Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Encoder.24249

Added to the Dr.Web virus database: 2018-01-10

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Encrypter_074' = '%APPDATA%\info.exe'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'userinfo' = '%APPDATA%\recovery.txt'
Creates or modifies the following files:
  • %WINDIR%\win.ini
  • %HOMEPATH%\Start Menu\Programs\Startup\How Recovery Files.txt
  • %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
  • %HOMEPATH%\Start Menu\Programs\Startup\desktop.ini
  • %WINDIR%\Tasks\How Recovery Files.txt
  • %WINDIR%\Tasks\SA.DAT
Changes the following executable system files:
  • %WINDIR%\XXInstall\vminstall.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
  • %WINDIR%\twunk_32.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
  • %WINDIR%\vmmreg32.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
  • %WINDIR%\TASKMAN.EXE
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
  • %WINDIR%\twain_32\wiatwain.ds
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
  • %WINDIR%\twain_32.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll
  • %WINDIR%\XXInstall\devcon.exe
  • %WINDIR%\XXInstall\events.exe
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll
  • %WINDIR%\XXInstall\exdir.exe
  • %WINDIR%\XXInstall\hashdeep.exe
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcirt.dll
  • %WINDIR%\XXInstall\ps.exe
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll
  • %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll
  • %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
  • %WINDIR%\winhlp32.exe
  • %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
  • %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
  • %WINDIR%\XXInstall\screen.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
  • %WINDIR%\XXInstall\Scripts\antivm.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll
  • %WINDIR%\XXInstall\cmdow.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
Infects the following executable files:
  • <STUBS_DIR>\test.exe
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll
  • C:\Far2\Plugins\FTP\lib\ftpDirList.fll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll
  • <ANALYSETOOLS_DIR>\XueTr_Cmd\XueTr.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
  • <ANALYSETOOLS_DIR>\XueTr_Cmd\XueTrCmd.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll
  • <ANALYSETOOLS_DIR>\XueTr_Cmd\PCHunter64.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll
  • <ANALYSE_DIR>\muldrop.sys
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll
  • <ANALYSE_DIR>\dwshield.sys
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll
  • <ANALYSE_DIR>\muldrop_dbg.sys
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll
  • <ANALYSETOOLS_DIR>\XueTr_Cmd\XueTrSDK.sys
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll
  • C:\Far2\Plugins\FileCase\FileCase.dll
  • C:\Far2\Plugins\FarCmds\FARCmds.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll
  • <ANALYSETOOLS_DIR>\XueTr_Cmd\XueTrCmdOrig.exe
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll
  • C:\Far2\Plugins\FTP\FarFtp.dll
  • C:\Far2\Plugins\FTP\lib\ftpProgress.fll
  • %ProgramFiles%\Windows Media Player\setup_wm.exe
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll
  • C:\Far2\Plugins\Colorer\bin\colorer.dll
  • C:\Far2\Plugins\Brackets\Brackets.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll
  • <ANALYSETOOLS_DIR>\STracer\SimplyTracer.exe
  • %ProgramFiles%\Outlook Express\wabmig.exe
  • %ProgramFiles%\Outlook Express\wabimp.dll
  • %ProgramFiles%\Outlook Express\wabfind.dll
  • %ProgramFiles%\Outlook Express\wab.exe
  • %ProgramFiles%\Outlook Express\setup50.exe
  • %ProgramFiles%\Outlook Express\oemiglib.dll
  • %ProgramFiles%\Outlook Express\oemig50.exe
  • <ANALYSETOOLS_DIR>\STracer\ollyext.dll
  • %ProgramFiles%\Outlook Express\oeimport.dll
  • %ProgramFiles%\Outlook Express\msoeres.dll
  • %ProgramFiles%\Outlook Express\msoe.dll
  • %ProgramFiles%\Outlook Express\msimn.exe
  • %ProgramFiles%\NetMeeting\wb32.exe
  • %ProgramFiles%\NetMeeting\rrcm.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll
  • C:\Far2\Plugins\ExtSearch\esearch.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll
  • C:\Far2\Plugins\EditCase\EditCase.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll
  • <ANALYSER.EXE>.3
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll
  • <ANALYSER.EXE>.2
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll
  • <ANALYSER.EXE>.1
  • C:\Far2\Plugins\EMenu\EMenu.dll
  • C:\Far2\Plugins\DrawLine\DrawLine.dll
  • <ANALYSETOOLS_DIR>\XueTr_Cmd\PCHunter32.exe
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll
  • C:\Far2\Plugins\Compare\Compare.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll
  • <ANALYSE_DIR>\_kdump.sys_
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
  • C:\Far2\FExcept\FExcept.dll
  • C:\Far2\FExcept\ExcDump.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
  • C:\Far2\FExcept\demangle32.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
  • %WINDIR%\XXInstall\Scripts\antivm.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
  • %ProgramFiles%\Windows NT\Pinball\PINBALL.EXE
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
  • C:\Far2\Plugins\TmpPanel\TmpPanel.dll
  • C:\Far2\Far.exe
  • %ProgramFiles%\Windows NT\hypertrm.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
  • C:\Far2\Plugins\WinSCP\WinSCP.dll
  • %ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
  • %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
  • %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll
  • %WINDIR%\winhlp32.exe
  • %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
  • %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll
  • %WINDIR%\XXInstall\screen.exe
  • %WINDIR%\XXInstall\ps.exe
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll
  • %WINDIR%\XXInstall\vminstall.exe
  • %WINDIR%\XXInstall\hashdeep.exe
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll
  • %WINDIR%\XXInstall\events.exe
  • %WINDIR%\XXInstall\devcon.exe
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcirt.dll
  • %WINDIR%\XXInstall\cmdow.exe
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
  • %WINDIR%\XXInstall\exdir.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
  • %WINDIR%\twain_32.dll
  • %ProgramFiles%\Windows Media Player\npdsplay.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
  • %WINDIR%\twain_32\wiatwain.ds
  • %ProgramFiles%\Windows Media Player\npdrmv2.dll
  • %ProgramFiles%\Windows Media Player\mpvis.dll
  • C:\Far2\Plugins\Network\Network.dll
  • %ProgramFiles%\Windows Media Player\mplayer2.exe
  • C:\Far2\Plugins\MacroView\MacroView.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
  • %ProgramFiles%\Windows Media Player\migrate.exe
  • %ProgramFiles%\Windows Media Player\custsat.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll
  • %WINDIR%\TASKMAN.EXE
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll
  • C:\Far2\Plugins\HlfViewer\HlfViewer.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll
  • %ProgramFiles%\Windows NT\htrn_jis.dll
  • %ProgramFiles%\Windows Media Player\npwmsdrm.dll
  • %ProgramFiles%\Windows NT\dialer.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
  • %WINDIR%\vmmreg32.dll
  • %ProgramFiles%\Windows NT\Accessories\write.wpc
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
  • %ProgramFiles%\Windows NT\Accessories\wordpad.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
  • %ProgramFiles%\Windows NT\Accessories\mswrd8.wpc
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
  • %ProgramFiles%\Windows NT\Accessories\mswrd6.wpc
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
  • %ProgramFiles%\Windows Media Player\wmpns.dll
  • %ProgramFiles%\Windows Media Player\wmplayer.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
  • %ProgramFiles%\Windows Media Player\wmpband.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
  • %WINDIR%\twunk_32.exe
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
  • C:\Far2\Plugins\ProcList\Proclist.dll
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
  • %ProgramFiles%\NetMeeting\nmwb.dll
Malicious functions:
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system:
Creates the following files:
  • %TEMP%\M15XoD
  • %HOMEPATH%\My Documents\How Recovery Files.txt
  • <ANALYSE_DIR>\PET-DUMP\0B4C_pet_cmd.exe
  • <ANALYSETOOLS_DIR>\XueTr_Cmd\How Recovery Files.txt
  • <ANALYSE_DIR>\PET-DUMP\How Recovery Files.txt
  • C:\Far2\Addons\SetUp\How Recovery Files.txt
  • %HOMEPATH%\My Documents\My Music\How Recovery Files.txt
  • C:\Far2\Plugins\FileCase\How Recovery Files.txt
  • %HOMEPATH%\My Documents\My Pictures\How Recovery Files.txt
  • %HOMEPATH%\Favorites\How Recovery Files.txt
  • C:\Far2\Plugins\FarCmds\How Recovery Files.txt
  • %HOMEPATH%\How Recovery Files.txt
  • <ANALYSE_DIR>\How Recovery Files.txt
  • C:\Far2\Addons\XLat\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\How Recovery Files.txt
  • C:\Far2\Plugins\FTP\lib\How Recovery Files.txt
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\How Recovery Files.txt
  • %WINDIR%\Temp\How Recovery Files.txt
  • C:\Far2\Addons\Shell\How Recovery Files.txt
  • %HOMEPATH%\Local Settings\<INETFILES>\How Recovery Files.txt
  • <ANALYSE_DIR>\PET-DUMP\0B44_pet_vssadmin.exe
  • %HOMEPATH%\Favorites\Links\How Recovery Files.txt
  • <LS_APPDATA>\Microsoft\Windows Media\9.0\How Recovery Files.txt
  • <LS_APPDATA>\VMware\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\How Recovery Files.txt
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\How Recovery Files.txt
  • %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\How Recovery Files.txt
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\How Recovery Files.txt
  • %HOMEPATH%\Local Settings\How Recovery Files.txt
  • %TEMP%\How Recovery Files.txt
  • <APATH_DUMPS_DIR>\How Recovery Files.txt
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\How Recovery Files.txt
  • C:\Far2\Plugins\ExtSearch\sources\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\How Recovery Files.txt
  • %APPDATA%\Mozilla\Firefox\How Recovery Files.txt
  • %APPDATA%\How Recovery Files.txt
  • %HOMEPATH%\Cookies\How Recovery Files.txt
  • C:\Far2\Plugins\ExtSearch\sources\RegExp\How Recovery Files.txt
  • <ANALYSE_DIR>\PET-DUMP\0B14_pet_<File name>.exe
  • C:\Far2\Addons\Macros\How Recovery Files.txt
  • C:\Far2\Addons\How Recovery Files.txt
  • C:\Far2\Addons\XLat\Russian\How Recovery Files.txt
  • %HOMEPATH%\Local Settings\History\History.IE5\How Recovery Files.txt
  • %HOMEPATH%\Recent\How Recovery Files.txt
  • C:\Far2\Plugins\HlfViewer\How Recovery Files.txt
  • %HOMEPATH%\Start Menu\Programs\How Recovery Files.txt
  • C:\Far2\FExcept\How Recovery Files.txt
  • C:\Far2\PluginSDK\Headers.pas\How Recovery Files.txt
  • C:\Far2\Plugins\WinSCP\How Recovery Files.txt
  • C:\Far2\How Recovery Files.txt
  • %HOMEPATH%\Templates\How Recovery Files.txt
  • C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_0
  • C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_1
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\How Recovery Files.txt
  • C:\Muldrop\dmp_0x14c_0x10000
  • C:\Muldrop\dmp_0x14c_0x30000
  • C:\Muldrop\dmp_0x198_0x10000
  • C:\Muldrop\dmp_0x198_0x20000
  • C:\Muldrop\dmp_0x198_0x30000
  • C:\Muldrop\dmp_0x1a4_0x10000
  • C:\Muldrop\dmp_0x1a4_0x20000
  • C:\Muldrop\dmp_0x1a4_0x30000
  • C:\Muldrop\dmp_0x1a8_0x10000
  • C:\Muldrop\dmp_0x14c_0x20000
  • C:\Far2\PluginSDK\Headers.c\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\How Recovery Files.txt
  • C:\Far2\Plugins\TmpPanel\How Recovery Files.txt
  • C:\Far2\Plugins\FTP\How Recovery Files.txt
  • C:\Far2\Plugins\Network\How Recovery Files.txt
  • %WINDIR%\twain_32\How Recovery Files.txt
  • %HOMEPATH%\SendTo\How Recovery Files.txt
  • C:\Far2\Documentation\eng\How Recovery Files.txt
  • %ProgramFiles%\Windows Media Player\Skins\How Recovery Files.txt
  • %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\How Recovery Files.txt
  • %HOMEPATH%\Start Menu\How Recovery Files.txt
  • C:\Far2\Plugins\ProcList\How Recovery Files.txt
  • %ProgramFiles%\Windows Media Player\How Recovery Files.txt
  • %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\How Recovery Files.txt
  • %ProgramFiles%\Windows NT\Accessories\How Recovery Files.txt
  • C:\Far2\Documentation\rus\How Recovery Files.txt
  • C:\Far2\Encyclopedia\How Recovery Files.txt
  • %ProgramFiles%\Windows NT\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\How Recovery Files.txt
  • %HOMEPATH%\Start Menu\Programs\Accessories\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\How Recovery Files.txt
  • %WINDIR%\Web\printers\images\How Recovery Files.txt
  • C:\Far2\Plugins\MacroView\How Recovery Files.txt
  • <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\How Recovery Files.txt
  • <LS_APPDATA>\Microsoft\Media Player\How Recovery Files.txt
  • C:\Documents and Settings\NetworkService\Local Settings\How Recovery Files.txt
  • C:\Far2\Addons\Colors\Default Highlighting\How Recovery Files.txt
  • C:\Far2\Plugins\Colorer\bin\How Recovery Files.txt
  • C:\Far2\Plugins\Brackets\How Recovery Files.txt
  • C:\Far2\Plugins\Colorer\hrc\auto\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00630000.alloc
  • C:\Documents and Settings\NetworkService\Local Settings\History\How Recovery Files.txt
  • C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\How Recovery Files.txt
  • C:\Far2\Plugins\Colorer\hrc\auto\types\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00520000.alloc
  • C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00930000.alloc
  • %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\How Recovery Files.txt
  • C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\How Recovery Files.txt
  • C:\Far2\Plugins\Colorer\hrc\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00990000.alloc
  • C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\How Recovery Files.txt
  • C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\How Recovery Files.txt
  • C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\How Recovery Files.txt
  • %ProgramFiles%\MSN\MSNCoreFiles\Install\How Recovery Files.txt
  • %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\How Recovery Files.txt
  • %ProgramFiles%\NetMeeting\How Recovery Files.txt
  • C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00330000.alloc
  • %ProgramFiles%\Online Services\How Recovery Files.txt
  • C:\Far2\Plugins\AutoWrap\How Recovery Files.txt
  • <ANALYSETOOLS_DIR>\THP\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00380000.alloc
  • C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\How Recovery Files.txt
  • C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00390000.alloc
  • C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003A0000.alloc
  • C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\How Recovery Files.txt
  • %ProgramFiles%\Outlook Express\How Recovery Files.txt
  • <ANALYSETOOLS_DIR>\THP\www\How Recovery Files.txt
  • <ANALYSETOOLS_DIR>\STracer\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003B0000.alloc
  • C:\Documents and Settings\LocalService\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00450000.alloc
  • C:\Far2\Plugins\Colorer\hrd\How Recovery Files.txt
  • C:\Far2\Addons\Colors\How Recovery Files.txt
  • C:\Far2\Plugins\Colorer\hrd\console\contrib\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00A80000.alloc
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00B60000.alloc
  • C:\Far2\Plugins\ExtSearch\How Recovery Files.txt
  • %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\How Recovery Files.txt
  • C:\Far2\Plugins\EMenu\How Recovery Files.txt
  • C:\Far2\Plugins\EditCase\How Recovery Files.txt
  • C:\Far2\Plugins\ExtSearch\doc\How Recovery Files.txt
  • <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\How Recovery Files.txt
  • <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\How Recovery Files.txt
  • <ANALYSE_DIR>\DWS-DUMP\0B14_dws_<File name>.exe
  • %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\How Recovery Files.txt
  • <ANALYSE_DIR>\DWS-DUMP\0B44_dws_vssadmin.exe
  • %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\How Recovery Files.txt
  • <ANALYSE_DIR>\DWS-DUMP\0B4C_dws_cmd.exe
  • <LS_APPDATA>\How Recovery Files.txt
  • <ANALYSE_DIR>\DWS-DUMP\How Recovery Files.txt
  • C:\Far2\Plugins\ExtSearch\keys\How Recovery Files.txt
  • %HOMEPATH%\Local Settings\History\How Recovery Files.txt
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\How Recovery Files.txt
  • <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\How Recovery Files.txt
  • %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\How Recovery Files.txt
  • C:\Far2\Plugins\DrawLine\How Recovery Files.txt
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFE0000.alloc
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\How Recovery Files.txt
  • C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\How Recovery Files.txt
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\How Recovery Files.txt
  • %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\How Recovery Files.txt
  • %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\How Recovery Files.txt
  • %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\How Recovery Files.txt
  • %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\How Recovery Files.txt
  • C:\Documents and Settings\NetworkService\How Recovery Files.txt
  • C:\Far2\Plugins\Colorer\hrd\console\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7F6F0000.alloc
  • %APPDATA%\Microsoft\Address Book\How Recovery Files.txt
  • C:\Far2\Plugins\Compare\How Recovery Files.txt
  • C:\Far2\Plugins\Colorer\How Recovery Files.txt
  • %APPDATA%\Microsoft\Internet Explorer\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFB0000.alloc
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFD5000.alloc
  • %APPDATA%\Microsoft\Internet Explorer\Quick Launch\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFDF000.alloc
  • %APPDATA%\Microsoft\Media Player\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\How Recovery Files.txt
  • <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00510000.alloc
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\How Recovery Files.txt
  • <STUBS_DIR>\ashAvSrv\How Recovery Files.txt
  • <STUBS_DIR>\magent\How Recovery Files.txt
  • <STUBS_DIR>\lotroclient\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\How Recovery Files.txt
  • <STUBS_DIR>\MCAGENT\How Recovery Files.txt
  • <STUBS_DIR>\Mir3Game\How Recovery Files.txt
  • <STUBS_DIR>\msn6\How Recovery Files.txt
  • <STUBS_DIR>\mpftray\How Recovery Files.txt
  • <STUBS_DIR>\miranda32\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\How Recovery Files.txt
  • <STUBS_DIR>\msnmsgr\How Recovery Files.txt
  • <STUBS_DIR>\NAVAPW32\How Recovery Files.txt
  • <STUBS_DIR>\netxray\How Recovery Files.txt
  • <STUBS_DIR>\nod\How Recovery Files.txt
  • <STUBS_DIR>\nod32\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\How Recovery Files.txt
  • <STUBS_DIR>\opera\How Recovery Files.txt
  • <STUBS_DIR>\pidgin\How Recovery Files.txt
  • <STUBS_DIR>\outpost\How Recovery Files.txt
  • %WINDIR%\XXInstall\Scripts\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\How Recovery Files.txt
  • <STUBS_DIR>\maplestory\How Recovery Files.txt
  • <STUBS_DIR>\loadmain\How Recovery Files.txt
  • <STUBS_DIR>\GVOnline\How Recovery Files.txt
  • <STUBS_DIR>\gw\How Recovery Files.txt
  • C:\Muldrop\unq4.unq_0
  • <STUBS_DIR>\httplook\How Recovery Files.txt
  • <STUBS_DIR>\ICQ\How Recovery Files.txt
  • <STUBS_DIR>\iexplore\How Recovery Files.txt
  • <STUBS_DIR>\inbank-start-ff\How Recovery Files.txt
  • %ProgramFiles%\Windows NT\Pinball\How Recovery Files.txt
  • C:\Muldrop\How Recovery Files.txt
  • <STUBS_DIR>\InphaseNXD\How Recovery Files.txt
  • C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\How Recovery Files.txt
  • <STUBS_DIR>\intpro\How Recovery Files.txt
  • <STUBS_DIR>\iscc\How Recovery Files.txt
  • <STUBS_DIR>\java\How Recovery Files.txt
  • <STUBS_DIR>\ISClient\How Recovery Files.txt
  • <STUBS_DIR>\javaw\How Recovery Files.txt
  • <STUBS_DIR>\lin\How Recovery Files.txt
  • <STUBS_DIR>\kb_cli\How Recovery Files.txt
  • <STUBS_DIR>\l2\How Recovery Files.txt
  • <STUBS_DIR>\oncbcli\How Recovery Files.txt
  • %WINDIR%\Web\How Recovery Files.txt
  • <STUBS_DIR>\ntvdm\How Recovery Files.txt
  • <STUBS_DIR>\putty\How Recovery Files.txt
  • %WINDIR%\XXInstall\How Recovery Files.txt
  • <STUBS_DIR>\winbaram\How Recovery Files.txt
  • <STUBS_DIR>\zlclient\How Recovery Files.txt
  • <STUBS_DIR>\wow\How Recovery Files.txt
  • <STUBS_DIR>\wsm\How Recovery Files.txt
  • <STUBS_DIR>\YahooMessenger\How Recovery Files.txt
  • <STUBS_DIR>\ybclient\How Recovery Files.txt
  • <STUBS_DIR>\zapro\How Recovery Files.txt
  • <STUBS_DIR>\ZZ__cd75efb816b2cc__\How Recovery Files.txt
  • <STUBS_DIR>\ZONEALARM\How Recovery Files.txt
  • %WINDIR%\How Recovery Files.txt
  • C:\How Recovery Files.txt
  • %APPDATA%\recovery.txt
  • %TEMP%\tmp6.tmp
  • %APPDATA%\info.exe
  • %TEMP%\tmp5.tmp
  • %TEMP%\tmp4.tmp
  • %TEMP%\tmp3.tmp
  • <STUBS_DIR>\__cd75efb816b2cc__\How Recovery Files.txt
  • <STUBS_DIR>\webmoney\How Recovery Files.txt
  • <STUBS_DIR>\woool\How Recovery Files.txt
  • <STUBS_DIR>\TwelveSky2\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\How Recovery Files.txt
  • <STUBS_DIR>\Ragexe\How Recovery Files.txt
  • <STUBS_DIR>\rclient\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\How Recovery Files.txt
  • <STUBS_DIR>\RagFree\How Recovery Files.txt
  • <STUBS_DIR>\safari\How Recovery Files.txt
  • <STUBS_DIR>\skype\How Recovery Files.txt
  • <STUBS_DIR>\sgbclient\How Recovery Files.txt
  • <STUBS_DIR>\smc\How Recovery Files.txt
  • <STUBS_DIR>\so3d\How Recovery Files.txt
  • <STUBS_DIR>\sro_client\How Recovery Files.txt
  • <STUBS_DIR>\startclient7\How Recovery Files.txt
  • <STUBS_DIR>\spidernt\How Recovery Files.txt
  • <STUBS_DIR>\translink\How Recovery Files.txt
  • <STUBS_DIR>\tiny\How Recovery Files.txt
  • <STUBS_DIR>\How Recovery Files.txt
  • <STUBS_DIR>\trillian\How Recovery Files.txt
  • <STUBS_DIR>\wclnt\How Recovery Files.txt
  • <STUBS_DIR>\UniStream\How Recovery Files.txt
  • <STUBS_DIR>\qip\How Recovery Files.txt
  • %WINDIR%\Web\Wallpaper\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\How Recovery Files.txt
  • <STUBS_DIR>\GUARD\How Recovery Files.txt
  • <STUBS_DIR>\AVGCTRL\How Recovery Files.txt
  • <STUBS_DIR>\AVP32\How Recovery Files.txt
  • <STUBS_DIR>\AVP\How Recovery Files.txt
  • C:\Muldrop\dmp_0xd8_0x10000
  • <STUBS_DIR>\AVPM\How Recovery Files.txt
  • <STUBS_DIR>\AVPCC\How Recovery Files.txt
  • C:\Muldrop\dmp_0xd8_0x20000
  • <STUBS_DIR>\bankcl\How Recovery Files.txt
  • <STUBS_DIR>\AVGCC32\How Recovery Files.txt
  • C:\Muldrop\dmp_0x88_0x30000
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\How Recovery Files.txt
  • <STUBS_DIR>\bdagent\How Recovery Files.txt
  • <STUBS_DIR>\bclient\How Recovery Files.txt
  • C:\Muldrop\jogp.fyf_0
  • <STUBS_DIR>\bc_loader\How Recovery Files.txt
  • <STUBS_DIR>\bdsubmit\How Recovery Files.txt
  • <STUBS_DIR>\bdss\How Recovery Files.txt
  • <STUBS_DIR>\bk\How Recovery Files.txt
  • <STUBS_DIR>\AVSYNMGR\How Recovery Files.txt
  • C:\Muldrop\dmp_0x1a8_0x30000
  • C:\Muldrop\dmp_0x88_0x20000
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\How Recovery Files.txt
  • C:\Muldrop\dmp_0x1b8_0x10000
  • C:\Muldrop\dmp_0x1b8_0x20000
  • C:\Muldrop\dmp_0x1b8_0x30000
  • C:\Muldrop\dmp_0x1bc_0x10000
  • C:\Muldrop\dmp_0x1bc_0x20000
  • C:\Muldrop\dmp_0x1bc_0x30000
  • C:\Muldrop\dmp_0x1c0_0x10000
  • C:\Muldrop\dmp_0x1c0_0x20000
  • <STUBS_DIR>\360tray\How Recovery Files.txt
  • C:\Muldrop\dmp_0x1c0_0x30000
  • <STUBS_DIR>\aion\How Recovery Files.txt
  • <STUBS_DIR>\ageofconan\How Recovery Files.txt
  • C:\Muldrop\dmp_0x88_0x10000
  • <STUBS_DIR>\ash\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\How Recovery Files.txt
  • <STUBS_DIR>\ashAvast\How Recovery Files.txt
  • <STUBS_DIR>\avgcc\How Recovery Files.txt
  • <STUBS_DIR>\cbank\How Recovery Files.txt
  • <STUBS_DIR>\BBClient\How Recovery Files.txt
  • <STUBS_DIR>\cabalmain\How Recovery Files.txt
  • <STUBS_DIR>\cbmain\How Recovery Files.txt
  • <STUBS_DIR>\chrome\How Recovery Files.txt
  • %WINDIR%\Web\printers\How Recovery Files.txt
  • <STUBS_DIR>\egni\How Recovery Files.txt
  • <STUBS_DIR>\ekrn\How Recovery Files.txt
  • C:\Muldrop\npgdpnq.mph_5
  • <STUBS_DIR>\elbank\How Recovery Files.txt
  • <STUBS_DIR>\elementclient\How Recovery Files.txt
  • <STUBS_DIR>\el_cli\How Recovery Files.txt
  • <STUBS_DIR>\firefox\How Recovery Files.txt
  • <STUBS_DIR>\fsav\How Recovery Files.txt
  • C:\Muldrop\Sztufn.emm_0
  • <STUBS_DIR>\ecmd\How Recovery Files.txt
  • <STUBS_DIR>\fsav32\How Recovery Files.txt
  • <STUBS_DIR>\fsavaui\How Recovery Files.txt
  • <STUBS_DIR>\fsavgui\How Recovery Files.txt
  • <STUBS_DIR>\gc\How Recovery Files.txt
  • <STUBS_DIR>\ge\How Recovery Files.txt
  • <STUBS_DIR>\googletalk\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\How Recovery Files.txt
  • C:\Muldrop\unq3.unq_0
  • C:\Muldrop\dmp_0x1a8_0x20000
  • <STUBS_DIR>\Drwebwcl\How Recovery Files.txt
  • C:\Muldrop\npgdpnq.mph_3
  • <STUBS_DIR>\drweb386\How Recovery Files.txt
  • C:\Muldrop\npgdpnq.mph_4
  • <STUBS_DIR>\cbsmain\How Recovery Files.txt
  • <STUBS_DIR>\ccapp\How Recovery Files.txt
  • <STUBS_DIR>\clbank\How Recovery Files.txt
  • <STUBS_DIR>\ClamWin\How Recovery Files.txt
  • C:\Muldrop\M15XpD_0
  • <STUBS_DIR>\clmain\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\How Recovery Files.txt
  • <STUBS_DIR>\client7\How Recovery Files.txt
  • <STUBS_DIR>\clntw32\How Recovery Files.txt
  • <STUBS_DIR>\contactNG\How Recovery Files.txt
  • <STUBS_DIR>\dekaron\How Recovery Files.txt
  • C:\Muldrop\npgdpnq.mph_0
  • <STUBS_DIR>\dnf\How Recovery Files.txt
  • <STUBS_DIR>\drweb\How Recovery Files.txt
  • %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\How Recovery Files.txt
  • C:\Muldrop\npgdpnq.mph_1
  • <STUBS_DIR>\Drweb32w\How Recovery Files.txt
  • C:\Muldrop\npgdpnq.mph_2
  • <STUBS_DIR>\Drwebupw\How Recovery Files.txt
  • %ProgramFiles%\MSN\MSNCoreFiles\OOBE\How Recovery Files.txt
Deletes the following files:
  • %TEMP%\tmp3.tmp
  • %TEMP%\tmp4.tmp
Moves the following system files:
  • from %WINDIR%\_default.pif to %WINDIR%\_default.pif.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll.rapid
  • from %WINDIR%\Web\bullet.gif to %WINDIR%\Web\bullet.gif.rapid
  • from %WINDIR%\Web\printers\images\ipp_0012.gif to %WINDIR%\Web\printers\images\ipp_0012.gif.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll.rapid
  • from %WINDIR%\vmmreg32.dll to %WINDIR%\vmmreg32.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll.rapid
  • from %WINDIR%\Web\printers\images\ipp_0005.gif to %WINDIR%\Web\printers\images\ipp_0005.gif.rapid
  • from %WINDIR%\twunk_32.exe to %WINDIR%\twunk_32.exe.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll.rapid
  • from %WINDIR%\Web\printers\images\ipp_0004.gif to %WINDIR%\Web\printers\images\ipp_0004.gif.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll.rapid
  • from %WINDIR%\vb.ini to %WINDIR%\vb.ini.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll.rapid
  • from %WINDIR%\updspapi.log to %WINDIR%\updspapi.log.rapid
  • from %WINDIR%\Web\printers\images\ipp_0003.gif to %WINDIR%\Web\printers\images\ipp_0003.gif.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll.rapid
  • from %WINDIR%\vbaddin.ini to %WINDIR%\vbaddin.ini.rapid
  • from %WINDIR%\Web\deskmovr.htt to %WINDIR%\Web\deskmovr.htt.rapid
  • from %WINDIR%\XXInstall\Scripts\apply_theme.vbs to %WINDIR%\XXInstall\Scripts\apply_theme.vbs.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll.rapid
  • from %WINDIR%\Web\printers\ipp_0004.asp to %WINDIR%\Web\printers\ipp_0004.asp.rapid
  • from %WINDIR%\XXInstall\Scripts\bcode-start.vbs to %WINDIR%\XXInstall\Scripts\bcode-start.vbs.rapid
  • from %WINDIR%\Web\printers\ipp_0003.asp to %WINDIR%\Web\printers\ipp_0003.asp.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll.rapid
  • from %WINDIR%\XXInstall\Scripts\bcode-start-stop.vbs to %WINDIR%\XXInstall\Scripts\bcode-start-stop.vbs.rapid
  • from %WINDIR%\Web\printers\ipp_0002.asp to %WINDIR%\Web\printers\ipp_0002.asp.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll.rapid
  • from %WINDIR%\Web\printers\images\ipp_0015.gif to %WINDIR%\Web\printers\images\ipp_0015.gif.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll.rapid
  • from %WINDIR%\Web\printers\ipp_0001.asp to %WINDIR%\Web\printers\ipp_0001.asp.rapid
  • from %WINDIR%\XXInstall\Scripts\antivm.exe to %WINDIR%\XXInstall\Scripts\antivm.exe.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll.rapid
  • from %WINDIR%\Web\printers\ipp_0000.inc to %WINDIR%\Web\printers\ipp_0000.inc.rapid
  • from %WINDIR%\XXInstall\Scripts\antivm.bat to %WINDIR%\XXInstall\Scripts\antivm.bat.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll.rapid
  • from %WINDIR%\Web\exclam.gif to %WINDIR%\Web\exclam.gif.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.cat to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.cat.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.30729.4148.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.30729.4148.cat.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.4148.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.4148.policy.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.4148.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.4148.cat.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.policy.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.cat.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.4148.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.4148.policy.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.4148.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.4148.cat.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.21022.8.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.21022.8.policy.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.21022.8.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.21022.8.cat.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.policy.rapid
  • from %WINDIR%\Web\printers\images\ipp_0002.gif to %WINDIR%\Web\printers\images\ipp_0002.gif.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.4148.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.4148.policy.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.cat to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.cat.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.cat to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.cat.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.4148.cat to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.4148.cat.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.policy.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.cat to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.cat.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.policy.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.cat to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.cat.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.policy.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.30729.4148.policy to %WINDIR%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.30729.4148.policy.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll.rapid
  • from %WINDIR%\Temp\Perflib_Perfdata_7e8.dat to %WINDIR%\Temp\Perflib_Perfdata_7e8.dat.rapid
  • from %WINDIR%\twunk_16.exe to %WINDIR%\twunk_16.exe.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll.rapid
  • from %WINDIR%\twain_32.dll to %WINDIR%\twain_32.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll.rapid
  • from %WINDIR%\twain.dll to %WINDIR%\twain.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll.rapid
  • from %WINDIR%\tsoc.log to %WINDIR%\tsoc.log.rapid
  • from %WINDIR%\twain_32\wiatwain.ds to %WINDIR%\twain_32\wiatwain.ds.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll.rapid
  • from %WINDIR%\TASKMAN.EXE to %WINDIR%\TASKMAN.EXE.rapid
  • from %WINDIR%\tabletoc.log to %WINDIR%\tabletoc.log.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll to %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.policy.rapid
  • from %WINDIR%\XXInstall\Scripts\bcode-stop.vbs to %WINDIR%\XXInstall\Scripts\bcode-stop.vbs.rapid
  • from %WINDIR%\Web\printers\ipp_0010.asp to %WINDIR%\Web\printers\ipp_0010.asp.rapid
  • from %WINDIR%\XXInstall\Scripts\smart_assembly_fix.reg to %WINDIR%\XXInstall\Scripts\smart_assembly_fix.reg.rapid
  • from %WINDIR%\wiaservc.log to %WINDIR%\wiaservc.log.rapid
  • from %WINDIR%\wiadebug.log to %WINDIR%\wiadebug.log.rapid
  • from %WINDIR%\XXInstall\Scripts\safely.reg to %WINDIR%\XXInstall\Scripts\safely.reg.rapid
  • from %WINDIR%\XXInstall\hashdeep.exe to %WINDIR%\XXInstall\hashdeep.exe.rapid
  • from %WINDIR%\XXInstall\Scripts\reboot_on_bsod.reg to %WINDIR%\XXInstall\Scripts\reboot_on_bsod.reg.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll.rapid
  • from %WINDIR%\XXInstall\Scripts\prefs.js to %WINDIR%\XXInstall\Scripts\prefs.js.rapid
  • from %WINDIR%\Web\tips.gif to %WINDIR%\Web\tips.gif.rapid
  • from %WINDIR%\XXInstall\exdir.exe to %WINDIR%\XXInstall\exdir.exe.rapid
  • from %WINDIR%\Web\printers\prtwebvw.css to %WINDIR%\Web\printers\prtwebvw.css.rapid
  • from %WINDIR%\XXInstall\Scripts\perf.reg to %WINDIR%\XXInstall\Scripts\perf.reg.rapid
  • from %WINDIR%\Web\tip.htm to %WINDIR%\Web\tip.htm.rapid
  • from %WINDIR%\Web\Wallpaper\Wind.jpg to %WINDIR%\Web\Wallpaper\Wind.jpg.rapid
  • from %WINDIR%\Web\safemode.htt to %WINDIR%\Web\safemode.htt.rapid
  • from %WINDIR%\XXInstall\Scripts\not_collect_offline.reg to %WINDIR%\XXInstall\Scripts\not_collect_offline.reg.rapid
  • from %WINDIR%\XXInstall\events.exe to %WINDIR%\XXInstall\events.exe.rapid
  • from %WINDIR%\Web\Wallpaper\Vortec space.jpg to %WINDIR%\Web\Wallpaper\Vortec space.jpg.rapid
  • from %WINDIR%\XXInstall\Scripts\norun.reg to %WINDIR%\XXInstall\Scripts\norun.reg.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll.rapid
  • from %WINDIR%\XXInstall\install.bat to %WINDIR%\XXInstall\install.bat.rapid
  • from %WINDIR%\Web\Wallpaper\Windows XP.jpg to %WINDIR%\Web\Wallpaper\Windows XP.jpg.rapid
  • from %WINDIR%\XXInstall\Scripts\startup_ar.bat to %WINDIR%\XXInstall\Scripts\startup_ar.bat.rapid
  • from %WINDIR%\XXInstall\vminstall.exe to %WINDIR%\XXInstall\vminstall.exe.rapid
  • from %WINDIR%\Zapotec.bmp to %WINDIR%\Zapotec.bmp.rapid
  • from %WINDIR%\WMSysPr9.prx to %WINDIR%\WMSysPr9.prx.rapid
  • from %WINDIR%\wmsetup.log to %WINDIR%\wmsetup.log.rapid
  • from %WINDIR%\winnt256.bmp to %WINDIR%\winnt256.bmp.rapid
  • from %WINDIR%\winnt.bmp to %WINDIR%\winnt.bmp.rapid
  • from %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll to %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll.rapid
  • from %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll to %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.Wrapper.dll.rapid
  • from %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll to %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll.rapid
  • from %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll to %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492\System.EnterpriseServices.dll.rapid
  • from %WINDIR%\winhlp32.exe to %WINDIR%\winhlp32.exe.rapid
  • from %WINDIR%\XXInstall\install_ar.bat to %WINDIR%\XXInstall\install_ar.bat.rapid
  • from %WINDIR%\XXInstall\screen.exe to %WINDIR%\XXInstall\screen.exe.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll.rapid
  • from %WINDIR%\XXInstall\Scripts\WindowsKiller.ini to %WINDIR%\XXInstall\Scripts\WindowsKiller.ini.rapid
  • from %WINDIR%\XXInstall\ps.exe to %WINDIR%\XXInstall\ps.exe.rapid
  • from %WINDIR%\XXInstall\Scripts\taskmgr.reg to %WINDIR%\XXInstall\Scripts\taskmgr.reg.rapid
  • from %WINDIR%\XXInstall\install_small.bat to %WINDIR%\XXInstall\install_small.bat.rapid
  • from %WINDIR%\winhelp.exe to %WINDIR%\winhelp.exe.rapid
  • from %WINDIR%\WindowsUpdate.log to %WINDIR%\WindowsUpdate.log.rapid
  • from %WINDIR%\XXInstall\Scripts\startup_bsod.bat to %WINDIR%\XXInstall\Scripts\startup_bsod.bat.rapid
  • from %WINDIR%\win.ini to %WINDIR%\win.ini.rapid
  • from %WINDIR%\Web\Wallpaper\Purple flower.jpg to %WINDIR%\Web\Wallpaper\Purple flower.jpg.rapid
  • from %WINDIR%\Web\printers\ipp_0005.asp to %WINDIR%\Web\printers\ipp_0005.asp.rapid
  • from %WINDIR%\XXInstall\devcon.exe to %WINDIR%\XXInstall\devcon.exe.rapid
  • from %WINDIR%\XXInstall\Scripts\KernelDump.reg to %WINDIR%\XXInstall\Scripts\KernelDump.reg.rapid
  • from %WINDIR%\Web\Wallpaper\Follow.jpg to %WINDIR%\Web\Wallpaper\Follow.jpg.rapid
  • from %WINDIR%\Web\Wallpaper\Crystal.jpg to %WINDIR%\Web\Wallpaper\Crystal.jpg.rapid
  • from %WINDIR%\Web\printers\ipp_0013.asp to %WINDIR%\Web\printers\ipp_0013.asp.rapid
  • from %WINDIR%\XXInstall\Scripts\ipv6_disable.reg to %WINDIR%\XXInstall\Scripts\ipv6_disable.reg.rapid
  • from %WINDIR%\Web\Wallpaper\Bliss.bmp to %WINDIR%\Web\Wallpaper\Bliss.bmp.rapid
  • from %WINDIR%\Web\Wallpaper\Azul.jpg to %WINDIR%\Web\Wallpaper\Azul.jpg.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll.rapid
  • from %WINDIR%\XXInstall\Scripts\eventmon-startlog.vbs to %WINDIR%\XXInstall\Scripts\eventmon-startlog.vbs.rapid
  • from %WINDIR%\Web\Wallpaper\Autumn.jpg to %WINDIR%\Web\Wallpaper\Autumn.jpg.rapid
  • from %WINDIR%\Web\Wallpaper\Stonehenge.jpg to %WINDIR%\Web\Wallpaper\Stonehenge.jpg.rapid
  • from %WINDIR%\XXInstall\Scripts\eventmon-setup.vbs to %WINDIR%\XXInstall\Scripts\eventmon-setup.vbs.rapid
  • from %WINDIR%\Web\Wallpaper\Ascent.jpg to %WINDIR%\Web\Wallpaper\Ascent.jpg.rapid
  • from %WINDIR%\Web\printers\ipp_0007.asp to %WINDIR%\Web\printers\ipp_0007.asp.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll.rapid
  • from %WINDIR%\XXInstall\Scripts\CompleteDump.reg to %WINDIR%\XXInstall\Scripts\CompleteDump.reg.rapid
  • from %WINDIR%\Web\printers\ipp_0006.asp to %WINDIR%\Web\printers\ipp_0006.asp.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll.rapid
  • from %WINDIR%\Web\printers\ipp_0014.asp to %WINDIR%\Web\printers\ipp_0014.asp.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll.rapid
  • from %WINDIR%\XXInstall\Scripts\kill_saves.vbs to %WINDIR%\XXInstall\Scripts\kill_saves.vbs.rapid
  • from %WINDIR%\Web\printers\ipp_res.inc to %WINDIR%\Web\printers\ipp_res.inc.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcirt.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcirt.dll.rapid
  • from %WINDIR%\XXInstall\Scripts\noballon.reg to %WINDIR%\XXInstall\Scripts\noballon.reg.rapid
  • from %WINDIR%\Web\printers\page1.asp to %WINDIR%\Web\printers\page1.asp.rapid
  • from %WINDIR%\Web\Wallpaper\Ripple.jpg to %WINDIR%\Web\Wallpaper\Ripple.jpg.rapid
  • from %WINDIR%\Web\printers\ipp_util.inc to %WINDIR%\Web\printers\ipp_util.inc.rapid
  • from %WINDIR%\XXInstall\cmdow.exe to %WINDIR%\XXInstall\cmdow.exe.rapid
  • from %WINDIR%\XXInstall\Scripts\ncsi_disable.reg to %WINDIR%\XXInstall\Scripts\ncsi_disable.reg.rapid
  • from %WINDIR%\Web\Wallpaper\Red moon desert.jpg to %WINDIR%\Web\Wallpaper\Red moon desert.jpg.rapid
  • from %WINDIR%\Web\Wallpaper\Radiance.jpg to %WINDIR%\Web\Wallpaper\Radiance.jpg.rapid
  • from %WINDIR%\Web\Wallpaper\Tulips.jpg to %WINDIR%\Web\Wallpaper\Tulips.jpg.rapid
  • from %WINDIR%\Web\Wallpaper\Friend.jpg to %WINDIR%\Web\Wallpaper\Friend.jpg.rapid
  • from %WINDIR%\XXInstall\Scripts\LanDisabler.vbs to %WINDIR%\XXInstall\Scripts\LanDisabler.vbs.rapid
  • from %WINDIR%\Web\Wallpaper\Power.jpg to %WINDIR%\Web\Wallpaper\Power.jpg.rapid
  • from %WINDIR%\Web\printers\ipp_adsi.inc to %WINDIR%\Web\printers\ipp_adsi.inc.rapid
  • from %WINDIR%\Web\Wallpaper\Peace.jpg to %WINDIR%\Web\Wallpaper\Peace.jpg.rapid
  • from %WINDIR%\XXInstall\Scripts\kill_windows.vbs to %WINDIR%\XXInstall\Scripts\kill_windows.vbs.rapid
  • from %WINDIR%\Web\Wallpaper\Moon flower.jpg to %WINDIR%\Web\Wallpaper\Moon flower.jpg.rapid
  • from %WINDIR%\Web\printers\ipp_0015.asp to %WINDIR%\Web\printers\ipp_0015.asp.rapid
  • from %WINDIR%\Web\Wallpaper\Home.jpg to %WINDIR%\Web\Wallpaper\Home.jpg.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll to %WINDIR%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll.rapid
  • from %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll to %WINDIR%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll.rapid
  • from %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.3053.policy to %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.3053.policy.rapid
Moves the following files:
  • from C:\Muldrop\unq4.unq_0 to C:\Muldrop\unq4.unq_0.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.rapid
  • from <ANALYSE_DIR>\DWS-DUMP\0B4C_dws_cmd.exe to <ANALYSE_DIR>\DWS-DUMP\0B4C_dws_cmd.exe.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll.rapid
  • from <ANALYSE_DIR>\DWS-DUMP\0B44_dws_vssadmin.exe to <ANALYSE_DIR>\DWS-DUMP\0B44_dws_vssadmin.exe.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.rapid
  • from <ANALYSE_DIR>\DWS-DUMP\0B14_dws_<File name>.exe to <ANALYSE_DIR>\DWS-DUMP\0B14_dws_<File name>.exe.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.rapid
  • from <APATH_DUMPS_DIR>\0B14_<File name>.exe_0.ndmp to <APATH_DUMPS_DIR>\0B14_<File name>.exe_0.ndmp.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.rapid
  • from <ANALYSE_DIR>\PET-DUMP\0B44_pet_vssadmin.exe to <ANALYSE_DIR>\PET-DUMP\0B44_pet_vssadmin.exe.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.rapid
  • from <ANALYSE_DIR>\PET-DUMP\0B14_pet_<File name>.exe to <ANALYSE_DIR>\PET-DUMP\0B14_pet_<File name>.exe.rapid
  • from %APPDATA%\winscp.rnd to %APPDATA%\winscp.rnd.rapid
  • from %APPDATA%\Mozilla\Firefox\profiles.ini to %APPDATA%\Mozilla\Firefox\profiles.ini.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.rapid
  • from <APATH_DUMPS_DIR>\0B44_vssadmin.exe_0.ndmp to <APATH_DUMPS_DIR>\0B44_vssadmin.exe_0.ndmp.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll.rapid
  • from %TEMP%\M15XoD to %TEMP%\M15XoD.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.rapid
  • from %TEMP%\nsu2.tmp\System.dll to %TEMP%\nsu2.tmp\System.dll.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.rapid
  • from <APATH_DUMPS_DIR>\0B4C_cmd.exe_0.ndmp to <APATH_DUMPS_DIR>\0B4C_cmd.exe_0.ndmp.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND19.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND19.WAV.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00630000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00630000.alloc.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00520000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00520000.alloc.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00510000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00510000.alloc.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00450000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00450000.alloc.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003B0000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003B0000.alloc.rapid
  • from %ProgramFiles%\Outlook Express\wabmig.exe to %ProgramFiles%\Outlook Express\wabmig.exe.rapid
  • from %ProgramFiles%\Outlook Express\wabimp.dll to %ProgramFiles%\Outlook Express\wabimp.dll.rapid
  • from %ProgramFiles%\Outlook Express\wabfind.dll to %ProgramFiles%\Outlook Express\wabfind.dll.rapid
  • from %ProgramFiles%\Outlook Express\wab.exe to %ProgramFiles%\Outlook Express\wab.exe.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003A0000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x003A0000.alloc.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00930000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00930000.alloc.rapid
  • from %ProgramFiles%\Outlook Express\oeimport.dll to %ProgramFiles%\Outlook Express\oeimport.dll.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00390000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00390000.alloc.rapid
  • from %ProgramFiles%\Outlook Express\msoeres.dll to %ProgramFiles%\Outlook Express\msoeres.dll.rapid
  • from %ProgramFiles%\Outlook Express\msoe.txt to %ProgramFiles%\Outlook Express\msoe.txt.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00380000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00380000.alloc.rapid
  • from %ProgramFiles%\Outlook Express\msoe.dll to %ProgramFiles%\Outlook Express\msoe.dll.rapid
  • from %ProgramFiles%\Outlook Express\msimn.exe to %ProgramFiles%\Outlook Express\msimn.exe.rapid
  • from %ProgramFiles%\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk to %ProgramFiles%\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk.rapid
  • from %ProgramFiles%\Online Services\Refer me to more Internet Service Providers.lnk to %ProgramFiles%\Online Services\Refer me to more Internet Service Providers.lnk.rapid
  • from %ProgramFiles%\NetMeeting\wb32.exe to %ProgramFiles%\NetMeeting\wb32.exe.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00330000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00330000.alloc.rapid
  • from %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml to %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml.rapid
  • from %ProgramFiles%\NetMeeting\TestSnd.wav to %ProgramFiles%\NetMeeting\TestSnd.wav.rapid
  • from %ProgramFiles%\Outlook Express\oemiglib.dll to %ProgramFiles%\Outlook Express\oemiglib.dll.rapid
  • from %ProgramFiles%\Outlook Express\setup50.exe to %ProgramFiles%\Outlook Express\setup50.exe.rapid
  • from <ANALYSE_DIR>\PET-DUMP\0B4C_pet_cmd.exe to <ANALYSE_DIR>\PET-DUMP\0B4C_pet_cmd.exe.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.rapid
  • from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~ to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json.rapid
  • from %APPDATA%\Microsoft\Media Player\0007F0B7.wpl to %APPDATA%\Microsoft\Media Player\0007F0B7.wpl.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFE0000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFE0000.alloc.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFDF000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFDF000.alloc.rapid
  • from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk.rapid
  • from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf.rapid
  • from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFD5000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFD5000.alloc.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.rapid
  • from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini.rapid
  • from %APPDATA%\Microsoft\Internet Explorer\Desktop.htt to %APPDATA%\Microsoft\Internet Explorer\Desktop.htt.rapid
  • from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00990000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00990000.alloc.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css.rapid
  • from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll.rapid
  • from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll.rapid
  • from %APPDATA%\desktop.ini to %APPDATA%\desktop.ini.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7F6F0000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7F6F0000.alloc.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00B60000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00B60000.alloc.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00A80000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x00A80000.alloc.rapid
  • from <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFB0000.alloc to <ANALYSE_DIR>\ALLOC\dmp_0x0B14_0x7FFB0000.alloc.rapid
  • from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND528.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND528.WAV.rapid
  • from C:\Muldrop\dmp_0x1bc_0x30000 to C:\Muldrop\dmp_0x1bc_0x30000.rapid
  • from C:\Muldrop\dmp_0x1bc_0x20000 to C:\Muldrop\dmp_0x1bc_0x20000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND50.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND50.WAV.rapid
  • from C:\Muldrop\dmp_0x1bc_0x10000 to C:\Muldrop\dmp_0x1bc_0x10000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND5.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND5.WAV.rapid
  • from C:\Muldrop\dmp_0x1b8_0x30000 to C:\Muldrop\dmp_0x1b8_0x30000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV.rapid
  • from C:\Muldrop\dmp_0x1b8_0x20000 to C:\Muldrop\dmp_0x1b8_0x20000.rapid
  • from C:\Muldrop\dmp_0x1b8_0x10000 to C:\Muldrop\dmp_0x1b8_0x10000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND49.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND49.WAV.rapid
  • from C:\Muldrop\dmp_0x1a8_0x30000 to C:\Muldrop\dmp_0x1a8_0x30000.rapid
  • from C:\Muldrop\dmp_0x1c0_0x20000 to C:\Muldrop\dmp_0x1c0_0x20000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND7.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND7.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND53.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND53.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND45.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND45.WAV.rapid
  • from C:\Muldrop\dmp_0x1a4_0x30000 to C:\Muldrop\dmp_0x1a4_0x30000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND42.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND42.WAV.rapid
  • from C:\Muldrop\dmp_0x1a4_0x20000 to C:\Muldrop\dmp_0x1a4_0x20000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND4.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND4.WAV.rapid
  • from C:\Muldrop\dmp_0x1a4_0x10000 to C:\Muldrop\dmp_0x1a4_0x10000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND39.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND39.WAV.rapid
  • from C:\Muldrop\dmp_0x198_0x30000 to C:\Muldrop\dmp_0x198_0x30000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND38.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND38.WAV.rapid
  • from C:\Muldrop\dmp_0x198_0x20000 to C:\Muldrop\dmp_0x198_0x20000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND36.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND36.WAV.rapid
  • from C:\Muldrop\dmp_0x198_0x10000 to C:\Muldrop\dmp_0x198_0x10000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND35.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND35.WAV.rapid
  • from C:\Muldrop\dmp_0x1a8_0x20000 to C:\Muldrop\dmp_0x1a8_0x20000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND43.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND43.WAV.rapid
  • from C:\Muldrop\dmp_0x1a8_0x10000 to C:\Muldrop\dmp_0x1a8_0x10000.rapid
  • from %ProgramFiles%\NetMeeting\rrcm.dll to %ProgramFiles%\NetMeeting\rrcm.dll.rapid
  • from C:\Muldrop\dmp_0x14c_0x30000 to C:\Muldrop\dmp_0x14c_0x30000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND55.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND55.WAV.rapid
  • from C:\Muldrop\Sztufn.emm_0 to C:\Muldrop\Sztufn.emm_0.rapid
  • from C:\Muldrop\npgdpnq.mph_5 to C:\Muldrop\npgdpnq.mph_5.rapid
  • from C:\Muldrop\npgdpnq.mph_4 to C:\Muldrop\npgdpnq.mph_4.rapid
  • from %ProgramFiles%\Windows NT\Pinball\table.bmp to %ProgramFiles%\Windows NT\Pinball\table.bmp.rapid
  • from C:\Muldrop\npgdpnq.mph_3 to C:\Muldrop\npgdpnq.mph_3.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND999.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND999.WAV.rapid
  • from C:\Muldrop\npgdpnq.mph_2 to C:\Muldrop\npgdpnq.mph_2.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND9.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND9.WAV.rapid
  • from C:\Muldrop\npgdpnq.mph_1 to C:\Muldrop\npgdpnq.mph_1.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND827.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND827.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND8.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND8.WAV.rapid
  • from C:\Muldrop\npgdpnq.mph_0 to C:\Muldrop\npgdpnq.mph_0.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND735.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND735.WAV.rapid
  • from C:\Muldrop\dmp_0x1c0_0x30000 to C:\Muldrop\dmp_0x1c0_0x30000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND54.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND54.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND713.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND713.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND68.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND68.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND65.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND65.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND6.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND6.WAV.rapid
  • from C:\Muldrop\jogp.fyf_0 to C:\Muldrop\jogp.fyf_0.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND58.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND58.WAV.rapid
  • from C:\Muldrop\dmp_0xd8_0x20000 to C:\Muldrop\dmp_0xd8_0x20000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND57.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND57.WAV.rapid
  • from C:\Muldrop\dmp_0xd8_0x10000 to C:\Muldrop\dmp_0xd8_0x10000.rapid
  • from C:\Muldrop\dmp_0x88_0x30000 to C:\Muldrop\dmp_0x88_0x30000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND563.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND563.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND560.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND560.WAV.rapid
  • from C:\Muldrop\dmp_0x88_0x20000 to C:\Muldrop\dmp_0x88_0x20000.rapid
  • from C:\Muldrop\dmp_0x88_0x10000 to C:\Muldrop\dmp_0x88_0x10000.rapid
  • from C:\Muldrop\unq3.unq_0 to C:\Muldrop\unq3.unq_0.rapid
  • from C:\Muldrop\M15XpD_0 to C:\Muldrop\M15XpD_0.rapid
  • from %ProgramFiles%\Outlook Express\oemig50.exe to %ProgramFiles%\Outlook Express\oemig50.exe.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND34.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND34.WAV.rapid
  • from C:\Muldrop\dmp_0x14c_0x10000 to C:\Muldrop\dmp_0x14c_0x10000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\FONT.DAT to %ProgramFiles%\Windows NT\Pinball\FONT.DAT.rapid
  • from %ProgramFiles%\Windows NT\hypertrm.exe to %ProgramFiles%\Windows NT\hypertrm.exe.rapid
  • from %ProgramFiles%\Windows NT\htrn_jis.dll to %ProgramFiles%\Windows NT\htrn_jis.dll.rapid
  • from %ProgramFiles%\Windows NT\dialer.exe to %ProgramFiles%\Windows NT\dialer.exe.rapid
  • from %ProgramFiles%\Windows NT\Accessories\write.wpc to %ProgramFiles%\Windows NT\Accessories\write.wpc.rapid
  • from %ProgramFiles%\Windows NT\Accessories\wordpad.exe to %ProgramFiles%\Windows NT\Accessories\wordpad.exe.rapid
  • from %ProgramFiles%\Windows NT\Accessories\mswrd8.wpc to %ProgramFiles%\Windows NT\Accessories\mswrd8.wpc.rapid
  • from %ProgramFiles%\Windows NT\Accessories\mswrd6.wpc to %ProgramFiles%\Windows NT\Accessories\mswrd6.wpc.rapid
  • from %ProgramFiles%\Windows Media Player\wmpns.dll to %ProgramFiles%\Windows Media Player\wmpns.dll.rapid
  • from %ProgramFiles%\Windows Media Player\wmplayer.exe to %ProgramFiles%\Windows Media Player\wmplayer.exe.rapid
  • from %ProgramFiles%\Windows Media Player\wmpband.dll to %ProgramFiles%\Windows Media Player\wmpband.dll.rapid
  • from %ProgramFiles%\Windows Media Player\Skins\Revert.wmz to %ProgramFiles%\Windows Media Player\Skins\Revert.wmz.rapid
  • from %ProgramFiles%\Windows Media Player\Skins\compact.wmz to %ProgramFiles%\Windows Media Player\Skins\compact.wmz.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND30.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND30.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\PINBALL.DAT to %ProgramFiles%\Windows NT\Pinball\PINBALL.DAT.rapid
  • from %ProgramFiles%\Windows NT\Pinball\PINBALL.EXE to %ProgramFiles%\Windows NT\Pinball\PINBALL.EXE.rapid
  • from %ProgramFiles%\Windows Media Player\npdrmv2.dll to %ProgramFiles%\Windows Media Player\npdrmv2.dll.rapid
  • from %ProgramFiles%\Windows Media Player\mpvis.dll to %ProgramFiles%\Windows Media Player\mpvis.dll.rapid
  • from %ProgramFiles%\Windows Media Player\mplayer2.exe to %ProgramFiles%\Windows Media Player\mplayer2.exe.rapid
  • from %ProgramFiles%\Windows Media Player\migrate.exe to %ProgramFiles%\Windows Media Player\migrate.exe.rapid
  • from %ProgramFiles%\Windows Media Player\custsat.dll to %ProgramFiles%\Windows Media Player\custsat.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.rapid
  • from %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll to %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll.rapid
  • from %ProgramFiles%\Windows Media Player\setup_wm.exe to %ProgramFiles%\Windows Media Player\setup_wm.exe.rapid
  • from %ProgramFiles%\Windows Media Player\npdsplay.dll to %ProgramFiles%\Windows Media Player\npdsplay.dll.rapid
  • from C:\Muldrop\dmp_0x14c_0x20000 to C:\Muldrop\dmp_0x14c_0x20000.rapid
  • from %ProgramFiles%\Windows Media Player\npwmsdrm.dll to %ProgramFiles%\Windows Media Player\npwmsdrm.dll.rapid
  • from C:\Muldrop\dmp_0x1c0_0x10000 to C:\Muldrop\dmp_0x1c0_0x10000.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND3.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND3.WAV.rapid
  • from C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_1 to C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_1.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND29.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND29.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND28.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND28.WAV.rapid
  • from C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_0 to C:\Muldrop\88744D2A29102FC88ECF505DD2E984FC.npg_0.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND27.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND27.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND26.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND26.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND25.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND25.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND243.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND243.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND240.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND240.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND24.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND24.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND22.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND22.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND21.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND21.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND1.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND1.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\PINBALL.MID to %ProgramFiles%\Windows NT\Pinball\PINBALL.MID.rapid
  • from %ProgramFiles%\Windows NT\Pinball\PINBALL2.MID to %ProgramFiles%\Windows NT\Pinball\PINBALL2.MID.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND18.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND18.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND17.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND17.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND16.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND16.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND14.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND14.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND136.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND136.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND131.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND131.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND13.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND13.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND12.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND12.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND112.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND112.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND111.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND111.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND108.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND108.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND105.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND105.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND104.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND104.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND20.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND20.WAV.rapid
  • from %ProgramFiles%\Windows NT\Pinball\SOUND181.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND181.WAV.rapid
  • from %ProgramFiles%\MSN\MSNCoreFiles\OOBE\signup.mar to %ProgramFiles%\MSN\MSNCoreFiles\OOBE\signup.mar.rapid
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous:
Creates and executes the following:
  • '<Full path to file>'
Executes the following:
  • '<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
  • '<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} recoveryenabled No
  • '<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  • '<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP
  • '<SYSTEM32>\cmd.exe' /c wmic SHADOWCOPY DELETE
  • '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /TN Encrypter /TR %APPDATA%\info.exe
  • '<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /TN EncrypterSt /TR %APPDATA%\info.exe

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android