Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'YqkDFVCKvVd3vgF1"<Full path to virus>" /SkipReg' = '"<Full path to virus>" /SkipRe'
Infects the following executable files:
- <APATH_<Auxiliary name>.EXE>.1
- <APATH_<Auxiliary name>.EXE>.2
- <APATH_<Auxiliary name>.EXE>.3
- <APATH_DUMPER_NET.EXE>.1
- <Auxiliary name>.1
- <Auxiliary name>.2
- <Auxiliary name>.3
Malicious functions:
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /Quiet /All
- '<SYSTEM32>\cmd.exe' /C vssadmin Delete Shadows /Quiet /All
Modifies file system :
Creates the following files:
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.5\SQL\EN\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\EN\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\readme_liesmich_encryptor_raas.txt
- %WINDIR%\inf\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v1.0.3705\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Media\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\mmTour\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\htmlTour\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Graphics\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Graphics\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\readme_liesmich_encryptor_raas.txt
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\readme_liesmich_encryptor_raas.txt
- %WINDIR%\$NtUninstallWIC$\spuninst\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\Services\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\Microsoft Shared\Stationery\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\content\branding\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\readme_liesmich_encryptor_raas.txt
- %APPDATA%\Microsoft\Address Book\readme_liesmich_encryptor_raas.txt
- C:\Documents and Settings\Default User\Templates\readme_liesmich_encryptor_raas.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\readme_liesmich_encryptor_raas.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\readme_liesmich_encryptor_raas.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\readme_liesmich_encryptor_raas.txt
- %APPDATA%\Microsoft\Internet Explorer\readme_liesmich_encryptor_raas.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\readme_liesmich_encryptor_raas.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\readme_liesmich_encryptor_raas.txt
- <Current directory>\readme_liesmich_encryptor_raas.txt
- %ALLUSERSPROFILE%\DRM\readme_liesmich_encryptor_raas.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\readme_liesmich_encryptor_raas.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\readme_liesmich_encryptor_raas.txt
- %HOMEPATH%\Templates\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\ExtSearch\sources\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\ExtSearch\sources\RegExp\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\ExtSearch\doc\readme_liesmich_encryptor_raas.txt
- C:\Far2\readme_liesmich_encryptor_raas.txt
- C:\Far2\PluginSDK\Headers.c\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\FTP\readme_liesmich_encryptor_raas.txt
- C:\Far2\Documentation\rus\readme_liesmich_encryptor_raas.txt
- C:\Far2\Documentation\eng\readme_liesmich_encryptor_raas.txt
- C:\Far2\Addons\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\Colorer\hrc\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\Colorer\hrc\auto\types\readme_liesmich_encryptor_raas.txt
- C:\Far2\Plugins\7-Zip\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\places\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\update\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\tree\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\toolbar\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\res\html\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\Windows Media Player\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\Outlook Express\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\NetMeeting\readme_liesmich_encryptor_raas.txt
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\readme_liesmich_encryptor_raas.txt
- <Auxiliary element>
- %PROGRAM_FILES%\Windows NT\Pinball\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\Messenger\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\res\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\Movie Maker\Shared\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\Movie Maker\Shared\Profiles\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\printpreview\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\media\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\icons\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\splitter\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\radio\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\readme_liesmich_encryptor_raas.txt
- %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\readme_liesmich_encryptor_raas.txt
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'аВЎЙQ•yЁМИЦd№!Х\u2013мЖЛз—oб» ЋЃП]e+ЉЮ( Ђ~лЫцУ'
- ClassName: '' WindowName: '????Q?y????d?!?'
