Trojan.Encoder.38931

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'hostslertvoantw' = '<SYSTEM32>\CMD.EXE /C START "" "%HOMEPATH%\Documents\rfsttdbvpmna.exe"'

Creates or modifies the following files

%ProgramFiles%\microsoft office\office14\startup\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\startup\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\xlstart\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\xlstart\-!recover!-vncoj++.txt

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Modifies file system

Creates the following files

%HOMEPATH%\documents\rfsttdbvpmna.exe
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\basic\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\basic\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\certificates\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\media\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\media\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\onenote\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\onenote\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\outlookautodiscover\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\outlookautodiscover\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\pagesize\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\pagesize\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\proof\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\proof\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\proof\1036\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\proof\1036\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\proof\3082\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\proof\3082\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\proof\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\proof\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\pubba\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\pubba\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\pubwiz\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\pubwiz\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\queries\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\queries\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\samples\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\samples\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\stationery\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\stationery\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\stationery\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\library\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\library\solver\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\toolicons\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\toolicons\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\xml files\space templates\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\xml files\space templates\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\xml files\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\xml files\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\infopathom\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\infopathom\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\library\analysis\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\library\analysis\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\library\solver\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\pubftscm\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\pubftscm\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\pubspapr\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\pubspapr\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\quickstyles\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\quickstyles\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1036\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1036\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\3082\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\3082\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\accessweb\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\accessweb\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\accwiz\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\accwiz\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\addins\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\addins\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\bibliography\sort\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\bibliography\sort\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\stationery\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\bibliography\style\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\media\office14\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\media\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\media\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\bibliography\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\bibliography\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\dataservices\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\dataservices\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\media\office14\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\library\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\bibliography\style\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\borders\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\sounds\places\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\sounds\places\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\things\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\sounds\things\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\sounds\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\toolbmps\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\toolbmps\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\bibliography\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\sounds\people\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\bibliography\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\people\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\borders\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\convert\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\convert\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\convert\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\convert\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\document parts\1033\14\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\document parts\1033\14\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\document parts\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\document parts\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\document parts\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\document parts\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\en\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\en\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\forms\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\forms\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\forms\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\forms\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\components\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\components\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\managedobjects\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\managedobjects\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\servers\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\servers\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\components\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\components\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\144dpi\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\1033\access\part\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\css\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\css\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\images\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\images\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\css\-!recover!-vncoj++.png
%ProgramFiles%\windows portable devices\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\css\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\images\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\images\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\css\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\css\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\js\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\js\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\js\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\clock.gadget\en-us\js\-!recover!-vncoj++.txt
%ProgramFiles%\windows portable devices\-!recover!-vncoj++.png
%ProgramFiles%\windows photo viewer\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\images\-!recover!-vncoj++.txt
%ProgramFiles%\windows mail\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows mail\-!recover!-vncoj++.png
%ProgramFiles%\windows mail\-!recover!-vncoj++.txt
%ProgramFiles%\windows media player\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows media player\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows media player\media renderer\-!recover!-vncoj++.png
%ProgramFiles%\windows media player\media renderer\-!recover!-vncoj++.txt
%ProgramFiles%\windows media player\network sharing\-!recover!-vncoj++.png
%ProgramFiles%\windows media player\network sharing\-!recover!-vncoj++.txt
%ProgramFiles%\windows media player\skins\-!recover!-vncoj++.png
%ProgramFiles%\windows media player\skins\-!recover!-vncoj++.txt
%ProgramFiles%\windows media player\visualizations\-!recover!-vncoj++.png
%ProgramFiles%\windows media player\visualizations\-!recover!-vncoj++.txt
%ProgramFiles%\windows media player\-!recover!-vncoj++.png
%ProgramFiles%\windows media player\-!recover!-vncoj++.txt
%ProgramFiles%\windows nt\accessories\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows nt\accessories\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows nt\accessories\-!recover!-vncoj++.png
%ProgramFiles%\windows nt\accessories\-!recover!-vncoj++.txt
%ProgramFiles%\windows nt\tabletextservice\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows nt\tabletextservice\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows nt\tabletextservice\-!recover!-vncoj++.png
%ProgramFiles%\windows nt\tabletextservice\-!recover!-vncoj++.txt
%ProgramFiles%\windows nt\-!recover!-vncoj++.png
%ProgramFiles%\windows nt\-!recover!-vncoj++.txt
%ProgramFiles%\windows photo viewer\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows photo viewer\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\images\-!recover!-vncoj++.png
%ProgramFiles%\windows journal\-!recover!-vncoj++.txt
%ProgramFiles%\windows photo viewer\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\access\datatype\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\js\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\images\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\images\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\css\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\css\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\js\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\js\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\in_sidebar\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\in_sidebar\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\on_desktop\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\on_desktop\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\css\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\css\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\js\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\js\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\120dpi\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\120dpi\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\js\-!recover!-vncoj++.png
%ProgramFiles%\windows journal\-!recover!-vncoj++.png
%ProgramFiles%\windows mail\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\css\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\css\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\js\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\js\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\images\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\images\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\currency.gadget\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\css\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\css\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\images\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\images\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\js\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\js\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\css\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\css\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\js\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\js\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\images\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\images\-!recover!-vncoj++.txt
%ProgramFiles%\windows sidebar\gadgets\picturepuzzle.gadget\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\css\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\cpu.gadget\-!recover!-vncoj++.txt
%ProgramFiles%\windows journal\templates\-!recover!-vncoj++.txt
%ProgramFiles%\windows journal\templates\-!recover!-vncoj++.png
%ProgramFiles%\windows journal\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\-!recover!-vncoj++.png
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\-!recover!-vncoj++.png
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\-!recover!-vncoj++.png
%ProgramFiles%\microsoft sync framework\v1.0\runtime\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sync framework\v1.0\-!recover!-vncoj++.png
%ProgramFiles%\microsoft sync framework\v1.0\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sync framework\-!recover!-vncoj++.png
%ProgramFiles%\microsoft sync framework\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft synchronization services\ado.net\v1.0\-!recover!-vncoj++.png
%ProgramFiles%\microsoft synchronization services\ado.net\v1.0\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft synchronization services\ado.net\-!recover!-vncoj++.png
%ProgramFiles%\microsoft synchronization services\ado.net\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft synchronization services\-!recover!-vncoj++.png
%ProgramFiles%\microsoft synchronization services\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla firefox\browser\features\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\browser\features\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla firefox\browser\visualelements\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\browser\visualelements\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla firefox\browser\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\browser\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla firefox\defaults\pref\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\defaults\pref\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla firefox\defaults\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\defaults\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla firefox\distibution\-!recover!-vncoj++.png
%ProgramFiles%\microsoft sync framework\v1.0\documentation\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\access\datatype\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla firefox\distibution\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\1033\access\wss\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\1033\access\wss\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\access\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\1033\access\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\fax\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\1033\fax\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\14\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\1033\onenote\14\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\1033\access\part\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\presentation designs\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\presentation designs\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\templates\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\-!recover!-vncoj++.png
%ProgramFiles%\microsoft sql server compact edition\v3.5\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sql server compact edition\-!recover!-vncoj++.png
%ProgramFiles%\microsoft sql server compact edition\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\-!recover!-vncoj++.png
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\templates\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft sync framework\v1.0\documentation\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\media\office14\lines\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla firefox\fonts\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\-!recover!-vncoj++.txt
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\-!recover!-vncoj++.txt
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\-!recover!-vncoj++.png
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\-!recover!-vncoj++.txt
%ProgramFiles%\msbuild\microsoft\-!recover!-vncoj++.png
%ProgramFiles%\msbuild\microsoft\-!recover!-vncoj++.txt
%ProgramFiles%\msbuild\-!recover!-vncoj++.png
%ProgramFiles%\msbuild\-!recover!-vncoj++.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\redistlist\-!recover!-vncoj++.png
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\redistlist\-!recover!-vncoj++.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\-!recover!-vncoj++.png
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\-!recover!-vncoj++.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\redistlist\-!recover!-vncoj++.png
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\redistlist\-!recover!-vncoj++.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\-!recover!-vncoj++.png
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\-!recover!-vncoj++.txt
%ProgramFiles%\reference assemblies\microsoft\framework\-!recover!-vncoj++.png
%ProgramFiles%\reference assemblies\microsoft\framework\-!recover!-vncoj++.txt
%ProgramFiles%\reference assemblies\microsoft\-!recover!-vncoj++.png
%ProgramFiles%\reference assemblies\microsoft\-!recover!-vncoj++.txt
%ProgramFiles%\reference assemblies\-!recover!-vncoj++.png
%ProgramFiles%\reference assemblies\-!recover!-vncoj++.txt
%ProgramFiles%\uninstall information\-!recover!-vncoj++.png
%ProgramFiles%\uninstall information\-!recover!-vncoj++.txt
%ProgramFiles%\windows defender\en-us\-!recover!-vncoj++.png
%ProgramFiles%\windows defender\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\windows defender\-!recover!-vncoj++.png
%ProgramFiles%\windows defender\-!recover!-vncoj++.txt
%ProgramFiles%\windows journal\en-us\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\fonts\-!recover!-vncoj++.txt
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\-!recover!-vncoj++.png
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\gmp-clearkey\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\gmp-clearkey\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla firefox\uninstall\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\uninstall\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla firefox\-!recover!-vncoj++.png
%ProgramFiles%\mozilla firefox\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\chrome\icons\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\chrome\icons\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\chrome\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\chrome\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\defaults\messenger\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\defaults\messenger\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\defaults\pref\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\defaults\pref\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\defaults\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\defaults\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\features\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\features\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\fonts\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\fonts\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\isp\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\isp\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\uninstall\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\uninstall\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\visualelements\-!recover!-vncoj++.png
%ProgramFiles%\mozilla thunderbird\visualelements\-!recover!-vncoj++.txt
%ProgramFiles%\mozilla thunderbird\-!recover!-vncoj++.png
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\en-us\css\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\media\office14\lines\-!recover!-vncoj++.png
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\1033\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\1033\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\cultures\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\cultures\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\msinfo\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\msinfo\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\msinfo\en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\msclientdatamgr\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\pt-pt\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\pt-pt\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\ro-ro\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\ro-ro\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\ru-ru\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\ru-ru\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\sk-sk\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\sk-sk\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\sl-si\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\sl-si\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\sv-se\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\sv-se\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\th-th\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\th-th\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\tr-tr\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\tr-tr\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\uk-ua\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\uk-ua\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\zh-cn\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\zh-cn\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\zh-tw\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\zh-tw\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\msclientdatamgr\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\pt-br\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\msinfo\en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\arctic\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\arctic\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\axis\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\axis\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\blends\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\blends\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\boldstri\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\boldstri\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\breeze\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\breeze\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\canyon\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\canyon\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\capsules\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\capsules\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\cascade\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\cascade\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\compass\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\compass\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\concrete\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\concrete\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\deepblue\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\deepblue\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\echo\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\echo\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\eclipse\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\pl-pl\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\pt-br\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\textconv\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\office setup controller\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\office14\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\proof\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\proof\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\smart tag\1033\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\smart tag\1033\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\smart tag\lists\1033\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\smart tag\lists\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\smart tag\lists\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\smart tag\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\smart tag\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\source engine\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\source engine\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\stationery\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\stationery\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\textconv\en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\textconv\en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\textconv\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\pl-pl\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\nl-nl\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\nl-nl\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
C:\msocache\all users\-!recover!-vncoj++.png
C:\msocache\all users\-!recover!-vncoj++.txt
C:\msocache\-!recover!-vncoj++.png
C:\msocache\-!recover!-vncoj++.txt
C:\perflogs\admin\-!recover!-vncoj++.png
C:\perflogs\admin\-!recover!-vncoj++.txt
C:\perflogs\-!recover!-vncoj++.png
C:\perflogs\-!recover!-vncoj++.txt
%CommonProgramFiles%\designer\-!recover!-vncoj++.png
%CommonProgramFiles%\designer\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\dw\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\dw\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\equation\1033\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\equation\1033\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\equation\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\equation\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\euro\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\euro\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\filters\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\filters\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\eclipse\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\grphflt\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
%HOMEPATH%\documents\-!recover!-!file!-.txt
C:\documents and settings\-!recover!-vncoj++.png
C:\documents and settings\-!recover!-vncoj++.txt
C:\kms\-!recover!-vncoj++.png
C:\kms\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
%HOMEPATH%\documents\desctop._ini
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\grphflt\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\ar-sa\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\he-il\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\he-il\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\hr-hr\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\hr-hr\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\hu-hu\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\hu-hu\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\hwrcustomization\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\it-it\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\it-it\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\ja-jp\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\ja-jp\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\ko-kr\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\ko-kr\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\lt-lt\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\lt-lt\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\lv-lv\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\lv-lv\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\nb-no\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\nb-no\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\help\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\help\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\-!recover!-vncoj++.png
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\ar-sa\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\bg-bg\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\bg-bg\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\cs-cz\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\cs-cz\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\da-dk\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\da-dk\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\de-de\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\de-de\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\el-gr\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\el-gr\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\es-es\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\es-es\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\et-ee\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\et-ee\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fi-fi\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fi-fi\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fr-fr\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fr-fr\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\media\office14\bullets\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\sports\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\stacking\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\stacking\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\travel\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\travel\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\videowall\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\videowall\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\vignette\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\vignette\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\sports\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\-!recover!-vncoj++.txt
%ProgramFiles%\internet explorer\en-us\-!recover!-vncoj++.png
%ProgramFiles%\internet explorer\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\internet explorer\signup\-!recover!-vncoj++.png
%ProgramFiles%\internet explorer\signup\-!recover!-vncoj++.txt
%ProgramFiles%\internet explorer\-!recover!-vncoj++.png
%ProgramFiles%\internet explorer\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\bin\plugin2\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\bin\plugin2\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\bin\server\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\bin\server\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\shatter\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\bin\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\en-us\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\flippage\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\flippage\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\full\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\full\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\memories\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\memories\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\oldage\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\oldage\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\performance\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\performance\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\pets\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\pets\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\push\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\push\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\bin\-!recover!-vncoj++.png
%CommonProgramFiles%\-!recover!-vncoj++.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\shatter\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\edge\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\amd64\-!recover!-vncoj++.png
%ProgramFiles%\microsoft analysis services\as oledb\10\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft analysis services\as oledb\-!recover!-vncoj++.png
%ProgramFiles%\microsoft analysis services\as oledb\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft analysis services\-!recover!-vncoj++.png
%ProgramFiles%\microsoft analysis services\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\clipart\pub60cor\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\clipart\pub60cor\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\clipart\publisher\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\clipart\publisher\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\clipart\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\clipart\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\document themes 14\theme colors\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\document themes 14\theme colors\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\document themes 14\theme effects\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\document themes 14\theme effects\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\document themes 14\theme fonts\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\document themes 14\theme fonts\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\document themes 14\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\document themes 14\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\media\cagcat10\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\media\cagcat10\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\media\cagcat10\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\media\cagcat10\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\media\office14\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\media\office14\1033\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft office\media\office14\autoshap\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\media\office14\autoshap\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft analysis services\as oledb\10\-!recover!-vncoj++.png
%CommonProgramFiles%\-!recover!-vncoj++.png
%ProgramFiles%\dvd maker\en-us\-!recover!-vncoj++.png
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\applet\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\applet\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\ext\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\ext\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\images\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\images\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\jfr\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\jfr\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\management\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\management\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\security\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\security\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\lib\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\-!recover!-vncoj++.txt
%ProgramFiles%\java\jre1.8.0_45\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\-!recover!-vncoj++.txt
%ProgramFiles%\java\-!recover!-vncoj++.png
%ProgramFiles%\java\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\-!recover!-vncoj++.png
%ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\-!recover!-vncoj++.txt
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\-!recover!-vncoj++.png
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\-!recover!-vncoj++.png
%ProgramFiles%\java\jre1.8.0_45\lib\amd64\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\-!recover!-vncoj++.png
%CommonProgramFiles%\system\ole db\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\satin\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\satin\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\sky\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\sky\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\slate\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\slate\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\sonora\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\sonora\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\spring\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\spring\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\strtedge\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\strtedge\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\studio\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\studio\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\sumipntg\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\sumipntg\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\water\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\water\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\watermar\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\watermar\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\translat\arfr\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\translat\arfr\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\translat\enes\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\translat\enes\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\translat\enfr\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\ripple\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\ricepapr\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\rmnsque\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\edge\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\translat\enfr\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\ricepapr\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\expeditn\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\expeditn\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\ice\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\ice\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\indust\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\indust\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\iris\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\iris\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\journal\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\journal\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\layers\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\layers\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\level\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\level\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\network\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\papyrus\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\papyrus\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\pixel\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\pixel\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\profile\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\profile\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\quad\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\quad\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\radial\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\radial\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\refined\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\refined\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\network\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\themes14\ripple\-!recover!-vncoj++.png
%ProgramFiles%\microsoft office\media\office14\bullets\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\translat\esen\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\translat\frar\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\web server extensions\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\web server extensions\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\-!recover!-vncoj++.txt
%CommonProgramFiles%\services\-!recover!-vncoj++.png
%CommonProgramFiles%\services\-!recover!-vncoj++.txt
%CommonProgramFiles%\speechengines\microsoft\-!recover!-vncoj++.png
%CommonProgramFiles%\speechengines\microsoft\-!recover!-vncoj++.txt
%CommonProgramFiles%\speechengines\-!recover!-vncoj++.png
%CommonProgramFiles%\speechengines\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\ado\en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\system\ado\en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\ado\-!recover!-vncoj++.png
%CommonProgramFiles%\system\ado\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\system\en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\msadc\en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\system\msadc\en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\msadc\-!recover!-vncoj++.png
%CommonProgramFiles%\system\msadc\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\msmapi\1033\-!recover!-vncoj++.png
%CommonProgramFiles%\system\msmapi\1033\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\msmapi\-!recover!-vncoj++.png
%CommonProgramFiles%\system\msmapi\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\ole db\en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\system\ole db\en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\system\ole db\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\translat\esen\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\translat\frar\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\themes14\rmnsque\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\translat\fren\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\translat\fren\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\translat\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\translat\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\triedit\en-us\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\triedit\en-us\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\triedit\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\triedit\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\vba\vba7\1033\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\vba\vba7\1033\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\vba\vba7\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\vba\vba7\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\vba\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\vba\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\vc\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\vc\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\vgx\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\vgx\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\vsto\10.0\1033\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\vsto\10.0\1033\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\vsto\10.0\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\vsto\10.0\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\vsto\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\vsto\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\web folders\1033\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\web folders\1033\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\web folders\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\web folders\-!recover!-vncoj++.txt
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\-!recover!-vncoj++.png
%CommonProgramFiles%\microsoft shared\web server extensions\14\bin\-!recover!-vncoj++.png
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\144dpi\-!recover!-vncoj++.txt

Sets the 'hidden' attribute to the following files

%HOMEPATH%\documents\rfsttdbvpmna.exe

Modifies the following files

%CommonProgramFiles%\microsoft shared\grphflt\ms.eps
%CommonProgramFiles%\microsoft shared\themes14\layers\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\journal\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\iris\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\indust\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\ice\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\expeditn\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\evrgreen\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\edge\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\eclipse\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\echo\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\deepblue\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\concrete\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\compass\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\cascade\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\capsules\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\canyon\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\breeze\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\boldstri\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\blends\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\axis\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\arctic\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\thmbnail.png
%CommonProgramFiles%\microsoft shared\smart tag\metconv.txt
%CommonProgramFiles%\microsoft shared\grphflt\ms.png
%CommonProgramFiles%\microsoft shared\grphflt\ms.jpg
%CommonProgramFiles%\microsoft shared\themes14\level\thmbnail.png
%CommonProgramFiles%\microsoft shared\themes14\network\thmbnail.png

Modifies multiple files.

Deletes itself.

Modifies user data files (Trojan.Encoder).

Network activity

Connects to

'ai##ab.pro':80
'al###tadom.com':80

TCP

HTTP POST requests

http://ai##ab.pro/modules/mod_ariimageslider/mzfile.php
http://al###tadom.com/mzfile.php

UDP

DNS ASK 4t##ka.com
DNS ASK ai##ab.pro
DNS ASK al###tadom.com
DNS ASK on##so.com
DNS ASK 13###225565.com
DNS ASK af###xvn.com

Miscellaneous

Creates and executes the following

'%HOMEPATH%\documents\rfsttdbvpmna.exe'
'%WINDIR%\syswow64\cmd.exe' /c DEL <Full path to file> >> NUL' (with hidden window)
'<SYSTEM32>\wbem\wmic.exe' shadowcopy delete /nointeractive' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c DEL <Full path to file> >> NUL

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial