.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\icarosthumbnailprovider.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\nss3.dll to %ProgramFiles(x86)%\mozilla firefox\nss3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\libswscale-3.dll to %ProgramFiles(x86)%\steam\libswscale-3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\vviewdwg.dll to %ProgramFiles(x86)%\microsoft office\office14\vviewdwg.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\maintenanceservice.exe to %ProgramFiles(x86)%\mozilla thunderbird\maintenanceservice.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\freebl3.dll to %ProgramFiles(x86)%\mozilla firefox\freebl3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\freebl3.chk to %ProgramFiles(x86)%\mozilla firefox\freebl3.chk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\urlredir.dll to %ProgramFiles(x86)%\microsoft office\office14\urlredir.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\stsupld.dll to %ProgramFiles(x86)%\microsoft office\office14\stsupld.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\libglesv2.dll to %ProgramFiles(x86)%\mozilla thunderbird\libglesv2.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\firefox.exe to %ProgramFiles(x86)%\mozilla firefox\firefox.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\libegl.dll to %ProgramFiles(x86)%\mozilla thunderbird\libegl.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\stscopy.dll to %ProgramFiles(x86)%\microsoft office\office14\stscopy.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\dependentlibs.list to %ProgramFiles(x86)%\mozilla firefox\dependentlibs.list id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\install.log to %ProgramFiles(x86)%\mozilla thunderbird\install.log id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\ppslax.dll to %ProgramFiles(x86)%\microsoft office\office14\ppslax.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\owssupp.dll to %ProgramFiles(x86)%\microsoft office\office14\owssupp.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\icuuc52.dll to %ProgramFiles(x86)%\mozilla thunderbird\icuuc52.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\icudt52.dll to %ProgramFiles(x86)%\mozilla firefox\icudt52.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\onenotesyncpc.dll to %ProgramFiles(x86)%\microsoft office\office14\onenotesyncpc.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\icuin52.dll to %ProgramFiles(x86)%\mozilla thunderbird\icuin52.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\onbttnielinkednotes.dll to %ProgramFiles(x86)%\microsoft office\office14\onbttnielinkednotes.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\unins000.exe to %ProgramFiles(x86)%\k-lite codec pack\unins000.exe id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\_copy_license_ja.lnk to %APPDATA%\microsoft\office\recent\_copy_license_ja.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\xml_excel_wiki.lnk to %APPDATA%\microsoft\office\recent\xml_excel_wiki.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\xml_excel.lnk to %APPDATA%\microsoft\office\recent\xml_excel.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\vm introspection.lnk to %APPDATA%\microsoft\office\recent\vm introspection.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\virtual-machiene-introspection.lnk to %APPDATA%\microsoft\office\recent\virtual-machiene-introspection.lnk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\onbttnie.dll to %ProgramFiles(x86)%\microsoft office\office14\onbttnie.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\templates.lnk to %APPDATA%\microsoft\office\recent\templates.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\protect.lnk to %APPDATA%\microsoft\office\recent\protect.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\license_ja.lnk to %APPDATA%\microsoft\office\recent\license_ja.lnk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\onlntcomlib.dll to %ProgramFiles(x86)%\microsoft office\office14\onlntcomlib.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt to %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\mapiproxy.dll to %ProgramFiles(x86)%\mozilla thunderbird\mapiproxy.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\msvcr120.dll to %ProgramFiles(x86)%\mozilla firefox\msvcr120.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\msvcp120.dll to %ProgramFiles(x86)%\mozilla firefox\msvcp120.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\mozglue.dll to %ProgramFiles(x86)%\mozilla firefox\mozglue.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\mozalloc.dll to %ProgramFiles(x86)%\mozilla firefox\mozalloc.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\nssckbi.dll to %ProgramFiles(x86)%\mozilla thunderbird\nssckbi.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\maintenanceservice_installer.exe to %ProgramFiles(x86)%\mozilla firefox\maintenanceservice_installer.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\maintenanceservice.exe to %ProgramFiles(x86)%\mozilla firefox\maintenanceservice.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolap100.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msolap100.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\nss3.dll to %ProgramFiles(x86)%\mozilla thunderbird\nss3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\nsldif32v60.dll to %ProgramFiles(x86)%\mozilla thunderbird\nsldif32v60.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\libglesv2.dll to %ProgramFiles(x86)%\mozilla firefox\libglesv2.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\nsldappr32v60.dll to %ProgramFiles(x86)%\mozilla thunderbird\nsldappr32v60.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\libegl.dll to %ProgramFiles(x86)%\mozilla firefox\libegl.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\license_en.lnk to %APPDATA%\microsoft\office\recent\license_en.lnk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\maintenanceservice_installer.exe to %ProgramFiles(x86)%\mozilla thunderbird\maintenanceservice_installer.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\install.log to %ProgramFiles(x86)%\mozilla firefox\install.log id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\nsldap32v60.dll to %ProgramFiles(x86)%\mozilla thunderbird\nsldap32v60.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmgdsrv.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmgdsrv.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\msvcr100.dll to %ProgramFiles(x86)%\mozilla thunderbird\msvcr100.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\icuuc52.dll to %ProgramFiles(x86)%\mozilla firefox\icuuc52.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\msvcp100.dll to %ProgramFiles(x86)%\mozilla thunderbird\msvcp100.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\mozmapi32_inuse.dll to %ProgramFiles(x86)%\mozilla thunderbird\mozmapi32_inuse.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\mozmapi32.dll to %ProgramFiles(x86)%\mozilla thunderbird\mozmapi32.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\icuin52.dll to %ProgramFiles(x86)%\mozilla firefox\icuin52.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\vviewer.dll to %ProgramFiles(x86)%\microsoft office\office14\vviewer.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\mozjs.dll to %ProgramFiles(x86)%\mozilla thunderbird\mozjs.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\mozglue.dll to %ProgramFiles(x86)%\mozilla thunderbird\mozglue.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\mozalloc.dll to %ProgramFiles(x86)%\mozilla thunderbird\mozalloc.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\mapiproxy_inuse.dll to %ProgramFiles(x86)%\mozilla thunderbird\mapiproxy_inuse.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\index.dat to %APPDATA%\microsoft\office\recent\index.dat id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\office\recent\clarify.lnk to %APPDATA%\microsoft\office\recent\clarify.lnk id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\f8401b27-0c7a-4d0f-80a5-9679c6328419 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\f8401b27-0c7a-4d0f-80a5-9679c6328419 id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\application.ini to %ProgramFiles(x86)%\mozilla firefox\application.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_subtitles.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_subtitles.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_playback_issues.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_playback_issues.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_mpc.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_mpc.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_miscellaneous.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_miscellaneous.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_installation.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_installation.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\crashreporter.exe to %ProgramFiles(x86)%\mozilla firefox\crashreporter.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\avformat-ics-56.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\avformat-ics-56.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_general.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_general.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_dxva.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_dxva.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_display_issues.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_display_issues.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\grooveex.dll to %ProgramFiles(x86)%\microsoft office\office14\grooveex.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_configuration.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_configuration.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll to %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 to %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\crashreporter.ini to %ProgramFiles(x86)%\mozilla firefox\crashreporter.ini id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_64bit.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_64bit.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq.css to %ProgramFiles(x86)%\k-lite codec pack\info\faq.css id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\steamclient64.dll to %ProgramFiles(x86)%\steam\steamclient64.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\msdn\7.0\objbrow.dat to %APPDATA%\microsoft\msdn\7.0\objbrow.dat id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\dbgclr\7.1\objbrow.dat to %APPDATA%\microsoft\dbgclr\7.1\objbrow.dat id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\steamclient.dll to %ProgramFiles(x86)%\steam\steamclient.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\steam2.dll to %ProgramFiles(x86)%\steam\steam2.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\steam.exe.old to %ProgramFiles(x86)%\steam\steam.exe.old id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\steam.exe to %ProgramFiles(x86)%\steam\steam.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\steam.dll to %ProgramFiles(x86)%\steam\steam.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\sdl2.dll to %ProgramFiles(x86)%\steam\sdl2.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\libx264-142.dll.md5 to %ProgramFiles(x86)%\steam\libx264-142.dll.md5 id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\steam\libx264-142.dll.crypt to %ProgramFiles(x86)%\steam\libx264-142.dll.crypt id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\breakpadinjector.dll to %ProgramFiles(x86)%\mozilla firefox\breakpadinjector.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\nssckbi.dll to %ProgramFiles(x86)%\mozilla firefox\nssckbi.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_troubleshooting.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_troubleshooting.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_wmp.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_wmp.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\d3dcompiler_43.dll to %ProgramFiles(x86)%\mozilla firefox\d3dcompiler_43.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\icudt52.dll to %ProgramFiles(x86)%\mozilla thunderbird\icudt52.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d524265f-dddf-4bb6-9b50-623f924971ba to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\d524265f-dddf-4bb6-9b50-623f924971ba id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\bd5b067d-34b5-40ef-9a93-eff9fd1771a3 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\bd5b067d-34b5-40ef-9a93-eff9fd1771a3 id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\ae597e89-6b58-4713-b543-846c970a2b49 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\ae597e89-6b58-4713-b543-846c970a2b49 id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\9a5de8c5-f1f1-4a14-bd2a-9a24fc199001 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\9a5de8c5-f1f1-4a14-bd2a-9a24fc199001 id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\95cc57d1-8d02-4469-8d7d-0e2db5f16cfe to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\95cc57d1-8d02-4469-8d7d-0e2db5f16cfe id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\857f1812-3b8b-41fd-99c5-09d06e6d1983 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\857f1812-3b8b-41fd-99c5-09d06e6d1983 id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\5fea2324-401c-4a67-adf5-81a4571f8b7d to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\5fea2324-401c-4a67-adf5-81a4571f8b7d id-+hy8i9weivplxplk.hr_r
from %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\24a81978-4594-42c5-80e9-bcd9abebab41 to %APPDATA%\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1001\24a81978-4594-42c5-80e9-bcd9abebab41 id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\swscale-ics-3.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\swscale-ics-3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\olkfstub.dll to %ProgramFiles(x86)%\microsoft office\office14\olkfstub.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\oisctrl.dll to %ProgramFiles(x86)%\microsoft office\office14\oisctrl.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\npspwrap.dll to %ProgramFiles(x86)%\microsoft office\office14\npspwrap.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_windows_issues.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_windows_issues.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\npauthz.dll to %ProgramFiles(x86)%\microsoft office\office14\npauthz.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\info\faq_thumbnails.htm to %ProgramFiles(x86)%\k-lite codec pack\info\faq_thumbnails.htm id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\namecontrolproxy.dll to %ProgramFiles(x86)%\microsoft office\office14\namecontrolproxy.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\name.dll to %ProgramFiles(x86)%\microsoft office\office14\name.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\msohtmed.exe to %ProgramFiles(x86)%\microsoft office\office14\msohtmed.exe id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\msohev.dll to %ProgramFiles(x86)%\microsoft office\office14\msohev.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla firefox\d3dcompiler_47.dll to %ProgramFiles(x86)%\mozilla firefox\d3dcompiler_47.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\icarospropertyhandler.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\icarospropertyhandler.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\gkmedias.dll to %ProgramFiles(x86)%\mozilla thunderbird\gkmedias.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\inlaunch.dll to %ProgramFiles(x86)%\microsoft office\office14\inlaunch.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\ieawsdc.dll to %ProgramFiles(x86)%\microsoft office\office14\ieawsdc.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\avutil-ics-54.dll to %ProgramFiles(x86)%\k-lite codec pack\icaros\64-bit\avutil-ics-54.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\freebl3.dll to %ProgramFiles(x86)%\mozilla thunderbird\freebl3.dll id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\freebl3.chk to %ProgramFiles(x86)%\mozilla thunderbird\freebl3.chk id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\mozilla thunderbird\dependentlibs.list to %ProgramFiles(x86)%\mozilla thunderbird\dependentlibs.list id-+hy8i9weivplxplk.hr_r
from %ProgramFiles(x86)%\microsoft office\office14\nameext.dll to %ProgramFiles(x86)%\microsoft office\office14\nameext.dll id-+hy8i9weivplxplk.hr_r
from %APPDATA%\qipguard\chrome.dll to %APPDATA%\qipguard\chrome.dll id-+hy8i9weivplxplk.hr_r

Substitutes the following executable files

<Full path to file>

Substitutes the following files

%CommonProgramFiles(x86)%\Services\verisign.bmp

Moves itself

from <Full path to file> to <Full path to file> id-+hy8i9weivplxplk.hr_r

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней