Trojan.Encoder.31200

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'firefox.exe' = '%APPDATA%\Frfx\firefox.exe'

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\lisp_success.doc

Modifies file system

Creates the following files

%APPDATA%\frfx\firefox.exe
%ProgramFiles%\microsoft office\document themes 14\theme fonts\paper.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\perspective.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\pushpin.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\slipstream.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\solstice.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\technic.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\thatch.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\trek.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\urban.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\verve.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\waveform.xml.fun
%ProgramFiles%\microsoft office\office14\infopathom\microsoft.office.infopath.xml.fun
%ProgramFiles%\microsoft office\office14\onenote\sendtoonenote-pipelineconfig.xml.fun
%ProgramFiles%\microsoft office\templates\1033\adjacencyletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\adjacencymergeletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\adjacencyresume.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\apothecaryletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\apothecarymergeletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\apothecarynewsletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\apothecaryresume.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\billingstatement.xltx.fun
%ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\origin.xml.fun
%ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\oriel.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\office classic.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\aspect.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\austin.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\black tie.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\civic.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\clarity.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\composite.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\concourse.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\couture.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\elemental.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\equity.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\essential.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\executive.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\flow.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\foundry.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\grid.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\hardcover.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\horizon.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\median.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\metro.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\module.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\newsprint.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\office 2.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\office classic 2.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\opulent.xml.fun
%ProgramFiles%\microsoft office\templates\presentation designs\maple.gif.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\setjmpex.h.fun
%ProgramFiles%\microsoft office\templates\1033\blog.dotx.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\ctype.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\direct.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\dos.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\eh.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\errno.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\excpt.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\fcntl.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\float.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\fpieee.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\gcroot.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\io.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\limits.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\locale.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\malloc.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\math.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\mbctype.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\mbstring.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\memory.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\minmax.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\new.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\process.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\search.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\setjmp.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\conio.h.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\apothecary.xml.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\assert.h.fun
%ProgramFiles%\microsoft office\templates\1033\widescreenpresentation.potx.fun
%ProgramFiles%\microsoft office\templates\1033\bloodpressuretracker.xltx.fun
%ProgramFiles%\microsoft office\templates\1033\classicphotoalbum.potx.fun
%ProgramFiles%\microsoft office\templates\1033\contemporaryphotoalbum.potx.fun
%ProgramFiles%\microsoft office\templates\1033\essentialletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\essentialmergeletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\essentialreport.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\essentialresume.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\executiveletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\executivemergeletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\executivenewsletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\executivereport.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\executiveresume.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\expensereport.xltx.fun
%ProgramFiles%\microsoft office\templates\1033\loanamortization.xltx.fun
%ProgramFiles%\microsoft office\templates\1033\office word 2003 look.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\personalmonthlybudget.xltx.fun
%ProgramFiles%\microsoft office\templates\1033\pitchbook.potx.fun
%ProgramFiles%\microsoft office\templates\1033\projectstatusreport.potx.fun
%ProgramFiles%\microsoft office\templates\1033\quizshow.potx.fun
%ProgramFiles%\microsoft office\templates\1033\salesreport.xltx.fun
%ProgramFiles%\microsoft office\templates\1033\timecard.xltx.fun
%ProgramFiles%\microsoft office\templates\1033\training.potx.fun
%ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx.fun
%ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.fun
%ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\apex.xml.fun
%ProgramFiles%\google\chrome\application\visualelementsmanifest.xml.fun
%HOMEPATH%\links\recentplaces.lnk.fun
C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.en\proof.xml.fun
C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.es\proof.xml.fun
C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proof.fr\proof.xml.fun
C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\access.en-us\accessmui.xml.fun
C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\access.en-us\branding.xml.fun
%CommonProgramFiles%\java\java update\task.xml.fun
%CommonProgramFiles%\java\java update\task64.xml.fun
%CommonProgramFiles%\microsoft shared\help\dexplore.xml.fun
%ProgramFiles%\far2\documentation\eng\arc_support.txt.fun
%ProgramFiles%\far2\documentation\eng\bug_report.txt.fun
%ProgramFiles%\far2\documentation\eng\far_faq.txt.fun
%ProgramFiles%\far2\documentation\eng\plugins_install.txt.fun
%ProgramFiles%\far2\documentation\eng\plugins_review.txt.fun
%ProgramFiles%\far2\documentation\eng\techinfo.txt.fun
%ProgramFiles%\far2\documentation\rus\arc_support.txt.fun
%ProgramFiles%\far2\documentation\rus\bug_report.txt.fun
%ProgramFiles%\far2\documentation\rus\far_faq.txt.fun
%ProgramFiles%\far2\documentation\rus\plugins_install.txt.fun
%ProgramFiles%\far2\documentation\rus\plugins_review.txt.fun
%ProgramFiles%\far2\documentation\rus\techinfo.txt.fun
%ProgramFiles%\far2\plugins\ftp\ftpcmds.txt.fun
%ProgramFiles%\far2\plugins\ftp\ftpcmds_rus.txt.fun
%HOMEPATH%\links\downloads.lnk.fun
%ProgramFiles%\far2\plugins\ftp\notes.txt.fun
%HOMEPATH%\links\desktop.lnk.fun
%HOMEPATH%\desktop\qip 2012.lnk.fun
%ProgramFiles%\steam\servers\serverbrowser_spanish.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_swedish.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_tchinese.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_thai.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_turkish.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_ukrainian.txt.fun
%ProgramFiles%\steam\skins\skins_readme.txt.fun
%PROGRAMDATA%\microsoft\ilscache\ilrcache.xml.fun
%PROGRAMDATA%\microsoft\ilscache\imcrcache.xml.fun
%PROGRAMDATA%\microsoft\user account pictures\guest.bmp.fun
%PROGRAMDATA%\microsoft\user account pictures\user.bmp.fun
%PROGRAMDATA%\microsoft\user account pictures\user.dat.fun
C:\users\public\desktop\adobe reader xi.lnk.fun
C:\users\public\desktop\google chrome.lnk.fun
C:\users\public\desktop\mirc.lnk.fun
C:\users\public\desktop\mozilla firefox.lnk.fun
C:\users\public\desktop\mozilla thunderbird.lnk.fun
C:\users\public\desktop\opera.lnk.fun
C:\users\public\desktop\steam.lnk.fun
%HOMEPATH%\desktop\icq.lnk.fun
%HOMEPATH%\desktop\mirc.lnk.fun
%HOMEPATH%\desktop\mozilla thunderbird.lnk.fun
%HOMEPATH%\desktop\pidgin.lnk.fun
%HOMEPATH%\desktop\telegram.lnk.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\essential.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\adjacency.xml.fun
%ProgramFiles%\java\jre7\lib\alt-rt.jar.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\foundry.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\grayscale.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\grid.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\hardcover.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\horizon.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\median.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\metro.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\module.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\newsprint.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\opulent.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\oriel.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\origin.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\paper.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\perspective.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\pushpin.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\slipstream.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\solstice.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\technic.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\thatch.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\trek.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\urban.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\verve.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\waveform.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\flow.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme fonts\angles.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\executive.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\equity.xml.fun
%ProgramFiles%\java\jre7\lib\charsets.jar.fun
%ProgramFiles%\java\jre7\lib\deploy.jar.fun
%ProgramFiles%\java\jre7\lib\javaws.jar.fun
%ProgramFiles%\java\jre7\lib\jce.jar.fun
%ProgramFiles%\java\jre7\lib\jfr.jar.fun
%ProgramFiles%\java\jre7\lib\jsse.jar.fun
%ProgramFiles%\java\jre7\lib\jvm.hprof.txt.fun
%ProgramFiles%\java\jre7\lib\management-agent.jar.fun
%ProgramFiles%\java\jre7\lib\plugin.jar.fun
%ProgramFiles%\java\jre7\lib\resources.jar.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\adjacency.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\angles.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\apex.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\apothecary.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\aspect.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\austin.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\black tie.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\civic.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\clarity.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\composite.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\concourse.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\couture.xml.fun
%ProgramFiles%\microsoft office\document themes 14\theme colors\elemental.xml.fun
%ProgramFiles%\far2\plugins\ftp\notes_rus.txt.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bn.gif.fun
%PROGRAMDATA%\microsoft\windows\ringtones\ringtone 01.wma.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\stdarg.h.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dq.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dr.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ds.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dt.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\du.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dv.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dw.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dx.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dy.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dz.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ea.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\eb.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ec.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ed.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ee.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ef.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\eg.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\eh.gif.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndadded.wav.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndauthdeny.wav.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndauthgrant.wav.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndauthreq.wav.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndemailmsg.wav.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dp.gif.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndfilercvd.wav.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\do.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dm.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cp.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cq.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cr.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cs.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ct.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cu.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cv.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cw.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cx.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cy.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cz.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\da.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\db.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dc.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dd.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\de.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\df.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dg.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dh.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\di.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dj.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dk.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dl.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\dn.gif.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_portuguese.txt.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\signal.h.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndmsgsent.wav.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_schinese.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_spanish.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_swedish.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_tchinese.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_thai.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_turkish.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_ukrainian.txt.fun
%ProgramFiles%\steam\steam\cached\steam_logo_onwhite.gif.fun
%PROGRAMDATA%\microsoft\network\downloader\qmgr0.dat.fun
%PROGRAMDATA%\microsoft\network\downloader\qmgr1.dat.fun
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\cache.dat.fun
%PROGRAMDATA%\microsoft\rac\publisheddata\racwmidatabase.sdf.fun
%PROGRAMDATA%\microsoft\rac\statedata\racdatabase.sdf.fun
%PROGRAMDATA%\microsoft\rac\statedata\racmetadata.dat.fun
%PROGRAMDATA%\microsoft\rac\statedata\racwmidatabookmarks.dat.fun
%PROGRAMDATA%\microsoft\rac\statedata\racwmieventdata.dat.fun
%PROGRAMDATA%\microsoft\windows\caches\cversions.2.db.fun
%PROGRAMDATA%\microsoft\windows\caches\{4a64632c-4330-4f41-bb76-f05b69009cf1}.2.ver0x0000000000000002.db.fun
%PROGRAMDATA%\microsoft\windows\caches\{67d69890-d853-4011-a87e-aa64fa83ce5a}.2.ver0x0000000000000002.db.fun
%PROGRAMDATA%\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000009.db.fun
%PROGRAMDATA%\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db.fun
%PROGRAMDATA%\microsoft\windows\caches\{7cd55808-3d38-4dd5-90c9-62f0e6ee60d4}.2.ver0x0000000000000001.db.fun
%PROGRAMDATA%\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_russian.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_romanian.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_polish.txt.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndonline.wav.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndservermsg.wav.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndstartup.wav.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndstatus.wav.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndtray.wav.fun
%ProgramFiles%\steam\remoteui\static\headsdown.js.fun
%ProgramFiles%\steam\remoteui\static\playercontrols.js.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_brazilian.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_bulgarian.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_czech.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_danish.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_dutch.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_english.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_finnish.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_french.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_german.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_greek.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_hungarian.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_italian.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_japanese.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_korean.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_koreana.txt.fun
%ProgramFiles%\steam\steam\cached\steamui_postlogon_norwegian.txt.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndincfile.wav.fun
%ProgramFiles%\steam\servers\serverbrowser_schinese.txt.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\an.gif.fun
%ProgramFiles%\mozilla firefox\defaults\pref\channel-prefs.js.fun
%ProgramFiles%\mozilla thunderbird\defaults\messenger\mailviews.dat.fun
%ProgramFiles%\mozilla thunderbird\defaults\pref\channel-prefs.js.fun
%ProgramFiles%\opera\33.0.1990.115\resources\dictionaries.xml.fun
%ProgramFiles%\opera\33.0.1990.115\resources\license.txt.fun
%ProgramFiles%\opera\35.0.2066.92\resources\dictionaries.xml.fun
%ProgramFiles%\opera\35.0.2066.92\resources\license.txt.fun
%ProgramFiles%\pidgin\sounds\purple\alert.wav.fun
%ProgramFiles%\pidgin\sounds\purple\login.wav.fun
%ProgramFiles%\pidgin\sounds\purple\logout.wav.fun
%ProgramFiles%\pidgin\sounds\purple\receive.wav.fun
%ProgramFiles%\pidgin\sounds\purple\send.wav.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\aa.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ab.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ac.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ad.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ae.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\af.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ag.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ah.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ai.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\aj.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ak.gif.fun
%ProgramFiles%\mozilla firefox\browser\searchplugins\yandex.xml.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\al.gif.fun
%ProgramFiles%\mozilla firefox\browser\searchplugins\yandex-slovari.xml.fun
%ProgramFiles%\mozilla firefox\browser\searchplugins\priceru.xml.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\stddef.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\stdexcpt.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\stdio.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\stdlib.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\string.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\tchar.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\time.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\typeinfo.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\varargs.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\vcclr.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\wchar.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\xmath.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\_vcclrit.h.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\lib\libc.pdb.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\lib\libcd.pdb.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\lib\libcmt.pdb.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\lib\libcmtd.pdb.fun
%ProgramFiles%\microsoft.net\sdk\v1.1\license.txt.fun
%ProgramFiles%\microsoft.net\sdk\v1.1\redist.txt.fun
%ProgramFiles%\mozilla firefox\browser\searchplugins\ddg.xml.fun
%ProgramFiles%\mozilla firefox\browser\searchplugins\google.xml.fun
%ProgramFiles%\mozilla firefox\browser\searchplugins\mailru.xml.fun
%ProgramFiles%\mozilla firefox\browser\searchplugins\ozonru.xml.fun
%ProgramFiles%\mozilla firefox\browser\searchplugins\wikipedia-ru.xml.fun
%ProgramFiles%\microsoft visual studio .net 2003\vc7\include\share.h.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cn.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ao.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bq.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\br.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bs.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bt.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bu.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bv.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bw.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bx.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\by.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bz.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ca.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cb.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cc.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cd.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ce.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cf.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cg.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ch.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ci.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cj.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ck.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cl.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\cm.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bp.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\co.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bo.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bm.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ap.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\aq.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ar.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\as.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\at.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\au.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\av.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\aw.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ax.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ay.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\az.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\ba.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bb.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bc.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bd.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\be.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bf.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bg.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bh.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bi.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bj.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bk.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\bl.gif.fun
%ProgramFiles%\qip 2012\smilies\qip smilies\am.gif.fun
%ProgramFiles%\qip 2012\sounds\qip sounds\sndincmsg.wav.fun
%ProgramFiles%\steam\servers\serverbrowser_russian.txt.fun
%ProgramFiles%\steam\resource\sourceinit_macos.dat.fun
%ProgramFiles%\opera\assets\150x150logo.scale-140_contrast-white.png.fun
%ProgramFiles%\opera\assets\150x150logo.scale-180.png.fun
%ProgramFiles%\opera\assets\150x150logo.scale-180_contrast-white.png.fun
%ProgramFiles%\opera\assets\150x150logo.scale-80.png.fun
%ProgramFiles%\opera\assets\150x150logo.scale-80_contrast-white.png.fun
%ProgramFiles%\opera\assets\70x70logo.scale-100.png.fun
%ProgramFiles%\opera\assets\70x70logo.scale-100_contrast-white.png.fun
%ProgramFiles%\opera\assets\70x70logo.scale-140.png.fun
%ProgramFiles%\opera\assets\70x70logo.scale-140_contrast-white.png.fun
%ProgramFiles%\opera\assets\70x70logo.scale-180.png.fun
%ProgramFiles%\opera\assets\70x70logo.scale-180_contrast-white.png.fun
%ProgramFiles%\opera\assets\70x70logo.scale-80.png.fun
%ProgramFiles%\opera\assets\70x70logo.scale-80_contrast-white.png.fun
%ProgramFiles%\opera\assets\notification_default.png.fun
%ProgramFiles%\steam\friends\friend_join.wav.fun
%ProgramFiles%\steam\friends\friend_online.wav.fun
%ProgramFiles%\steam\friends\message.wav.fun
%ProgramFiles%\steam\friends\trackerui_brazilian.txt.fun
%ProgramFiles%\steam\friends\trackerui_bulgarian.txt.fun
%ProgramFiles%\steam\friends\trackerui_czech.txt.fun
%ProgramFiles%\steam\friends\trackerui_danish.txt.fun
%ProgramFiles%\steam\friends\trackerui_dutch.txt.fun
%ProgramFiles%\steam\friends\trackerui_english.txt.fun
%ProgramFiles%\opera\assets\150x150logo.scale-140.png.fun
%ProgramFiles%\steam\friends\trackerui_finnish.txt.fun
%ProgramFiles%\opera\assets\150x150logo.scale-100_contrast-white.png.fun
%ProgramFiles%\mozilla thunderbird\searchplugins\yahoo.xml.fun
%ProgramFiles%\firefox\components\webcontentconverter.js.fun
%ProgramFiles%\java\jre7\readme.txt.fun
%ProgramFiles%\java\jre7\thirdpartylicensereadme-javafx.txt.fun
%ProgramFiles%\java\jre7\thirdpartylicensereadme.txt.fun
%ProgramFiles%\java\jre7\welcome.html.fun
%ProgramFiles%\microsoft office\office14\microsoft.businessdata.xml.fun
%ProgramFiles%\microsoft office\office14\microsoft.office.businessapplications.runtime.xml.fun
%ProgramFiles%\microsoft office\office14\microsoft.office.businessapplications.runtimeui.xml.fun
%ProgramFiles%\microsoft office\office14\microsoft.office.businessdata.xml.fun
%ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.semitrust.xml.fun
%ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.xml.xml.fun
%ProgramFiles%\microsoft office\office14\microsoft.sharepoint.businessdata.administration.client.xml.fun
%ProgramFiles%\microsoft office\office14\sketchpadtestschema.xml.fun
%ProgramFiles%\microsoft office\office14\splashscreen.bmp.fun
%ProgramFiles%\microsoft.net\redistlist\assemblylist_4_client.xml.fun
%ProgramFiles%\microsoft.net\redistlist\assemblylist_4_extended.xml.fun
%ProgramFiles%\mozilla firefox\browser\blocklist.xml.fun
%ProgramFiles%\mozilla thunderbird\searchplugins\amazondotcom.xml.fun
%ProgramFiles%\mozilla thunderbird\searchplugins\aol-web-search.xml.fun
%ProgramFiles%\mozilla thunderbird\searchplugins\bing.xml.fun
%ProgramFiles%\mozilla thunderbird\searchplugins\ebay.xml.fun
%ProgramFiles%\mozilla thunderbird\searchplugins\twitter.xml.fun
%ProgramFiles%\mozilla thunderbird\searchplugins\wikipedia.xml.fun
%ProgramFiles%\opera\assets\150x150logo.scale-100.png.fun
%ProgramFiles%\steam\graphics\icon_status_mobile.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album5.png.fun
%ProgramFiles%\steam\friends\trackerui_greek.txt.fun
%ProgramFiles%\steam\graphics\icon_status_web_ingame.png.fun
%ProgramFiles%\steam\graphics\mega_btn_off.png.fun
%ProgramFiles%\steam\graphics\mega_btn_on.png.fun
%ProgramFiles%\steam\graphics\music_background_0.png.fun
%ProgramFiles%\steam\graphics\music_background_1.png.fun
%ProgramFiles%\steam\graphics\music_background_2.png.fun
%ProgramFiles%\steam\graphics\music_background_3.png.fun
%ProgramFiles%\steam\graphics\music_background_4.png.fun
%ProgramFiles%\steam\graphics\music_background_5.png.fun
%ProgramFiles%\steam\graphics\music_background_6.png.fun
%ProgramFiles%\steam\graphics\music_background_7.png.fun
%ProgramFiles%\steam\graphics\music_background_8.png.fun
%ProgramFiles%\steam\graphics\music_background_9.png.fun
%ProgramFiles%\steam\graphics\music_details_mask.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album0.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album1.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album1_50.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album2.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album2_50.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album3.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album3_50.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album4.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album4_50.png.fun
%ProgramFiles%\steam\graphics\icon_status_web.png.fun
%ProgramFiles%\firefox\components\weave.js.fun
%ProgramFiles%\steam\graphics\icon_status_mobile_ingame.png.fun
%ProgramFiles%\steam\graphics\icon_status_bigpic_ingame.png.fun
%ProgramFiles%\steam\friends\trackerui_hungarian.txt.fun
%ProgramFiles%\steam\friends\trackerui_italian.txt.fun
%ProgramFiles%\steam\friends\trackerui_japanese.txt.fun
%ProgramFiles%\steam\friends\trackerui_korean.txt.fun
%ProgramFiles%\steam\friends\trackerui_koreana.txt.fun
%ProgramFiles%\steam\friends\trackerui_norwegian.txt.fun
%ProgramFiles%\steam\friends\trackerui_polish.txt.fun
%ProgramFiles%\steam\friends\trackerui_portuguese.txt.fun
%ProgramFiles%\steam\friends\trackerui_romanian.txt.fun
%ProgramFiles%\steam\friends\trackerui_russian.txt.fun
%ProgramFiles%\steam\friends\trackerui_schinese.txt.fun
%ProgramFiles%\steam\friends\trackerui_spanish.txt.fun
%ProgramFiles%\steam\friends\trackerui_swedish.txt.fun
%ProgramFiles%\steam\friends\trackerui_tchinese.txt.fun
%ProgramFiles%\steam\friends\trackerui_thai.txt.fun
%ProgramFiles%\steam\friends\trackerui_turkish.txt.fun
%ProgramFiles%\steam\friends\trackerui_ukrainian.txt.fun
%ProgramFiles%\steam\friends\voice_hang_up.wav.fun
%ProgramFiles%\steam\graphics\controller_dialog.png.fun
%ProgramFiles%\steam\graphics\driver_dialog.png.fun
%ProgramFiles%\steam\graphics\icon_emoticon.png.fun
%ProgramFiles%\steam\graphics\icon_emoticon_hover.png.fun
%ProgramFiles%\steam\graphics\icon_status_bigpic.png.fun
%ProgramFiles%\steam\friends\trackerui_french.txt.fun
%ProgramFiles%\steam\friends\trackerui_german.txt.fun
%ProgramFiles%\firefox\components\txexsltregexfunctions.js.fun
%ProgramFiles%\firefox\components\contentsecuritypolicy.js.fun
C:\msocache\all users\{90140000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml.fun
C:\msocache\all users\{90140000-0019-0409-0000-0000000ff1ce}-c\setup.xml.fun
C:\msocache\all users\{90140000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml.fun
C:\msocache\all users\{90140000-001a-0409-0000-0000000ff1ce}-c\setup.xml.fun
C:\msocache\all users\{90140000-001b-0409-0000-0000000ff1ce}-c\setup.xml.fun
C:\msocache\all users\{90140000-001b-0409-0000-0000000ff1ce}-c\wordmui.xml.fun
C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\proofing.xml.fun
C:\msocache\all users\{90140000-002c-0409-0000-0000000ff1ce}-c\setup.xml.fun
C:\msocache\all users\{90140000-0044-0409-0000-0000000ff1ce}-c\infopathmui.xml.fun
C:\msocache\all users\{90140000-0044-0409-0000-0000000ff1ce}-c\setup.xml.fun
C:\msocache\all users\{90140000-00a1-0409-0000-0000000ff1ce}-c\onenotemui.xml.fun
C:\msocache\all users\{90140000-00a1-0409-0000-0000000ff1ce}-c\setup.xml.fun
C:\msocache\all users\{90140000-00ba-0409-0000-0000000ff1ce}-c\groovemui.xml.fun
C:\msocache\all users\{90140000-00ba-0409-0000-0000000ff1ce}-c\setup.xml.fun
C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\branding.xml.fun
C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\officemui.xml.fun
C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\officemuiset.xml.fun
C:\msocache\all users\{90140000-0115-0409-0000-0000000ff1ce}-c\setup.xml.fun
C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\accessmuiset.xml.fun
C:\msocache\all users\{90140000-0117-0409-0000-0000000ff1ce}-c\setup.xml.fun
%ProgramFiles%\firefox\components\addonmanager.js.fun
%ProgramFiles%\firefox\components\amcontenthandler.js.fun
%ProgramFiles%\firefox\components\amwebinstalllistener.js.fun
C:\msocache\all users\{90140000-0018-0409-0000-0000000ff1ce}-c\setup.xml.fun
%ProgramFiles%\firefox\components\consoleapi.js.fun
C:\msocache\all users\{90140000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml.fun
C:\msocache\all users\{90140000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml.fun
%LOCALAPPDATA%\drpbx\drpbx.exe
%ProgramFiles%\firefox\blocklist.xml.fun
%ProgramFiles%\firefox\greprefs.js.fun
%ProgramFiles%\firefox\readme.txt.fun
%ProgramFiles%\mirc\readme.txt.fun
%ProgramFiles%\mirc\versions.txt.fun
%ProgramFiles%\mozilla thunderbird\blocklist.xml.fun
%ProgramFiles%\opera\installation_status.xml.fun
%ProgramFiles%\opera\launcher.visualelementsmanifest.xml.fun
%ProgramFiles%\qip 2012\unins000.dat.fun
%ProgramFiles%\qip 2012\unins000.msg.fun
%ProgramFiles%\steam\thirdpartylegalnotices.doc.fun
%ProgramFiles%\steam\thirdpartylegalnotices.html.fun
%ProgramFiles%\winrar\license.txt.fun
%ProgramFiles%\winrar\rar.txt.fun
%ProgramFiles%\winrar\rarnew.dat.fun
%ProgramFiles%\winrar\readme.txt.fun
%ProgramFiles%\winrar\whatsnew.txt.fun
%ProgramFiles%\winrar\zipnew.dat.fun
%PROGRAMDATA%\microsoft toolkit\settings.xml.fun
C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml.fun
C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml.fun
C:\msocache\all users\{90140000-0011-0000-0000-0000000ff1ce}-c\setup.xml.fun
C:\msocache\all users\{90140000-0016-0409-0000-0000000ff1ce}-c\setup.xml.fun
%ProgramFiles%\firefox\components\nsloginmanager.js.fun
%ProgramFiles%\firefox\components\storage_legacy.js.fun
%ProgramFiles%\firefox\components\crypto_sdr.js.fun
%ProgramFiles%\firefox\components\nsplacesautocomplete.js.fun
%ProgramFiles%\firefox\components\nsplacesexpiration.js.fun
%ProgramFiles%\firefox\components\nsprivatebrowsingservice.js.fun
%ProgramFiles%\firefox\components\nsprompter.js.fun
%ProgramFiles%\firefox\components\nsproxyautoconfig.js.fun
%ProgramFiles%\firefox\components\nssafebrowsingapplication.js.fun
%ProgramFiles%\firefox\components\nssearchservice.js.fun
%ProgramFiles%\firefox\components\nssearchsuggestions.js.fun
%ProgramFiles%\firefox\components\nssessionstartup.js.fun
%ProgramFiles%\firefox\components\nssessionstore.js.fun
%ProgramFiles%\firefox\components\nssetdefaultbrowser.js.fun
%ProgramFiles%\firefox\components\nssidebar.js.fun
%ProgramFiles%\firefox\components\nstaggingservice.js.fun
%ProgramFiles%\firefox\components\nstrytoclose.js.fun
%ProgramFiles%\firefox\components\nsupdateservice.js.fun
%ProgramFiles%\firefox\components\nsupdateservicestub.js.fun
%ProgramFiles%\firefox\components\nsupdatetimermanager.js.fun
%ProgramFiles%\firefox\components\nsurlclassifierlib.js.fun
%ProgramFiles%\firefox\components\nsurlclassifierlistmanager.js.fun
%ProgramFiles%\firefox\components\nsurlformatter.js.fun
%ProgramFiles%\firefox\components\nswebhandlerapp.js.fun
%ProgramFiles%\firefox\components\placescategoriesstarter.js.fun
%ProgramFiles%\firefox\components\placesprotocolhandler.js.fun
%ProgramFiles%\firefox\components\nsmicrosummaryservice.js.fun
%ProgramFiles%\firefox\components\storage_mozstorage.js.fun
%ProgramFiles%\firefox\components\nsloginmanagerprompter.js.fun
%ProgramFiles%\firefox\components\nslogininfo.js.fun
%ProgramFiles%\firefox\components\feedconverter.js.fun
%ProgramFiles%\firefox\components\feedprocessor.js.fun
%ProgramFiles%\firefox\components\feedwriter.js.fun
%ProgramFiles%\firefox\components\fuelapplication.js.fun
%ProgramFiles%\firefox\components\gpsdgeolocationprovider.js.fun
%ProgramFiles%\firefox\components\jsconsole_clhandler.js.fun
%ProgramFiles%\firefox\components\messagewakeupservice.js.fun
%ProgramFiles%\firefox\components\networkgeolocationprovider.js.fun
%ProgramFiles%\firefox\components\nsbadcerthandler.js.fun
%ProgramFiles%\firefox\components\nsblocklistservice.js.fun
%ProgramFiles%\firefox\components\nsbrowsercontenthandler.js.fun
%ProgramFiles%\firefox\components\nsbrowserglue.js.fun
%ProgramFiles%\firefox\components\nscontentdispatchchooser.js.fun
%ProgramFiles%\firefox\components\nscontentprefservice.js.fun
%ProgramFiles%\firefox\components\nsdefaultclh.js.fun
%ProgramFiles%\firefox\components\nsdownloadmanagerui.js.fun
%ProgramFiles%\firefox\components\nsformautocomplete.js.fun
%ProgramFiles%\firefox\components\nsformhistory.js.fun
%ProgramFiles%\firefox\components\nshandlerservice.js.fun
%ProgramFiles%\firefox\components\nshelperappdlg.js.fun
%ProgramFiles%\firefox\components\nsiniprocessor.js.fun
%ProgramFiles%\firefox\components\nsinputlistautocomplete.js.fun
%ProgramFiles%\firefox\components\nslivemarkservice.js.fun
%ProgramFiles%\firefox\components\contentareadroplistener.js.fun
%ProgramFiles%\steam\public\steamui_polish.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_portuguese.txt.fun
%ProgramFiles%\steam\graphics\music_placeholder_album6_50.png.fun
%ProgramFiles%\steam\resource\platform_danish.txt.fun
%ProgramFiles%\steam\resource\platform_dutch.txt.fun
%ProgramFiles%\steam\resource\platform_english.txt.fun
%ProgramFiles%\steam\resource\platform_finnish.txt.fun
%ProgramFiles%\steam\resource\platform_french.txt.fun
%ProgramFiles%\steam\resource\platform_german.txt.fun
%ProgramFiles%\steam\resource\platform_greek.txt.fun
%ProgramFiles%\steam\resource\platform_hungarian.txt.fun
%ProgramFiles%\steam\resource\platform_italian.txt.fun
%ProgramFiles%\steam\resource\platform_japanese.txt.fun
%ProgramFiles%\steam\resource\platform_korean.txt.fun
%ProgramFiles%\steam\resource\platform_koreana.txt.fun
%ProgramFiles%\steam\resource\platform_norwegian.txt.fun
%ProgramFiles%\steam\resource\platform_polish.txt.fun
%ProgramFiles%\steam\resource\platform_portuguese.txt.fun
%ProgramFiles%\steam\resource\platform_romanian.txt.fun
%ProgramFiles%\steam\resource\platform_russian.txt.fun
%ProgramFiles%\steam\resource\platform_schinese.txt.fun
%ProgramFiles%\steam\resource\platform_spanish.txt.fun
%ProgramFiles%\steam\resource\platform_swedish.txt.fun
%ProgramFiles%\steam\resource\platform_tchinese.txt.fun
%ProgramFiles%\steam\resource\platform_thai.txt.fun
%ProgramFiles%\steam\resource\platform_turkish.txt.fun
%ProgramFiles%\steam\resource\platform_czech.txt.fun
%ProgramFiles%\steam\resource\platform_ukrainian.txt.fun
%ProgramFiles%\steam\resource\platform_bulgarian.txt.fun
%ProgramFiles%\steam\resource\overlay_ukrainian.txt.fun
%ProgramFiles%\steam\resource\overlay_danish.txt.fun
%ProgramFiles%\steam\resource\overlay_dutch.txt.fun
%ProgramFiles%\steam\resource\overlay_english.txt.fun
%ProgramFiles%\steam\resource\overlay_finnish.txt.fun
%ProgramFiles%\steam\resource\overlay_french.txt.fun
%ProgramFiles%\steam\resource\overlay_german.txt.fun
%ProgramFiles%\steam\resource\overlay_greek.txt.fun
%ProgramFiles%\steam\resource\overlay_hungarian.txt.fun
%ProgramFiles%\steam\resource\overlay_italian.txt.fun
%ProgramFiles%\steam\resource\overlay_japanese.txt.fun
%ProgramFiles%\steam\resource\overlay_korean.txt.fun
%ProgramFiles%\steam\resource\overlay_koreana.txt.fun
%ProgramFiles%\steam\resource\overlay_norwegian.txt.fun
%ProgramFiles%\steam\resource\overlay_polish.txt.fun
%ProgramFiles%\steam\resource\overlay_portuguese.txt.fun
%ProgramFiles%\steam\resource\overlay_romanian.txt.fun
%ProgramFiles%\steam\resource\overlay_russian.txt.fun
%ProgramFiles%\steam\resource\overlay_schinese.txt.fun
%ProgramFiles%\steam\resource\overlay_spanish.txt.fun
%ProgramFiles%\steam\resource\overlay_swedish.txt.fun
%ProgramFiles%\steam\resource\overlay_tchinese.txt.fun
%ProgramFiles%\steam\resource\overlay_thai.txt.fun
%ProgramFiles%\steam\resource\overlay_turkish.txt.fun
%ProgramFiles%\steam\resource\platform_brazilian.txt.fun
%ProgramFiles%\steam\resource\vgui_turkish.txt.fun
%ProgramFiles%\steam\graphics\music_placeholder_album6.png.fun
%ProgramFiles%\steam\resource\vgui_brazilian.txt.fun
%ProgramFiles%\steam\resource\voice_dialing.wav.fun
%ProgramFiles%\steam\resource\voice_ringing.wav.fun
%ProgramFiles%\steam\resource\warning.wav.fun
%ProgramFiles%\steam\resource\workshop_banner.png.fun
%ProgramFiles%\steam\resource\workshop_minibanner.png.fun
%ProgramFiles%\steam\servers\game_ready.wav.fun
%ProgramFiles%\steam\servers\serverbrowser_brazilian.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_bulgarian.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_czech.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_danish.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_dutch.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_english.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_finnish.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_french.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_german.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_greek.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_hungarian.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_italian.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_japanese.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_korean.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_koreana.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_norwegian.txt.fun
%ProgramFiles%\steam\servers\serverbrowser_polish.txt.fun
%ProgramFiles%\steam\resource\voice_busy.wav.fun
%ProgramFiles%\steam\resource\overlay_czech.txt.fun
%ProgramFiles%\steam\resource\vgui_ukrainian.txt.fun
%ProgramFiles%\steam\resource\vgui_thai.txt.fun
%ProgramFiles%\steam\resource\vgui_bulgarian.txt.fun
%ProgramFiles%\steam\resource\vgui_czech.txt.fun
%ProgramFiles%\steam\resource\vgui_danish.txt.fun
%ProgramFiles%\steam\resource\vgui_dutch.txt.fun
%ProgramFiles%\steam\resource\vgui_english.txt.fun
%ProgramFiles%\steam\resource\vgui_finnish.txt.fun
%ProgramFiles%\steam\resource\vgui_french.txt.fun
%ProgramFiles%\steam\resource\vgui_german.txt.fun
%ProgramFiles%\steam\resource\vgui_greek.txt.fun
%ProgramFiles%\steam\resource\vgui_hungarian.txt.fun
%ProgramFiles%\steam\resource\vgui_italian.txt.fun
%ProgramFiles%\steam\resource\vgui_japanese.txt.fun
%ProgramFiles%\steam\resource\vgui_korean.txt.fun
%ProgramFiles%\steam\resource\vgui_koreana.txt.fun
%ProgramFiles%\steam\resource\vgui_norwegian.txt.fun
%ProgramFiles%\steam\resource\vgui_polish.txt.fun
%ProgramFiles%\steam\resource\vgui_portuguese.txt.fun
%ProgramFiles%\steam\resource\vgui_romanian.txt.fun
%ProgramFiles%\steam\resource\vgui_russian.txt.fun
%ProgramFiles%\steam\resource\vgui_schinese.txt.fun
%ProgramFiles%\steam\resource\vgui_spanish.txt.fun
%ProgramFiles%\steam\resource\vgui_swedish.txt.fun
%ProgramFiles%\steam\resource\vgui_tchinese.txt.fun
%ProgramFiles%\steam\resource\sourceinit.dat.fun
%ProgramFiles%\steam\servers\serverbrowser_romanian.txt.fun
%ProgramFiles%\steam\resource\overlay_bulgarian.txt.fun
%ProgramFiles%\steam\public\steamclean_portuguese.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_portuguese.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_romanian.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_russian.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_schinese.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_spanish.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_swedish.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_tchinese.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_thai.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_turkish.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_ukrainian.txt.fun
%ProgramFiles%\steam\public\steamclean_brazilian.txt.fun
%ProgramFiles%\steam\public\steamclean_czech.txt.fun
%ProgramFiles%\steam\public\steamclean_danish.txt.fun
%ProgramFiles%\steam\public\steamclean_dutch.txt.fun
%ProgramFiles%\steam\public\steamclean_english.txt.fun
%ProgramFiles%\steam\public\steamclean_finnish.txt.fun
%ProgramFiles%\steam\public\steamclean_french.txt.fun
%ProgramFiles%\steam\public\steamclean_german.txt.fun
%ProgramFiles%\steam\public\steamclean_greek.txt.fun
%ProgramFiles%\steam\public\steamclean_hungarian.txt.fun
%ProgramFiles%\steam\public\steamclean_italian.txt.fun
%ProgramFiles%\steam\public\steamclean_japanese.txt.fun
%ProgramFiles%\steam\public\steamclean_korean.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_polish.txt.fun
%ProgramFiles%\steam\public\steamclean_norwegian.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_norwegian.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_korean.txt.fun
%ProgramFiles%\steam\graphics\music_placeholder_album7.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album7_50.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album8.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album8_50.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album9.png.fun
%ProgramFiles%\steam\graphics\music_placeholder_album9_50.png.fun
%ProgramFiles%\steam\logs\bootstrap_log.txt.fun
%ProgramFiles%\steam\logs\configstore_log.txt.fun
%ProgramFiles%\steam\logs\connection_log.txt.fun
%ProgramFiles%\steam\logs\content_log.txt.fun
%ProgramFiles%\steam\public\account.html.fun
%ProgramFiles%\steam\public\steambootstrapper_brazilian.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_czech.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_danish.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_dutch.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_english.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_finnish.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_french.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_german.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_greek.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_hungarian.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_italian.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_japanese.txt.fun
%ProgramFiles%\steam\public\steambootstrapper_koreana.txt.fun
%ProgramFiles%\steam\graphics\music_placeholder_album5_50.png.fun
%ProgramFiles%\steam\resource\notfamilyview.png.fun
%ProgramFiles%\steam\public\steamclean_romanian.txt.fun
%ProgramFiles%\steam\public\steamui_romanian.txt.fun
%ProgramFiles%\steam\public\steamui_russian.txt.fun
%ProgramFiles%\steam\public\steamui_schinese.txt.fun
%ProgramFiles%\steam\public\steamui_spanish.txt.fun
%ProgramFiles%\steam\public\steamui_swedish.txt.fun
%ProgramFiles%\steam\public\steamui_tchinese.txt.fun
%ProgramFiles%\steam\public\steamui_thai.txt.fun
%ProgramFiles%\steam\public\steamui_turkish.txt.fun
%ProgramFiles%\steam\public\steamui_ukrainian.txt.fun
%ProgramFiles%\steam\public\steam_tray_mono.png.fun
%ProgramFiles%\steam\public\url_list.txt.fun
%ProgramFiles%\steam\resource\0_star.png.fun
%ProgramFiles%\steam\resource\1_star.png.fun
%ProgramFiles%\steam\resource\2_star.png.fun
%ProgramFiles%\steam\resource\3_star.png.fun
%ProgramFiles%\steam\resource\4_star.png.fun
%ProgramFiles%\steam\resource\5_star.png.fun
%ProgramFiles%\steam\resource\camera1.wav.fun
%ProgramFiles%\steam\resource\dlc_generic_header.png.fun
%ProgramFiles%\steam\resource\dlc_installed.png.fun
%ProgramFiles%\steam\resource\dlc_overlay.png.fun
%ProgramFiles%\steam\resource\familyview.png.fun
%ProgramFiles%\steam\resource\icon_steam_vr.png.fun
%ProgramFiles%\steam\public\steamui_postlogon_greek.txt.fun
%ProgramFiles%\steam\resource\overlay_brazilian.txt.fun
%ProgramFiles%\steam\public\steamui_portuguese.txt.fun
%ProgramFiles%\steam\public\steamui_norwegian.txt.fun
%ProgramFiles%\steam\public\steamclean_russian.txt.fun
%ProgramFiles%\steam\public\steamclean_schinese.txt.fun
%ProgramFiles%\steam\public\steamclean_spanish.txt.fun
%ProgramFiles%\steam\public\steamclean_swedish.txt.fun
%ProgramFiles%\steam\public\steamclean_tchinese.txt.fun
%ProgramFiles%\steam\public\steamclean_thai.txt.fun
%ProgramFiles%\steam\public\steamclean_turkish.txt.fun
%ProgramFiles%\steam\public\steamclean_ukrainian.txt.fun
%ProgramFiles%\steam\public\steamui_brazilian.txt.fun
%ProgramFiles%\steam\public\steamui_bulgarian.txt.fun
%ProgramFiles%\steam\public\steamui_czech.txt.fun
%ProgramFiles%\steam\public\steamui_danish.txt.fun
%ProgramFiles%\steam\public\steamui_dutch.txt.fun
%ProgramFiles%\steam\public\steamui_english.txt.fun
%ProgramFiles%\steam\public\steamui_finnish.txt.fun
%ProgramFiles%\steam\public\steamui_french.txt.fun
%ProgramFiles%\steam\public\steamui_german.txt.fun
%ProgramFiles%\steam\public\steamui_greek.txt.fun
%ProgramFiles%\steam\public\steamui_hungarian.txt.fun
%ProgramFiles%\steam\public\steamui_italian.txt.fun
%ProgramFiles%\steam\public\steamui_japanese.txt.fun
%ProgramFiles%\steam\public\steamui_korean.txt.fun
%ProgramFiles%\steam\public\steamui_koreana.txt.fun
%ProgramFiles%\steam\public\steamclean_polish.txt.fun
%PROGRAMDATA%\microsoft\windows\ringtones\ringtone 02.wma.fun

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%LOCALAPPDATA%\drpbx\drpbx.exe' <Full path to file>

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial