Trojan.Encoder.32271

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PhoenixTechnology' = '%PROGRAMDATA%\XINOF.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PhoenixTechnology' = '%PROGRAMDATA%\XINOF.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'PhoenixTechnology' = '%PROGRAMDATA%\XINOF.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'PhoenixTechnology' = '%PROGRAMDATA%\XINOF.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\fonix

Creates the following files on removable media

<Drive name for removable media>:\how to decrypt files.hta
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\cpriv.key
<Drive name for removable media>:\help.txt
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\february_catalogue__2015.doc

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

modifies the following system settings:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'

Modifies file system

Creates the following files

<Current directory>\cpriv.key
%ProgramFiles%\cleaner3\cpriv.key
%ProgramFiles%\clisvc\how to decrypt files.hta
%ProgramFiles%\clisvc\help.txt
%ProgramFiles%\clisvc\cpriv.key
%ProgramFiles%\clrcche\how to decrypt files.hta
%ProgramFiles%\clrcche\help.txt
%ProgramFiles%\clrcche\cpriv.key
%ProgramFiles%\cmain\how to decrypt files.hta
%ProgramFiles%\cmain\help.txt
%ProgramFiles%\cmain\cpriv.key
%ProgramFiles%\cmgrdian\how to decrypt files.hta
%ProgramFiles%\cmgrdian\cpriv.key
%CommonProgramFiles%\microsoft shared\dw\cpriv.key
%CommonProgramFiles%\how to decrypt files.hta
%CommonProgramFiles%\help.txt
%CommonProgramFiles%\cpriv.key
%CommonProgramFiles%\designer\how to decrypt files.hta
%CommonProgramFiles%\designer\help.txt
%CommonProgramFiles%\designer\cpriv.key
%CommonProgramFiles%\microsoft shared\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\help.txt
%CommonProgramFiles%\microsoft shared\cpriv.key
%CommonProgramFiles%\microsoft shared\dw\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\dw\help.txt
%ProgramFiles%\cleaner3\help.txt
%ProgramFiles%\cmgrdian\help.txt
%ProgramFiles%\cleaner3\how to decrypt files.hta
%ProgramFiles%\clamtray\how to decrypt files.hta
%ProgramFiles%\ccsetmgr\help.txt
%ProgramFiles%\ccsetmgr\cpriv.key
%ProgramFiles%\cemrep\how to decrypt files.hta
%ProgramFiles%\cemrep\help.txt
%ProgramFiles%\cemrep\cpriv.key
%ProgramFiles%\chrome\how to decrypt files.hta
%ProgramFiles%\chrome\help.txt
%ProgramFiles%\chrome\cpriv.key
%ProgramFiles%\clamscan\how to decrypt files.hta
%ProgramFiles%\clamscan\help.txt
%ProgramFiles%\clamscan\cpriv.key
%ProgramFiles%\clamtray\help.txt
%ProgramFiles%\cleaner\help.txt
%ProgramFiles%\clamtray\cpriv.key
%ProgramFiles%\clamwin\how to decrypt files.hta
%ProgramFiles%\clamwin\help.txt
%ProgramFiles%\clamwin\cpriv.key
%ProgramFiles%\claw95\how to decrypt files.hta
%ProgramFiles%\claw95\help.txt
%ProgramFiles%\claw95\cpriv.key
%ProgramFiles%\claw95cf\how to decrypt files.hta
%ProgramFiles%\claw95cf\help.txt
%ProgramFiles%\claw95cf\cpriv.key
%ProgramFiles%\cleaner\how to decrypt files.hta
%ProgramFiles%\cleaner\cpriv.key
%CommonProgramFiles%\microsoft shared\help\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\help.txt
%CommonProgramFiles%\microsoft shared\equation\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\da-dk\help.txt
%CommonProgramFiles%\microsoft shared\ink\da-dk\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\de-de\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\de-de\help.txt
%CommonProgramFiles%\microsoft shared\ink\de-de\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\el-gr\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\el-gr\help.txt
%CommonProgramFiles%\microsoft shared\ink\el-gr\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\en-us\help.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\es-es\help.txt
%CommonProgramFiles%\microsoft shared\equation\help.txt
%CommonProgramFiles%\microsoft shared\ink\es-es\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\et-ee\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\et-ee\help.txt
%CommonProgramFiles%\microsoft shared\ink\et-ee\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fi-fi\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fi-fi\help.txt
%CommonProgramFiles%\microsoft shared\ink\fi-fi\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fr-fr\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fr-fr\help.txt
%CommonProgramFiles%\microsoft shared\ink\fr-fr\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\da-dk\how to decrypt files.hta
%ProgramFiles%\ccsetmgr\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\cs-cz\cpriv.key
%CommonProgramFiles%\microsoft shared\grphflt\cpriv.key
%CommonProgramFiles%\microsoft shared\equation\1033\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\equation\1033\help.txt
%CommonProgramFiles%\microsoft shared\equation\1033\cpriv.key
%CommonProgramFiles%\microsoft shared\euro\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\euro\help.txt
%CommonProgramFiles%\microsoft shared\euro\cpriv.key
%CommonProgramFiles%\microsoft shared\filters\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\filters\help.txt
%CommonProgramFiles%\microsoft shared\filters\cpriv.key
%CommonProgramFiles%\microsoft shared\grphflt\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\grphflt\help.txt
%CommonProgramFiles%\microsoft shared\equation\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\cs-cz\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\help\help.txt
%CommonProgramFiles%\microsoft shared\help\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\help.txt
%CommonProgramFiles%\microsoft shared\ink\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\ar-sa\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\ar-sa\help.txt
%CommonProgramFiles%\microsoft shared\ink\ar-sa\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\bg-bg\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\bg-bg\help.txt
%CommonProgramFiles%\microsoft shared\ink\bg-bg\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\cs-cz\help.txt
%CommonProgramFiles%\microsoft shared\ink\es-es\how to decrypt files.hta
%ProgramFiles%\ccproxy\cpriv.key
%ProgramFiles%\cavuserupd\cpriv.key
%ProgramFiles%\bdwizreg\help.txt
%ProgramFiles%\bdwizreg\cpriv.key
%ProgramFiles%\blackd\how to decrypt files.hta
%ProgramFiles%\blackd\help.txt
%ProgramFiles%\blackd\cpriv.key
%ProgramFiles%\blackice\how to decrypt files.hta
%ProgramFiles%\blackice\help.txt
%ProgramFiles%\blackice\cpriv.key
%ProgramFiles%\blindman\how to decrypt files.hta
%ProgramFiles%\blindman\help.txt
%ProgramFiles%\blindman\cpriv.key
%ProgramFiles%\btini\help.txt
%ProgramFiles%\cavapp\help.txt
%ProgramFiles%\btini\cpriv.key
%ProgramFiles%\btinint\how to decrypt files.hta
%ProgramFiles%\btinint\help.txt
%ProgramFiles%\btinint\cpriv.key
%ProgramFiles%\cabalmain\how to decrypt files.hta
%ProgramFiles%\cabalmain\help.txt
%ProgramFiles%\cabalmain\cpriv.key
%ProgramFiles%\cafix\how to decrypt files.hta
%ProgramFiles%\cafix\help.txt
%ProgramFiles%\cafix\cpriv.key
%ProgramFiles%\cavapp\how to decrypt files.hta
%ProgramFiles%\bdwizreg\how to decrypt files.hta
%ProgramFiles%\btini\how to decrypt files.hta
%ProgramFiles%\bdswitch\cpriv.key
%ProgramFiles%\bdoesrv\cpriv.key
%ProgramFiles%\bdagent\how to decrypt files.hta
%ProgramFiles%\bdagent\help.txt
%ProgramFiles%\bdagent\cpriv.key
%ProgramFiles%\bdmcon\how to decrypt files.hta
%ProgramFiles%\bdmcon\help.txt
%ProgramFiles%\bdmcon\cpriv.key
%ProgramFiles%\bdnews\how to decrypt files.hta
%ProgramFiles%\bdnews\help.txt
%ProgramFiles%\bdnews\cpriv.key
%ProgramFiles%\bdoesrv\how to decrypt files.hta
%ProgramFiles%\bdoesrv\help.txt
%ProgramFiles%\bdss\how to decrypt files.hta
%ProgramFiles%\bdswitch\how to decrypt files.hta
%ProgramFiles%\bdss\help.txt
%ProgramFiles%\bdss\cpriv.key
%ProgramFiles%\bdsubmit\how to decrypt files.hta
%ProgramFiles%\bdsubmit\help.txt
%ProgramFiles%\bdsubmit\cpriv.key
%ProgramFiles%\bdsubmitwiz\how to decrypt files.hta
%ProgramFiles%\bdsubmitwiz\help.txt
%ProgramFiles%\bdsubmitwiz\cpriv.key
%ProgramFiles%\bdsurvey\how to decrypt files.hta
%ProgramFiles%\bdsurvey\help.txt
%ProgramFiles%\bdsurvey\cpriv.key
%ProgramFiles%\bdswitch\help.txt
%ProgramFiles%\cavmud\cpriv.key
%ProgramFiles%\ccproxy\how to decrypt files.hta
%ProgramFiles%\cavasm\help.txt
%ProgramFiles%\cavsub\how to decrypt files.hta
%ProgramFiles%\cavsub\help.txt
%ProgramFiles%\cavsub\cpriv.key
%ProgramFiles%\cavsubmit\how to decrypt files.hta
%ProgramFiles%\cavsubmit\help.txt
%ProgramFiles%\cavsubmit\cpriv.key
%ProgramFiles%\cavumas\how to decrypt files.hta
%ProgramFiles%\cavumas\help.txt
%ProgramFiles%\cavumas\cpriv.key
%ProgramFiles%\cavuserupd\how to decrypt files.hta
%ProgramFiles%\cavuserupd\help.txt
%ProgramFiles%\cavvl\how to decrypt files.hta
%ProgramFiles%\cavasm\how to decrypt files.hta
%ProgramFiles%\cavvl\help.txt
%ProgramFiles%\cavvl\cpriv.key
%ProgramFiles%\ccapp\how to decrypt files.hta
%ProgramFiles%\ccapp\help.txt
%ProgramFiles%\ccapp\cpriv.key
%ProgramFiles%\ccevtmgr\how to decrypt files.hta
%ProgramFiles%\ccevtmgr\help.txt
%ProgramFiles%\ccevtmgr\cpriv.key
%ProgramFiles%\ccleaner\how to decrypt files.hta
%ProgramFiles%\ccleaner\help.txt
%ProgramFiles%\ccleaner\cpriv.key
%ProgramFiles%\cavsn\cpriv.key
%ProgramFiles%\ccproxy\help.txt
%ProgramFiles%\cavsn\help.txt
%ProgramFiles%\cavmud\help.txt
%ProgramFiles%\cavasm\cpriv.key
%ProgramFiles%\cavaud\how to decrypt files.hta
%ProgramFiles%\cavaud\help.txt
%ProgramFiles%\cavaud\cpriv.key
%ProgramFiles%\cavemsrv\how to decrypt files.hta
%ProgramFiles%\cavemsrv\help.txt
%ProgramFiles%\cavemsrv\cpriv.key
%ProgramFiles%\cavmr\how to decrypt files.hta
%ProgramFiles%\cavmr\help.txt
%ProgramFiles%\cavmr\cpriv.key
%ProgramFiles%\cavmud\how to decrypt files.hta
%ProgramFiles%\cavapp\cpriv.key
%ProgramFiles%\cavse\cpriv.key
%ProgramFiles%\cavoar\how to decrypt files.hta
%ProgramFiles%\cavoar\help.txt
%ProgramFiles%\cavoar\cpriv.key
%ProgramFiles%\cavq\how to decrypt files.hta
%ProgramFiles%\cavq\help.txt
%ProgramFiles%\cavq\cpriv.key
%ProgramFiles%\cavscons\how to decrypt files.hta
%ProgramFiles%\cavscons\help.txt
%ProgramFiles%\cavscons\cpriv.key
%ProgramFiles%\cavse\how to decrypt files.hta
%ProgramFiles%\cavse\help.txt
%ProgramFiles%\cavsn\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\1033\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\help.txt
%CommonProgramFiles%\microsoft shared\office14\1033\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\cultures\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\cultures\help.txt
%CommonProgramFiles%\microsoft shared\office14\cultures\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\1033\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\help.txt
%CommonProgramFiles%\microsoft shared\textconv\cpriv.key
%CommonProgramFiles%\microsoft shared\textconv\en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\textconv\en-us\help.txt
%CommonProgramFiles%\microsoft shared\textconv\en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\themes14\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\themes14\help.txt
%CommonProgramFiles%\microsoft shared\themes14\cpriv.key
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\help.txt
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\cpriv.key
%CommonProgramFiles%\microsoft shared\textconv\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\textconv\help.txt
%CommonProgramFiles%\microsoft shared\themes14\arctic\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\themes14\axis\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\themes14\axis\help.txt
%CommonProgramFiles%\microsoft shared\themes14\axis\cpriv.key
%CommonProgramFiles%\microsoft shared\themes14\blends\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\themes14\blends\help.txt
%CommonProgramFiles%\microsoft shared\themes14\blends\cpriv.key
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\help.txt
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\cpriv.key
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\themes14\arctic\help.txt
%CommonProgramFiles%\microsoft shared\themes14\arctic\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\help.txt
%CommonProgramFiles%\microsoft shared\stationery\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\help.txt
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\cpriv.key
%CommonProgramFiles%\microsoft shared\proof\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\proof\help.txt
%CommonProgramFiles%\microsoft shared\proof\cpriv.key
%CommonProgramFiles%\microsoft shared\smart tag\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\smart tag\help.txt
%CommonProgramFiles%\microsoft shared\stationery\help.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\stationery\cpriv.key
%CommonProgramFiles%\microsoft shared\smart tag\cpriv.key
%CommonProgramFiles%\microsoft shared\smart tag\lists\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\smart tag\lists\help.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\cpriv.key
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\help.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\cpriv.key
%CommonProgramFiles%\microsoft shared\source engine\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\source engine\help.txt
%CommonProgramFiles%\microsoft shared\source engine\cpriv.key
%CommonProgramFiles%\microsoft shared\smart tag\1033\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\smart tag\1033\help.txt
%CommonProgramFiles%\microsoft shared\smart tag\1033\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\cpriv.key
%CommonProgramFiles%\microsoft shared\office14\help.txt
%CommonProgramFiles%\microsoft shared\office14\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\hr-hr\help.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\hu-hu\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\hu-hu\help.txt
%CommonProgramFiles%\microsoft shared\ink\hu-hu\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\help.txt
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\it-it\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\it-it\help.txt
%CommonProgramFiles%\microsoft shared\ink\he-il\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\nb-no\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\he-il\help.txt
%CommonProgramFiles%\microsoft shared\ink\ja-jp\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\ko-kr\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\ko-kr\help.txt
%CommonProgramFiles%\microsoft shared\ink\ko-kr\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\lt-lt\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\lt-lt\help.txt
%CommonProgramFiles%\microsoft shared\ink\lt-lt\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\lv-lv\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\lv-lv\help.txt
%CommonProgramFiles%\microsoft shared\ink\lv-lv\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\ja-jp\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\it-it\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\ja-jp\help.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\help.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\help.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\help.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\he-il\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\nb-no\help.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\help.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\help.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\help.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\help.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\help.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\nb-no\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\th-th\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\th-th\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\tr-tr\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\tr-tr\help.txt
%CommonProgramFiles%\microsoft shared\ink\tr-tr\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\uk-ua\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\uk-ua\help.txt
%CommonProgramFiles%\microsoft shared\ink\uk-ua\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\zh-cn\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\zh-cn\help.txt
%CommonProgramFiles%\microsoft shared\ink\sv-se\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\sv-se\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\th-th\help.txt
%CommonProgramFiles%\microsoft shared\ink\zh-cn\cpriv.key
%CommonProgramFiles%\microsoft shared\msclientdatamgr\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\msclientdatamgr\help.txt
%CommonProgramFiles%\microsoft shared\msclientdatamgr\cpriv.key
%CommonProgramFiles%\microsoft shared\msinfo\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\msinfo\help.txt
%CommonProgramFiles%\microsoft shared\msinfo\cpriv.key
%CommonProgramFiles%\microsoft shared\msinfo\en-us\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\msinfo\en-us\help.txt
%CommonProgramFiles%\microsoft shared\msinfo\en-us\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\zh-tw\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\zh-tw\help.txt
%CommonProgramFiles%\microsoft shared\ink\zh-tw\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\sv-se\help.txt
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\nl-nl\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\nl-nl\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\pl-pl\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\pl-pl\help.txt
%CommonProgramFiles%\microsoft shared\ink\pl-pl\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\pt-br\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\pt-br\help.txt
%CommonProgramFiles%\microsoft shared\ink\pt-br\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\pt-pt\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\pt-pt\help.txt
%CommonProgramFiles%\microsoft shared\ink\pt-pt\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\ro-ro\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\nl-nl\help.txt
%CommonProgramFiles%\microsoft shared\ink\ro-ro\help.txt
%CommonProgramFiles%\microsoft shared\ink\ru-ru\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\ru-ru\help.txt
%CommonProgramFiles%\microsoft shared\ink\ru-ru\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\sk-sk\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\sk-sk\help.txt
%CommonProgramFiles%\microsoft shared\ink\sk-sk\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\sl-si\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\sl-si\help.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\cpriv.key
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\help.txt
%CommonProgramFiles%\microsoft shared\ink\ro-ro\cpriv.key
%ProgramFiles%\backweb-4476822\cpriv.key
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\help.txt
%ProgramFiles%\backweb-4476822\help.txt
%ProgramFiles%\b2\cpriv.key
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\how to decrypt files.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\help.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\cpriv.key
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\how to decrypt files.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\help.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\cpriv.key
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\how to decrypt files.hta
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\help.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\cpriv.key
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\help.txt
C:\far2\pluginsdk\headers.c\help.txt
C:\far2\plugins\network\cpriv.key
C:\far2\plugins\proclist\how to decrypt files.hta
C:\far2\plugins\proclist\help.txt
C:\far2\plugins\proclist\cpriv.key
C:\far2\plugins\tmppanel\how to decrypt files.hta
C:\far2\plugins\tmppanel\help.txt
C:\far2\plugins\tmppanel\cpriv.key
C:\far2\pluginsdk\how to decrypt files.hta
C:\far2\pluginsdk\help.txt
C:\far2\pluginsdk\cpriv.key
C:\far2\pluginsdk\headers.c\how to decrypt files.hta
C:\far2\pluginsdk\headers.c\cpriv.key
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\cpriv.key
C:\far2\pluginsdk\headers.pas\how to decrypt files.hta
C:\far2\pluginsdk\headers.pas\help.txt
C:\far2\pluginsdk\headers.pas\cpriv.key
C:\msocache\how to decrypt files.hta
C:\msocache\help.txt
C:\msocache\cpriv.key
C:\msocache\all users\how to decrypt files.hta
C:\msocache\all users\help.txt
C:\msocache\all users\cpriv.key
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\help.txt
%ProgramFiles%\a2upd\cpriv.key
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
%ProgramFiles%\cpriv.key
%ProgramFiles%\360tray\how to decrypt files.hta
%ProgramFiles%\360tray\help.txt
%ProgramFiles%\360tray\cpriv.key
%ProgramFiles%\a2cmd\how to decrypt files.hta
%ProgramFiles%\a2cmd\help.txt
%ProgramFiles%\a2cmd\cpriv.key
%ProgramFiles%\a2guard\how to decrypt files.hta
%ProgramFiles%\a2guard\help.txt
%ProgramFiles%\a2guard\cpriv.key
%ProgramFiles%\a2hijackfree\how to decrypt files.hta
%ProgramFiles%\a2hijackfree\cpriv.key
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\cpriv.key
%ProgramFiles%\a2scan\how to decrypt files.hta
%ProgramFiles%\a2scan\help.txt
%ProgramFiles%\a2scan\cpriv.key
%ProgramFiles%\a2service\how to decrypt files.hta
%ProgramFiles%\a2service\help.txt
%ProgramFiles%\a2service\cpriv.key
%ProgramFiles%\a2start\how to decrypt files.hta
%ProgramFiles%\a2start\help.txt
%ProgramFiles%\a2start\cpriv.key
%ProgramFiles%\a2upd\how to decrypt files.hta
%ProgramFiles%\a2upd\help.txt
%ProgramFiles%\help.txt
C:\far2\plugins\network\help.txt
%ProgramFiles%\how to decrypt files.hta
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\how to decrypt files.hta
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\help.txt
C:\perflogs\admin\help.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\cpriv.key
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\how to decrypt files.hta
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\help.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\cpriv.key
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\how to decrypt files.hta
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\help.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\cpriv.key
C:\perflogs\how to decrypt files.hta
C:\perflogs\help.txt
C:\perflogs\cpriv.key
C:\perflogs\admin\how to decrypt files.hta
C:\perflogs\admin\cpriv.key
%ProgramFiles%\a2hijackfree\help.txt
C:\far2\plugins\network\how to decrypt files.hta
C:\far2\plugins\filecase\how to decrypt files.hta
C:\far2\addons\colors\custom_highlighting\cpriv.key
C:\far2\addons\colors\default_highlighting\how to decrypt files.hta
C:\far2\addons\colors\default_highlighting\help.txt
C:\far2\addons\colors\default_highlighting\cpriv.key
C:\far2\addons\macros\how to decrypt files.hta
C:\far2\addons\macros\help.txt
C:\far2\addons\macros\cpriv.key
C:\far2\addons\setup\how to decrypt files.hta
C:\far2\addons\setup\help.txt
C:\far2\addons\setup\cpriv.key
C:\far2\addons\shell\how to decrypt files.hta
C:\far2\addons\shell\cpriv.key
C:\far2\documentation\eng\cpriv.key
C:\far2\addons\xlat\how to decrypt files.hta
C:\far2\addons\xlat\help.txt
C:\far2\addons\xlat\cpriv.key
C:\far2\addons\xlat\russian\how to decrypt files.hta
C:\far2\addons\xlat\russian\help.txt
C:\far2\addons\xlat\russian\cpriv.key
C:\far2\documentation\how to decrypt files.hta
C:\far2\documentation\help.txt
C:\far2\documentation\cpriv.key
C:\far2\documentation\eng\how to decrypt files.hta
C:\far2\documentation\eng\help.txt
C:\far2\addons\colors\custom_highlighting\help.txt
C:\far2\addons\shell\help.txt
C:\far2\addons\colors\custom_highlighting\how to decrypt files.hta
D:\cpriv.key
<Current directory>\cpub.key
%PROGRAMDATA%\cpub.key
%PROGRAMDATA%\cpriv.key
%PROGRAMDATA%\crptsrvcflg
<Current directory>\systemid
%PROGRAMDATA%\systemid
%PROGRAMDATA%\how to decrypt files.hta
%PROGRAMDATA%\help.txt
%PROGRAMDATA%\hello michaele gllips
D:\how to decrypt files.hta
D:\help.txt
C:\how to decrypt files.hta
C:\far2\addons\colors\help.txt
C:\help.txt
C:\cpriv.key
<Current directory>\how to decrypt files.hta
<Current directory>\help.txt
C:\far2\how to decrypt files.hta
C:\far2\help.txt
C:\far2\cpriv.key
C:\far2\addons\how to decrypt files.hta
C:\far2\addons\help.txt
C:\far2\addons\cpriv.key
C:\far2\addons\colors\how to decrypt files.hta
C:\far2\addons\colors\cpriv.key
C:\far2\plugins\align\how to decrypt files.hta
C:\far2\plugins\macroview\help.txt
C:\far2\documentation\rus\cpriv.key
C:\far2\plugins\drawline\help.txt
C:\far2\plugins\drawline\cpriv.key
C:\far2\plugins\editcase\how to decrypt files.hta
C:\far2\plugins\editcase\help.txt
C:\far2\plugins\editcase\cpriv.key
C:\far2\plugins\emenu\how to decrypt files.hta
C:\far2\plugins\emenu\help.txt
C:\far2\plugins\emenu\cpriv.key
C:\far2\plugins\farcmds\how to decrypt files.hta
C:\far2\plugins\farcmds\help.txt
C:\far2\plugins\farcmds\cpriv.key
C:\far2\plugins\filecase\help.txt
C:\far2\documentation\rus\help.txt
C:\far2\plugins\filecase\cpriv.key
C:\far2\plugins\ftp\how to decrypt files.hta
C:\far2\plugins\ftp\help.txt
C:\far2\plugins\ftp\cpriv.key
C:\far2\plugins\ftp\lib\how to decrypt files.hta
C:\far2\plugins\ftp\lib\help.txt
C:\far2\plugins\ftp\lib\cpriv.key
C:\far2\plugins\hlfviewer\how to decrypt files.hta
C:\far2\plugins\hlfviewer\help.txt
C:\far2\plugins\hlfviewer\cpriv.key
C:\far2\plugins\macroview\how to decrypt files.hta
C:\far2\plugins\drawline\how to decrypt files.hta
C:\far2\plugins\macroview\cpriv.key
C:\far2\plugins\compare\cpriv.key
C:\far2\plugins\cpriv.key
C:\far2\encyclopedia\how to decrypt files.hta
C:\far2\encyclopedia\help.txt
C:\far2\encyclopedia\cpriv.key
C:\far2\encyclopedia\tap\how to decrypt files.hta
C:\far2\encyclopedia\tap\help.txt
C:\far2\encyclopedia\tap\cpriv.key
C:\far2\fexcept\how to decrypt files.hta
C:\far2\fexcept\help.txt
C:\far2\fexcept\cpriv.key
C:\far2\plugins\how to decrypt files.hta
C:\far2\plugins\help.txt
C:\far2\documentation\rus\how to decrypt files.hta
C:\far2\plugins\compare\how to decrypt files.hta
C:\far2\plugins\align\help.txt
C:\far2\plugins\align\cpriv.key
C:\far2\plugins\arclite\how to decrypt files.hta
C:\far2\plugins\arclite\help.txt
C:\far2\plugins\arclite\cpriv.key
C:\far2\plugins\autowrap\how to decrypt files.hta
C:\far2\plugins\autowrap\help.txt
C:\far2\plugins\autowrap\cpriv.key
C:\far2\plugins\brackets\how to decrypt files.hta
C:\far2\plugins\brackets\help.txt
C:\far2\plugins\brackets\cpriv.key
C:\far2\plugins\compare\help.txt
%ProgramFiles%\a2wizard\how to decrypt files.hta
%ProgramFiles%\a2wizard\help.txt
%ProgramFiles%\a2wizard\cpriv.key
%ProgramFiles%\avconfig\help.txt
%ProgramFiles%\avconfig\cpriv.key
%ProgramFiles%\avconsol\how to decrypt files.hta
%ProgramFiles%\avconsol\help.txt
%ProgramFiles%\avconsol\cpriv.key
%ProgramFiles%\avgamsvr\how to decrypt files.hta
%ProgramFiles%\avgamsvr\help.txt
%ProgramFiles%\avgamsvr\cpriv.key
%ProgramFiles%\avgcc\how to decrypt files.hta
%ProgramFiles%\avgcc\help.txt
%ProgramFiles%\avgnpdln\how to decrypt files.hta
%ProgramFiles%\avconfig\how to decrypt files.hta
%ProgramFiles%\avcmd\cpriv.key
%ProgramFiles%\avgdiag\cpriv.key
%ProgramFiles%\avgemc\how to decrypt files.hta
%ProgramFiles%\avgemc\help.txt
%ProgramFiles%\avgemc\cpriv.key
%ProgramFiles%\avgfwsrv\how to decrypt files.hta
%ProgramFiles%\avgfwsrv\help.txt
%ProgramFiles%\avgfwsrv\cpriv.key
%ProgramFiles%\avginet\how to decrypt files.hta
%ProgramFiles%\avginet\help.txt
%ProgramFiles%\avginet\cpriv.key
%ProgramFiles%\avgcc\cpriv.key
%ProgramFiles%\avgdiag\help.txt
%ProgramFiles%\ash_updatemediator\help.txt
%ProgramFiles%\avgdiag\how to decrypt files.hta
%ProgramFiles%\autostartexplorer\cpriv.key
%ProgramFiles%\aswregsvr\how to decrypt files.hta
%ProgramFiles%\aswregsvr\help.txt
%ProgramFiles%\aswregsvr\cpriv.key
%ProgramFiles%\aswupdsv\how to decrypt files.hta
%ProgramFiles%\aswupdsv\help.txt
%ProgramFiles%\aswupdsv\cpriv.key
%ProgramFiles%\autodown\how to decrypt files.hta
%ProgramFiles%\autodown\help.txt
%ProgramFiles%\autodown\cpriv.key
%ProgramFiles%\autostartexplorer\how to decrypt files.hta
%ProgramFiles%\avciman\cpriv.key
%ProgramFiles%\avcmd\help.txt
%ProgramFiles%\avcmd\how to decrypt files.hta
%ProgramFiles%\autotrace\help.txt
%ProgramFiles%\autotrace\cpriv.key
%ProgramFiles%\avadmin\how to decrypt files.hta
%ProgramFiles%\avadmin\help.txt
%ProgramFiles%\avadmin\cpriv.key
%ProgramFiles%\avcenter\how to decrypt files.hta
%ProgramFiles%\avcenter\help.txt
%ProgramFiles%\avcenter\cpriv.key
%ProgramFiles%\avciman\how to decrypt files.hta
%ProgramFiles%\avciman\help.txt
%ProgramFiles%\autostartexplorer\help.txt
%ProgramFiles%\autotrace\how to decrypt files.hta
%ProgramFiles%\ash_updatemediator\cpriv.key
%ProgramFiles%\avgnpdln\help.txt
%ProgramFiles%\avgnpsvc\cpriv.key
%ProgramFiles%\avkservice\how to decrypt files.hta
%ProgramFiles%\avkservice\help.txt
%ProgramFiles%\avkservice\cpriv.key
%ProgramFiles%\avkwctl\how to decrypt files.hta
%ProgramFiles%\avkwctl\help.txt
%ProgramFiles%\avkwctl\cpriv.key
%ProgramFiles%\avnotify\how to decrypt files.hta
%ProgramFiles%\avnotify\help.txt
%ProgramFiles%\avnotify\cpriv.key
%ProgramFiles%\avpcc\how to decrypt files.hta
%ProgramFiles%\avkserv\help.txt
%ProgramFiles%\avkserv\cpriv.key
%ProgramFiles%\avpcc\help.txt
%ProgramFiles%\avpm\help.txt
%ProgramFiles%\avpm\cpriv.key
%ProgramFiles%\avscan\how to decrypt files.hta
%ProgramFiles%\avscan\help.txt
%ProgramFiles%\avscan\cpriv.key
%ProgramFiles%\avsynmgr\how to decrypt files.hta
%ProgramFiles%\avsynmgr\help.txt
%ProgramFiles%\avsynmgr\cpriv.key
%ProgramFiles%\b2\how to decrypt files.hta
%ProgramFiles%\b2\help.txt
%ProgramFiles%\avpcc\cpriv.key
%ProgramFiles%\avpm\how to decrypt files.hta
%ProgramFiles%\avgnpsvc\how to decrypt files.hta
%ProgramFiles%\avgnpdln\cpriv.key
%ProgramFiles%\avinitnt\help.txt
%ProgramFiles%\avgrssvc\how to decrypt files.hta
%ProgramFiles%\avgrssvc\help.txt
%ProgramFiles%\avgrssvc\cpriv.key
%ProgramFiles%\avgscan\how to decrypt files.hta
%ProgramFiles%\avgscan\help.txt
%ProgramFiles%\avgscan\cpriv.key
%ProgramFiles%\avgupden\how to decrypt files.hta
%ProgramFiles%\avgupden\help.txt
%ProgramFiles%\avgupden\cpriv.key
%ProgramFiles%\avinitnt\cpriv.key
%ProgramFiles%\avgnpsvc\help.txt
%ProgramFiles%\avkserv\how to decrypt files.hta
%ProgramFiles%\avgupsvc\how to decrypt files.hta
%ProgramFiles%\avgvv\help.txt
%ProgramFiles%\avgvv\cpriv.key
%ProgramFiles%\avgw\how to decrypt files.hta
%ProgramFiles%\avgw\help.txt
%ProgramFiles%\avgw\cpriv.key
%ProgramFiles%\avgwizfw\how to decrypt files.hta
%ProgramFiles%\avgwizfw\help.txt
%ProgramFiles%\avgwizfw\cpriv.key
%ProgramFiles%\avinitnt\how to decrypt files.hta
%ProgramFiles%\avgupsvc\help.txt
%ProgramFiles%\avgupsvc\cpriv.key
%ProgramFiles%\avgvv\how to decrypt files.hta
%ProgramFiles%\ash_updatemediator\how to decrypt files.hta
%ProgramFiles%\ashwebsv\cpriv.key
%ProgramFiles%\ashwebsv\help.txt
%ProgramFiles%\airdefense\cpriv.key
%ProgramFiles%\almon\how to decrypt files.hta
%ProgramFiles%\almon\help.txt
%ProgramFiles%\almon\cpriv.key
%ProgramFiles%\alsvc\how to decrypt files.hta
%ProgramFiles%\alsvc\help.txt
%ProgramFiles%\alsvc\cpriv.key
%ProgramFiles%\amon\how to decrypt files.hta
%ProgramFiles%\amon\help.txt
%ProgramFiles%\amon\cpriv.key
%ProgramFiles%\airdefense\how to decrypt files.hta
%ProgramFiles%\armor2net\help.txt
%ProgramFiles%\aimpro\cpriv.key
%ProgramFiles%\anti-trojan\how to decrypt files.hta
%ProgramFiles%\anti-trojan\help.txt
%ProgramFiles%\anti-trojan\cpriv.key
%ProgramFiles%\antivirus\how to decrypt files.hta
%ProgramFiles%\antivirus\help.txt
%ProgramFiles%\antivirus\cpriv.key
%ProgramFiles%\aoltbserver\how to decrypt files.hta
%ProgramFiles%\aoltbserver\help.txt
%ProgramFiles%\aoltbserver\cpriv.key
%ProgramFiles%\armor2net\how to decrypt files.hta
%ProgramFiles%\amsn\help.txt
%ProgramFiles%\amsn\how to decrypt files.hta
%ProgramFiles%\amsn\cpriv.key
%ProgramFiles%\aimpro\how to decrypt files.hta
%ProgramFiles%\agb5\help.txt
%ProgramFiles%\aavshield\help.txt
%ProgramFiles%\aavshield\cpriv.key
%ProgramFiles%\about\how to decrypt files.hta
%ProgramFiles%\about\help.txt
%ProgramFiles%\about\cpriv.key
%ProgramFiles%\ackwin32\how to decrypt files.hta
%ProgramFiles%\ackwin32\help.txt
%ProgramFiles%\ackwin32\cpriv.key
%ProgramFiles%\admunch\how to decrypt files.hta
%ProgramFiles%\admunch\help.txt
%ProgramFiles%\aimpro\help.txt
%ProgramFiles%\armor2net\cpriv.key
%ProgramFiles%\aavshield\how to decrypt files.hta
%ProgramFiles%\agb5\cpriv.key
%ProgramFiles%\ageofconan\how to decrypt files.hta
%ProgramFiles%\ageofconan\help.txt
%ProgramFiles%\ageofconan\cpriv.key
%ProgramFiles%\ahnsd\how to decrypt files.hta
%ProgramFiles%\ahnsd\help.txt
%ProgramFiles%\ahnsd\cpriv.key
%ProgramFiles%\aim6\how to decrypt files.hta
%ProgramFiles%\aim6\help.txt
%ProgramFiles%\aim6\cpriv.key
%ProgramFiles%\agb5\how to decrypt files.hta
%ProgramFiles%\admunch\cpriv.key
%ProgramFiles%\airdefense\help.txt
%ProgramFiles%\armorsurf\how to decrypt files.hta
%ProgramFiles%\ashpopwz\help.txt
%ProgramFiles%\ashquick\how to decrypt files.hta
%ProgramFiles%\ashquick\help.txt
%ProgramFiles%\ashquick\cpriv.key
%ProgramFiles%\ashserv\how to decrypt files.hta
%ProgramFiles%\ashserv\help.txt
%ProgramFiles%\ashserv\cpriv.key
%ProgramFiles%\ashsimp2\how to decrypt files.hta
%ProgramFiles%\ashsimp2\help.txt
%ProgramFiles%\ashsimp2\cpriv.key
%ProgramFiles%\ashpopwz\how to decrypt files.hta
%ProgramFiles%\ashmaisv\help.txt
%ProgramFiles%\ashpopwz\cpriv.key
%ProgramFiles%\ashsimpl\how to decrypt files.hta
%ProgramFiles%\ashskpcc\help.txt
%ProgramFiles%\ashskpcc\cpriv.key
%ProgramFiles%\ashskpck\how to decrypt files.hta
%ProgramFiles%\ashskpck\help.txt
%ProgramFiles%\ashskpck\cpriv.key
%ProgramFiles%\ashupd\how to decrypt files.hta
%ProgramFiles%\ashupd\help.txt
%ProgramFiles%\ashupd\cpriv.key
%ProgramFiles%\ashwebsv\how to decrypt files.hta
%ProgramFiles%\ashsimpl\help.txt
%ProgramFiles%\ashsimpl\cpriv.key
%ProgramFiles%\ashskpcc\how to decrypt files.hta
%ProgramFiles%\ashmaisv\cpriv.key
%ProgramFiles%\ashmaisv\how to decrypt files.hta
%ProgramFiles%\armorsurf\help.txt
%ProgramFiles%\ash\how to decrypt files.hta
%ProgramFiles%\ash\help.txt
%ProgramFiles%\ash\cpriv.key
%ProgramFiles%\ashavast\how to decrypt files.hta
%ProgramFiles%\ashavast\help.txt
%ProgramFiles%\ashavast\cpriv.key
%ProgramFiles%\ashavsrv\how to decrypt files.hta
%ProgramFiles%\ashavsrv\help.txt
%ProgramFiles%\ashavsrv\cpriv.key
%ProgramFiles%\ashchest\how to decrypt files.hta
%ProgramFiles%\ashchest\help.txt
%ProgramFiles%\armorsurf\cpriv.key
%ProgramFiles%\ashchest\cpriv.key
%ProgramFiles%\ashdisp\help.txt
%ProgramFiles%\ashdisp\cpriv.key
%ProgramFiles%\ashdug\how to decrypt files.hta
%ProgramFiles%\ashdug\help.txt
%ProgramFiles%\ashdug\cpriv.key
%ProgramFiles%\ashenhcd\how to decrypt files.hta
%ProgramFiles%\ashenhcd\help.txt
%ProgramFiles%\ashenhcd\cpriv.key
%ProgramFiles%\ashlogv\how to decrypt files.hta
%ProgramFiles%\ashlogv\help.txt
%ProgramFiles%\ashlogv\cpriv.key
%ProgramFiles%\ashdisp\how to decrypt files.hta
%ProgramFiles%\backweb-4476822\how to decrypt files.hta
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\cpriv.key

Moves the following files

from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\360tray.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\btinint\btinint.exe to %ProgramFiles%\btinint\btinint.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\btini\btini.exe to %ProgramFiles%\btini\btini.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\blindman\blindman.exe to %ProgramFiles%\blindman\blindman.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\blackice\blackice.exe to %ProgramFiles%\blackice\blackice.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\blackd\blackd.exe to %ProgramFiles%\blackd\blackd.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\bdwizreg\bdwizreg.exe to %ProgramFiles%\bdwizreg\bdwizreg.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\bdswitch\bdswitch.exe to %ProgramFiles%\bdswitch\bdswitch.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\bdsurvey\bdsurvey.exe to %ProgramFiles%\bdsurvey\bdsurvey.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe to %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\bdsubmit\bdsubmit.exe to %ProgramFiles%\bdsubmit\bdsubmit.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\bdss\bdss.exe to %ProgramFiles%\bdss\bdss.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\bdoesrv\bdoesrv.exe to %ProgramFiles%\bdoesrv\bdoesrv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\bdnews\bdnews.exe to %ProgramFiles%\bdnews\bdnews.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\bdmcon\bdmcon.exe to %ProgramFiles%\bdmcon\bdmcon.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cabalmain\cabalmain.exe to %ProgramFiles%\cabalmain\cabalmain.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\bdagent\bdagent.exe to %ProgramFiles%\bdagent\bdagent.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\b2\b2.exe to %ProgramFiles%\b2\b2.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avsynmgr\avsynmgr.exe to %ProgramFiles%\avsynmgr\avsynmgr.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avscan\avscan.exe to %ProgramFiles%\avscan\avscan.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avpm\avpm.exe to %ProgramFiles%\avpm\avpm.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avpcc\avpcc.exe to %ProgramFiles%\avpcc\avpcc.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avnotify\avnotify.exe to %ProgramFiles%\avnotify\avnotify.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avkwctl\avkwctl.exe to %ProgramFiles%\avkwctl\avkwctl.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avkservice\avkservice.exe to %ProgramFiles%\avkservice\avkservice.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avkserv\avkserv.exe to %ProgramFiles%\avkserv\avkserv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avinitnt\avinitnt.exe to %ProgramFiles%\avinitnt\avinitnt.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgwizfw\avgwizfw.exe to %ProgramFiles%\avgwizfw\avgwizfw.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgw\avgw.exe to %ProgramFiles%\avgw\avgw.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgvv\avgvv.exe to %ProgramFiles%\avgvv\avgvv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgupsvc\avgupsvc.exe to %ProgramFiles%\avgupsvc\avgupsvc.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\backweb-4476822\backweb-4476822.exe to %ProgramFiles%\backweb-4476822\backweb-4476822.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ccapp\ccapp.exe to %ProgramFiles%\ccapp\ccapp.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cmain\cmain.exe to %ProgramFiles%\cmain\cmain.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavasm\cavasm.exe to %ProgramFiles%\cavasm\cavasm.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\clrcche\clrcche.exe to %ProgramFiles%\clrcche\clrcche.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\clisvc\clisvc.exe to %ProgramFiles%\clisvc\clisvc.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cleaner3\cleaner3.exe to %ProgramFiles%\cleaner3\cleaner3.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cleaner\cleaner.exe to %ProgramFiles%\cleaner\cleaner.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\claw95cf\claw95cf.exe to %ProgramFiles%\claw95cf\claw95cf.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\claw95\claw95.exe to %ProgramFiles%\claw95\claw95.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\clamwin\clamwin.exe to %ProgramFiles%\clamwin\clamwin.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\clamtray\clamtray.exe to %ProgramFiles%\clamtray\clamtray.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\clamscan\clamscan.exe to %ProgramFiles%\clamscan\clamscan.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\chrome\chrome.exe to %ProgramFiles%\chrome\chrome.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cemrep\cemrep.exe to %ProgramFiles%\cemrep\cemrep.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ccsetmgr\ccsetmgr.exe to %ProgramFiles%\ccsetmgr\ccsetmgr.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ccproxy\ccproxy.exe to %ProgramFiles%\ccproxy\ccproxy.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ccleaner\ccleaner.exe to %ProgramFiles%\ccleaner\ccleaner.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgupden\avgupden.exe to %ProgramFiles%\avgupden\avgupden.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ccevtmgr\ccevtmgr.exe to %ProgramFiles%\ccevtmgr\ccevtmgr.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavvl\cavvl.exe to %ProgramFiles%\cavvl\cavvl.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavuserupd\cavuserupd.exe to %ProgramFiles%\cavuserupd\cavuserupd.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavumas\cavumas.exe to %ProgramFiles%\cavumas\cavumas.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavsubmit\cavsubmit.exe to %ProgramFiles%\cavsubmit\cavsubmit.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavsub\cavsub.exe to %ProgramFiles%\cavsub\cavsub.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavsn\cavsn.exe to %ProgramFiles%\cavsn\cavsn.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavse\cavse.exe to %ProgramFiles%\cavse\cavse.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavscons\cavscons.exe to %ProgramFiles%\cavscons\cavscons.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavq\cavq.exe to %ProgramFiles%\cavq\cavq.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavoar\cavoar.exe to %ProgramFiles%\cavoar\cavoar.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavmud\cavmud.exe to %ProgramFiles%\cavmud\cavmud.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavmr\cavmr.exe to %ProgramFiles%\cavmr\cavmr.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavemsrv\cavemsrv.exe to %ProgramFiles%\cavemsrv\cavemsrv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavaud\cavaud.exe to %ProgramFiles%\cavaud\cavaud.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cafix\cafix.exe to %ProgramFiles%\cafix\cafix.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cavapp\cavapp.exe to %ProgramFiles%\cavapp\cavapp.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgscan\avgscan.exe to %ProgramFiles%\avgscan\avgscan.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\ashdug.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\ashavsrv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\ashavast.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\ash.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\armorsurf\armorsurf.exe to %ProgramFiles%\armorsurf\armorsurf.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\armor2net\armor2net.exe to %ProgramFiles%\armor2net\armor2net.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\aoltbserver.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\anti-trojan\anti-trojan.exe to %ProgramFiles%\anti-trojan\anti-trojan.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\amsn.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\amon\amon.exe to %ProgramFiles%\amon\amon.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\alsvc.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\almon.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\airdefense.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\aimpro.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\ashchest.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\aim6.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\ageofconan.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\agb5.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\admunch.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\ackwin32.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\about.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\aavshield.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\a2upd.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\a2start.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\a2service.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\a2scan.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\a2hijackfree.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\a2guard.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\ahnsd.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\autodown\autodown.exe to %ProgramFiles%\autodown\autodown.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgnpsvc\avgnpsvc.exe to %ProgramFiles%\avgnpsvc\avgnpsvc.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\ashenhcd.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgnpdln\avgnpdln.exe to %ProgramFiles%\avgnpdln\avgnpdln.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avginet\avginet.exe to %ProgramFiles%\avginet\avginet.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgfwsrv\avgfwsrv.exe to %ProgramFiles%\avgfwsrv\avgfwsrv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgemc\avgemc.exe to %ProgramFiles%\avgemc\avgemc.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgdiag\avgdiag.exe to %ProgramFiles%\avgdiag\avgdiag.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgcc\avgcc.exe to %ProgramFiles%\avgcc\avgcc.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgamsvr\avgamsvr.exe to %ProgramFiles%\avgamsvr\avgamsvr.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avconsol\avconsol.exe to %ProgramFiles%\avconsol\avconsol.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avconfig\avconfig.exe to %ProgramFiles%\avconfig\avconfig.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avcmd\avcmd.exe to %ProgramFiles%\avcmd\avcmd.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avciman\avciman.exe to %ProgramFiles%\avciman\avciman.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avcenter\avcenter.exe to %ProgramFiles%\avcenter\avcenter.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avadmin\avadmin.exe to %ProgramFiles%\avadmin\avadmin.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\autotrace\autotrace.exe to %ProgramFiles%\autotrace\autotrace.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\avgrssvc\avgrssvc.exe to %ProgramFiles%\avgrssvc\avgrssvc.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\autostartexplorer\autostartexplorer.exe to %ProgramFiles%\autostartexplorer\autostartexplorer.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\aswupdsv\aswupdsv.exe to %ProgramFiles%\aswupdsv\aswupdsv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\aswregsvr\aswregsvr.exe to %ProgramFiles%\aswregsvr\aswregsvr.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe to %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashwebsv\ashwebsv.exe to %ProgramFiles%\ashwebsv\ashwebsv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashupd\ashupd.exe to %ProgramFiles%\ashupd\ashupd.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashskpck\ashskpck.exe to %ProgramFiles%\ashskpck\ashskpck.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashskpcc\ashskpcc.exe to %ProgramFiles%\ashskpcc\ashskpcc.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashsimpl\ashsimpl.exe to %ProgramFiles%\ashsimpl\ashsimpl.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashsimp2\ashsimp2.exe to %ProgramFiles%\ashsimp2\ashsimp2.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\ashserv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashquick\ashquick.exe to %ProgramFiles%\ashquick\ashquick.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashpopwz\ashpopwz.exe to %ProgramFiles%\ashpopwz\ashpopwz.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\ashmaisv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\ashlogv.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\ashdisp.exe.email=[payordie@cock.li]id=[02e7050a].xinof
from %ProgramFiles%\cmgrdian\cmgrdian.exe to %ProgramFiles%\cmgrdian\cmgrdian.exe.email=[payordie@cock.li]id=[02e7050a].xinof

Creates ransom message files (Trojan.Encoder).

Modifies user data files (Trojan.Encoder).

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c schtasks /CREATE /SC ONLOGON /TN fonix /TR %PROGRAMDATA%\XINOF.exe /RU SYSTEM /RL HIGHEST /F
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
'<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
'<SYSTEM32>\cmd.exe' /c start cmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q
'<SYSTEM32>\cmd.exe' /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q
'<SYSTEM32>\cmd.exe' /c Copy Cpub.key %PROGRAMDATA%\Cpub.key
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c Copy SystemID %PROGRAMDATA%\SystemID
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
'<SYSTEM32>\icacls.exe' * /grant Everyone:(OI)(CI)F /T /C /Q
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c Copy Cpriv.key %PROGRAMDATA%\Cpriv.key
'<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "PhoenixTechnology" /t REG_SZ /d %PROGRAMDATA%\XINOF.exe /f
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /TN fonix /TR %PROGRAMDATA%\XINOF.exe /RU SYSTEM /RL HIGHEST /F
'<SYSTEM32>\cmd.exe' /c copy XINOF.exe %appdata%\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe
'<SYSTEM32>\cmd.exe' /c attrib +h +s %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe
'<SYSTEM32>\attrib.exe' +h +s %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "PhoenixTechnology" /t REG_SZ /d %PROGRAMDATA%\XINOF.exe /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "PhoenixTechnology" /t REG_SZ /d %PROGRAMDATA%\XINOF.exe /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "PhoenixTechnology" /t REG_SZ /d %PROGRAMDATA%\XINOF.exe /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "PhoenixTechnology" /t REG_SZ /d %PROGRAMDATA%\XINOF.exe /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "PhoenixTechnology" /t REG_SZ /d %PROGRAMDATA%\XINOF.exe /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "PhoenixTechnology" /t REG_SZ /d %PROGRAMDATA%\XINOF.exe /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "PhoenixTechnology" /t REG_SZ /d %PROGRAMDATA%\XINOF.exe /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial