Trojan.Encoder.37192

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '"%APPDATA%\Microsoft\Windows\ctfmon.exe" *'

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\!!! your files are encrypted !!!.txt
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\waterresourcesag.pptx

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\testee.cer

Modifies file system

Creates the following files

%TEMP%\3be08dd4.buran
C:\far2\plugins\tmppanel\!!! your files are encrypted !!!.txt
C:\far2\pluginsdk\headers.c\!!! your files are encrypted !!!.txt
C:\far2\pluginsdk\headers.pas\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\branding\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\bookmarks\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\certerror\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\feeds\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\history\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\migration\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\places\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\safebrowsing\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\en_us\locale\branding\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\search\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\feeds\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\places\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\preferences\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\tabbrowser\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\tabview\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\feeds\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\places\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\preferences\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\tabbrowser\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\browser\tabview\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\skin\classic\communicator\!!! your files are encrypted !!!.txt
C:\far2\plugins\proclist\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\browser\content\browser\preferences\!!! your files are encrypted !!!.txt
C:\far2\plugins\network\!!! your files are encrypted !!!.txt
C:\far2\documentation\rus\!!! your files are encrypted !!!.txt
%APPDATA%\microsoft\windows\ctfmon.exe
%TEMP%\530d2c8e.buran
C:\far2\!!! your files are encrypted !!!.txt
%HOMEPATH%\desktop\!!! your files are encrypted !!!.txt
C:\far2\addons\!!! your files are encrypted !!!.txt
C:\far2\addons\colors\!!! your files are encrypted !!!.txt
C:\far2\addons\colors\custom_highlighting\!!! your files are encrypted !!!.txt
C:\far2\addons\colors\default_highlighting\!!! your files are encrypted !!!.txt
C:\far2\addons\macros\!!! your files are encrypted !!!.txt
C:\far2\addons\setup\!!! your files are encrypted !!!.txt
C:\far2\addons\shell\!!! your files are encrypted !!!.txt
C:\far2\addons\xlat\!!! your files are encrypted !!!.txt
C:\far2\addons\xlat\russian\!!! your files are encrypted !!!.txt
C:\far2\documentation\eng\!!! your files are encrypted !!!.txt
C:\far2\encyclopedia\!!! your files are encrypted !!!.txt
C:\far2\plugins\hlfviewer\!!! your files are encrypted !!!.txt
C:\far2\encyclopedia\tap\!!! your files are encrypted !!!.txt
C:\far2\fexcept\!!! your files are encrypted !!!.txt
C:\far2\plugins\align\!!! your files are encrypted !!!.txt
C:\far2\plugins\arclite\!!! your files are encrypted !!!.txt
C:\far2\plugins\autowrap\!!! your files are encrypted !!!.txt
C:\far2\plugins\brackets\!!! your files are encrypted !!!.txt
C:\far2\plugins\compare\!!! your files are encrypted !!!.txt
C:\far2\plugins\drawline\!!! your files are encrypted !!!.txt
C:\far2\plugins\editcase\!!! your files are encrypted !!!.txt
C:\far2\plugins\emenu\!!! your files are encrypted !!!.txt
C:\far2\plugins\farcmds\!!! your files are encrypted !!!.txt
C:\far2\plugins\filecase\!!! your files are encrypted !!!.txt
C:\far2\plugins\ftp\!!! your files are encrypted !!!.txt
C:\far2\plugins\ftp\lib\!!! your files are encrypted !!!.txt
C:\far2\plugins\macroview\!!! your files are encrypted !!!.txt
%ProgramFiles%\firefox\chrome\en_us\locale\browser\!!! your files are encrypted !!!.txt

Deletes the following files

%TEMP%\3be08dd4.buran
%TEMP%\530d2c8e.buran

Moves the following files

from %ProgramFiles%\firefox\application.ini to %ProgramFiles%\firefox\application.ini.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\openlocation.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\openlocation.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\neterror.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\neterror.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\inspector.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\inspector.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\enginemanager.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\enginemanager.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\enginemanager.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\enginemanager.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\browser.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\browser.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\browser.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\browser.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\basemenuoverlay.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\basemenuoverlay.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\appstrings.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\appstrings.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutsynctabs.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutsynctabs.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutsessionrestore.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutsessionrestore.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutrobots.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutrobots.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutprivatebrowsing.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutprivatebrowsing.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\abouthome.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\abouthome.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutdialog.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutdialog.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\tabbrowser.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\tabbrowser.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutcerterror.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\aboutcerterror.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\branding\browserconfig.properties to %ProgramFiles%\firefox\chrome\en_us\locale\branding\browserconfig.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\quitdialog.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\quitdialog.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\openlocation.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\openlocation.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\tabbrowser.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\tabbrowser.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncsetup.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncsetup.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncsetup.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncsetup.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncquota.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncquota.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncquota.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncquota.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\synckey.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\synckey.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncgenericchange.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncgenericchange.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncbrand.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\syncbrand.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\shellservice.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\shellservice.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\setdesktopbackground.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\setdesktopbackground.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\searchbar.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\searchbar.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\search.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\search.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\sanitize.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\sanitize.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\safemode.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\safemode.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\pageinfo.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\pageinfo.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\synccommon.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\synccommon.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\pageinfo.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\pageinfo.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\inspector.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\inspector.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\enginemanager.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\enginemanager.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\browser.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\browser.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\aboutsynctabs.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\aboutsynctabs.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\aboutsessionrestore.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\aboutsessionrestore.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\aboutprivatebrowsing.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\aboutprivatebrowsing.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\aboutcerterror.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\aboutcerterror.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\tabview\tabview.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\tabview\tabview.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\preferences\preferences.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\preferences\preferences.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\preferences\applications.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\preferences\applications.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\places\places.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\places\places.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\places\organizer.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\places\organizer.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\places\editbookmarkoverlay.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\places\editbookmarkoverlay.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\feeds\subscribe_ui.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\feeds\subscribe_ui.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\feeds\subscribe.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\feeds\subscribe.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\syncsetup.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\syncsetup.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\communicator\communicator.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\communicator\communicator.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\branding\brand.properties to %ProgramFiles%\firefox\chrome\en_us\locale\branding\brand.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\branding\brand.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\branding\brand.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\pageinfo.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\pageinfo.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\fullscreen_video.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\fullscreen_video.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\tabview\tabview.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\tabview\tabview.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\preferences\preferences.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\preferences\preferences.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\preferences\applications.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\preferences\applications.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\places\places.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\places\places.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\places\organizer.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\places\organizer.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\places\editbookmarkoverlay.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\places\editbookmarkoverlay.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\feeds\subscribe_ui.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\feeds\subscribe_ui.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\feeds\subscribe.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\feeds\subscribe.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\syncsetup.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\syncsetup.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\syncquota.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\syncquota.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\synccommon.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\synccommon.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\setdesktopbackground.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\setdesktopbackground.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\searchbar.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\searchbar.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\sanitizedialog.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\sanitizedialog.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\keyhole_forward_mask.svg to %ProgramFiles%\firefox\chrome\browser\skin\classic\browser\keyhole_forward_mask.svg.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\syncquota.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\syncquota.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\tabview.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\tabview.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\connection.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\connection.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\config.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\config.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\config.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\config.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\commondialogs.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\commondialogs.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\commondialog.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\commondialog.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\charsettitles.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\charsettitles.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\charsetoverlay.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\charsetoverlay.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\browser.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\browser.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\brand.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\brand.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\appstrings.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\appstrings.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\apppicker.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\apppicker.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\actions.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\actions.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\aboutsupport.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\aboutsupport.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\aboutsupport.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\aboutsupport.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\aboutrights.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\aboutrights.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\aboutrights.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\aboutrights.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\about.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\about.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\aboutabout.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\aboutabout.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\console.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\console.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\console.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\console.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\filepicker.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\filepicker.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\filepicker.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\filepicker.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\filefield.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\filefield.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\editmenuoverlay.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\editmenuoverlay.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\downloadprogress.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\downloadprogress.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\dialogoverlay.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\dialogoverlay.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\dialog.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\dialog.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\dateformat.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\dateformat.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\applications.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\applications.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\customizetoolbar.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\customizetoolbar.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\customizetoolbar.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\customizetoolbar.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\customizecharset.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\customizecharset.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\css.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\css.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\crashes.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\crashes.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\crashes.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\crashes.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\contentareacommands.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\contentareacommands.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\downloads\settingschange.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\downloads\settingschange.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\taskbar.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\taskbar.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\autoconfig\autoconfig.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\autoconfig\autoconfig.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\cookie\cookieacceptdialog.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\cookie\cookieacceptdialog.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\applications.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\applications.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\applicationmanager.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\applicationmanager.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\applicationmanager.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\applicationmanager.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\advanced_scripts.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\advanced_scripts.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\advanced.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\advanced.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\places\places.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\places\places.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\places\places.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\places\places.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\places\movebookmarks.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\places\movebookmarks.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\places\editbookmarkoverlay.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\places\editbookmarkoverlay.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\places\bookmarkproperties.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\places\bookmarkproperties.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\migration\migration.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\migration\migration.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\migration\migration.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\migration\migration.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\feeds\subscribe.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\feeds\subscribe.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\feeds\subscribe.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\feeds\subscribe.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\colors.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\colors.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\cookie\cookieacceptdialog.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\cookie\cookieacceptdialog.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\content.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\content.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\cookies.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\cookies.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\fonts.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\fonts.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser_region\region.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser_region\region.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\sidebar\sidebar.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\sidebar\sidebar.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\safebrowsing\report_phishing.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\safebrowsing\report_phishing.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\safebrowsing\phishing_afterload_warning_.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\safebrowsing\phishing_afterload_warning_.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\tabs.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\tabs.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\sync.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\sync.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\selectbookmark.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\selectbookmark.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\security.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\security.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\privacy.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\privacy.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\preferences.properties to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\preferences.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\preferences.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\preferences.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\permissions.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\permissions.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\main.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\main.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\languages.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\browser\preferences\languages.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\alerts\notificationnames.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\alerts\notificationnames.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\setdesktopbackground.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\setdesktopbackground.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\searchbar.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\searchbar.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\sanitizedialog.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\sanitizedialog.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\syncquota.js to %ProgramFiles%\firefox\chrome\browser\content\browser\syncquota.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\synckey.xhtml to %ProgramFiles%\firefox\chrome\browser\content\browser\synckey.xhtml.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\syncgenericchange.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\syncgenericchange.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\syncgenericchange.js to %ProgramFiles%\firefox\chrome\browser\content\browser\syncgenericchange.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\syncadddevice.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\syncadddevice.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\syncadddevice.js to %ProgramFiles%\firefox\chrome\browser\content\browser\syncadddevice.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\setdesktopbackground.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\setdesktopbackground.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\setdesktopbackground.js to %ProgramFiles%\firefox\chrome\browser\content\browser\setdesktopbackground.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\sanitizedialog.js to %ProgramFiles%\firefox\chrome\browser\content\browser\sanitizedialog.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\sanitizedialog.css to %ProgramFiles%\firefox\chrome\browser\content\browser\sanitizedialog.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\sanitize.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\sanitize.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\sanitize.js to %ProgramFiles%\firefox\chrome\browser\content\browser\sanitize.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\safemode.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\safemode.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\safemode.js to %ProgramFiles%\firefox\chrome\browser\content\browser\safemode.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\syncsetup.js to %ProgramFiles%\firefox\chrome\browser\content\browser\syncsetup.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\openlocation.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\openlocation.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\history\history_panel.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\history\history_panel.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\openlocation.js to %ProgramFiles%\firefox\chrome\browser\content\browser\openlocation.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\feeds\subscribe.xhtml to %ProgramFiles%\firefox\chrome\browser\content\browser\feeds\subscribe.xhtml.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\feeds\subscribe.js to %ProgramFiles%\firefox\chrome\browser\content\browser\feeds\subscribe.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\feeds\subscribe.css to %ProgramFiles%\firefox\chrome\browser\content\browser\feeds\subscribe.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\certerror\aboutcerterror.xhtml to %ProgramFiles%\firefox\chrome\browser\content\browser\certerror\aboutcerterror.xhtml.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\certerror\aboutcerterror.css to %ProgramFiles%\firefox\chrome\browser\content\browser\certerror\aboutcerterror.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\bookmarks\sidebarutils.js to %ProgramFiles%\firefox\chrome\browser\content\browser\bookmarks\sidebarutils.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\bookmarks\bookmarkspanel.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\bookmarks\bookmarkspanel.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\bookmarks\bookmarkspanel.js to %ProgramFiles%\firefox\chrome\browser\content\browser\bookmarks\bookmarkspanel.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\win6browseroverlay.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\win6browseroverlay.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\web_panels.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\web_panels.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\web_panels.js to %ProgramFiles%\firefox\chrome\browser\content\browser\web_panels.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\viewsourceoverlay.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\viewsourceoverlay.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\utilityoverlay.js to %ProgramFiles%\firefox\chrome\browser\content\browser\utilityoverlay.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\tabview.js to %ProgramFiles%\firefox\chrome\browser\content\browser\tabview.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\tabview.css to %ProgramFiles%\firefox\chrome\browser\content\browser\tabview.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\syncutils.js to %ProgramFiles%\firefox\chrome\browser\content\browser\syncutils.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\syncsetup.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\syncsetup.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\tabbrowser.css to %ProgramFiles%\firefox\chrome\browser\content\browser\tabbrowser.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\networkpanel.xhtml to %ProgramFiles%\firefox\chrome\browser\content\browser\networkpanel.xhtml.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\abouthome.css to %ProgramFiles%\firefox\chrome\browser\content\browser\abouthome.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\pippki.manifest to %ProgramFiles%\firefox\chrome\pippki.manifest.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us.manifest to %ProgramFiles%\firefox\chrome\en_us.manifest.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser.manifest to %ProgramFiles%\firefox\chrome\browser.manifest.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\updater.ini to %ProgramFiles%\firefox\updater.ini.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\softokn3.chk to %ProgramFiles%\firefox\softokn3.chk.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\readme.txt to %ProgramFiles%\firefox\readme.txt.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\platform.ini to %ProgramFiles%\firefox\platform.ini.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\nssdbm3.chk to %ProgramFiles%\firefox\nssdbm3.chk.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\greprefs.js to %ProgramFiles%\firefox\greprefs.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\freebl3.chk to %ProgramFiles%\firefox\freebl3.chk.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\dependentlibs.list to %ProgramFiles%\firefox\dependentlibs.list.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\crashreporter_override.ini to %ProgramFiles%\firefox\crashreporter_override.ini.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\crashreporter.ini to %ProgramFiles%\firefox\crashreporter.ini.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome.manifest to %ProgramFiles%\firefox\chrome.manifest.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\aboutdialog.css to %ProgramFiles%\firefox\chrome\browser\content\browser\aboutdialog.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\nscontextmenu.js to %ProgramFiles%\firefox\chrome\browser\content\browser\nscontextmenu.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\migration\migration.js to %ProgramFiles%\firefox\chrome\browser\content\browser\migration\migration.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\toolkit.manifest to %ProgramFiles%\firefox\chrome\toolkit.manifest.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\hiddenwindow.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\hiddenwindow.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\fullscreen_video.xhtml to %ProgramFiles%\firefox\chrome\browser\content\browser\fullscreen_video.xhtml.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\browser.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\browser.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\browser.js to %ProgramFiles%\firefox\chrome\browser\content\browser\browser.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\browser.css to %ProgramFiles%\firefox\chrome\browser\content\browser\browser.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\basemenuoverlay.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\basemenuoverlay.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\aboutsynctabs.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\aboutsynctabs.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\aboutsynctabs.js to %ProgramFiles%\firefox\chrome\browser\content\browser\aboutsynctabs.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\aboutsynctabs.css to %ProgramFiles%\firefox\chrome\browser\content\browser\aboutsynctabs.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\aboutsessionrestore.xhtml to %ProgramFiles%\firefox\chrome\browser\content\browser\aboutsessionrestore.xhtml.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\aboutsessionrestore.js to %ProgramFiles%\firefox\chrome\browser\content\browser\aboutsessionrestore.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\aboutrobots.xhtml to %ProgramFiles%\firefox\chrome\browser\content\browser\aboutrobots.xhtml.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\aboutprivatebrowsing.xhtml to %ProgramFiles%\firefox\chrome\browser\content\browser\aboutprivatebrowsing.xhtml.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\abouthome.xhtml to %ProgramFiles%\firefox\chrome\browser\content\browser\abouthome.xhtml.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\abouthome.js to %ProgramFiles%\firefox\chrome\browser\content\browser\abouthome.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\aboutdialog.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\aboutdialog.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\aboutdialog.js to %ProgramFiles%\firefox\chrome\browser\content\browser\aboutdialog.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\syncquota.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\syncquota.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\migration\migration.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\migration\migration.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\sync.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\sync.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\languages.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\languages.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\selectbookmark.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\selectbookmark.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\selectbookmark.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\selectbookmark.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\security.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\security.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\security.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\security.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\sanitize.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\sanitize.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\privacy.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\privacy.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\privacy.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\privacy.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\preferences.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\preferences.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\permissionsutils.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\permissionsutils.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\permissions.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\permissions.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\permissions.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\permissions.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\main.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\main.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\main.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\main.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\languages.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\languages.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\fonts.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\fonts.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\sync.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\sync.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\tabs.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\tabs.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\tabs.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\tabs.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\safebrowsing\blockedsite.xhtml to %ProgramFiles%\firefox\chrome\browser\content\browser\safebrowsing\blockedsite.xhtml.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\keyhole_forward_mask.svg to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\keyhole_forward_mask.svg.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\inspector.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\inspector.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\fullscreen_video.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\fullscreen_video.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\enginemanager.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\enginemanager.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\browser.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\browser.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\aboutsynctabs.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\aboutsynctabs.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\aboutsessionrestore.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\aboutsessionrestore.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\aboutprivatebrowsing.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\aboutprivatebrowsing.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\aboutcerterror.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\aboutcerterror.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\search\searchbarbindings.css to %ProgramFiles%\firefox\chrome\browser\content\browser\search\searchbarbindings.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\search\enginemanager.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\search\enginemanager.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\search\enginemanager.js to %ProgramFiles%\firefox\chrome\browser\content\browser\search\enginemanager.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\safebrowsing\sb_loader.js to %ProgramFiles%\firefox\chrome\browser\content\browser\safebrowsing\sb_loader.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\safebrowsing\report_phishing_overlay.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\safebrowsing\report_phishing_overlay.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\pageinfo.css to %ProgramFiles%\firefox\chrome\browser\skin\classic\aero\browser\pageinfo.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\handlers.css to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\handlers.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\fonts.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\fonts.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\feeds.js to %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\feeds.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\movebookmarks.js to %ProgramFiles%\firefox\chrome\browser\content\browser\places\movebookmarks.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\history_panel.js to %ProgramFiles%\firefox\chrome\browser\content\browser\places\history_panel.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\editbookmarkoverlay.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\places\editbookmarkoverlay.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\editbookmarkoverlay.js to %ProgramFiles%\firefox\chrome\browser\content\browser\places\editbookmarkoverlay.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\controller.js to %ProgramFiles%\firefox\chrome\browser\content\browser\places\controller.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\browserplacesviews.js to %ProgramFiles%\firefox\chrome\browser\content\browser\places\browserplacesviews.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\bookmarkproperties2.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\places\bookmarkproperties2.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\bookmarkproperties.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\places\bookmarkproperties.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\bookmarkproperties.js to %ProgramFiles%\firefox\chrome\browser\content\browser\places\bookmarkproperties.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\security.js to %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\security.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\permissions.js to %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\permissions.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\pageinfo.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\pageinfo.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\pageinfo.js to %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\pageinfo.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\pageinfo.css to %ProgramFiles%\firefox\chrome\browser\content\browser\pageinfo\pageinfo.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\organizer.css to %ProgramFiles%\firefox\chrome\browser\content\browser\places\organizer.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\places.css to %ProgramFiles%\firefox\chrome\browser\content\browser\places\places.css.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\movebookmarks.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\places\movebookmarks.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\places.js to %ProgramFiles%\firefox\chrome\browser\content\browser\places\places.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\cookies.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\cookies.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\places.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\places\places.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\cookies.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\cookies.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\content.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\content.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\content.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\content.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\connection.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\connection.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\connection.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\connection.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\colors.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\colors.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\datetimepicker.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\datetimepicker.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\findbar.dtd to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\findbar.dtd.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\applicationmanager.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\applicationmanager.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\applicationmanager.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\applicationmanager.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\advanced_scripts.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\advanced_scripts.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\advanced.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\advanced.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\advanced.js to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\advanced.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\treeview.js to %ProgramFiles%\firefox\chrome\browser\content\browser\places\treeview.js.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\places\placesoverlay.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\places\placesoverlay.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\applications.xul to %ProgramFiles%\firefox\chrome\browser\content\browser\preferences\applications.xul.50ad0af7-d608-5d16-5a60-140e4f6e5c6a
from %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\findbar.properties to %ProgramFiles%\firefox\chrome\en_us\locale\en_us\global\findbar.properties.50ad0af7-d608-5d16-5a60-140e4f6e5c6a

Modifies the following files

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\asaprojectcompetition.pptx
C:\far2\addons\macros\descript.ion
C:\far2\addons\colors\default_highlighting\descript.ion
C:\far2\addons\colors\custom_highlighting\descript.ion
C:\far2\addons\colors\descript.ion
C:\far2\addons\readme.txt
C:\far2\addons\descript.ion
C:\far2\file_id.diz
C:\far2\farspa.lng
C:\far2\farrus.lng
C:\far2\farrus.hlf
C:\far2\farpol.lng
C:\far2\farhun.lng
C:\far2\farhun.hlf
C:\far2\farger.lng
C:\far2\fareng.lng
C:\far2\fareng.hlf
C:\far2\farcze.lng
<Drive name for removable media>:\dialmap.bmp
%HOMEPATH%\desktop\adhd_and_obesity.docx
C:\far2\far.map
<Drive name for removable media>:\dashborder_144.bmp
%HOMEPATH%\desktop\508softwareandos.doc
C:\far2\changelog_eng
<Drive name for removable media>:\dial.bmp
%HOMEPATH%\desktop\000814251_video_01.avi
C:\far2\changelog
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\waterresourcesag.pptx

Modifies multiple files.

Deletes itself.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'ip##gger.ru':80
'ip##gger.ru':443

TCP

HTTP GET requests

http://ip##gger.ru/1cpD27.jpg

Other

'ip##gger.ru':443

UDP

DNS ASK ip##gger.ru
'localhost':57742
'localhost':62626
'localhost':65407

Miscellaneous

Creates and executes the following

'%APPDATA%\microsoft\windows\ctfmon.exe' *
'%WINDIR%\syswow64\cmd.exe' /e:on /c md "%APPDATA%\Microsoft\Windows" & copy "<Full path to file>" "%APPDATA%\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t...' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "<Full path to file>" & if not exist "<Full path to file>" exit )' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /e:on /c md "%APPDATA%\Microsoft\Windows" & copy "<Full path to file>" "%APPDATA%\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t...
'%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t REG_SZ /F /D "\"%APPDATA%\Microsoft\Windows\ctfmon.exe\" *"
'%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "<Full path to file>" & if not exist "<Full path to file>" exit )
'%WINDIR%\syswow64\ping.exe' -n 3 127.1

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial