Trojan.Encoder.41012

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\how to recovery files.txt
<Drive name for removable media>:\indogerman2010.pptx.encrypting
<Drive name for removable media>:\indogerman2010.pptx.encrypting.map
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx.encrypting
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx.encrypting.map
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\waterresourcesag.pptx.encrypting
<Drive name for removable media>:\waterresourcesag.pptx.encrypting.map
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt.encrypting.map
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx.encrypting.map
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\middaugh_keynote.pptx.encrypting
<Drive name for removable media>:\middaugh_keynote.pptx.encrypting.map
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\roozenedowebinar.pptx.encrypting
<Drive name for removable media>:\roozenedowebinar.pptx.encrypting.map
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx.encrypting
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt.encrypting
<Drive name for removable media>:\fungalnameauthors.rtf.encrypting.map
<Drive name for removable media>:\price030215.xls.encrypting
<Drive name for removable media>:\1sm_price.zip.encrypting
<Drive name for removable media>:\1sm_price.zip.encrypting.map
<Drive name for removable media>:\disclosuredetails.xlsx.encrypting
<Drive name for removable media>:\disclosuredetails.xlsx.encrypting.map
<Drive name for removable media>:\al.xlsx.encrypting
<Drive name for removable media>:\al.xlsx.encrypting.map
<Drive name for removable media>:\mjaxm19zbwnjy19jb21wzxrpdglvbl9wb2ludhnfanvsmjaxmy54bhn4.encrypted
<Drive name for removable media>:\guide_reorganization_mapping.xls.encrypting
<Drive name for removable media>:\pubnet_855.rtf.encrypting.map
<Drive name for removable media>:\fungalnameauthors.rtf.encrypting
<Drive name for removable media>:\price030215.xls.encrypting.map
<Drive name for removable media>:\pandp.rtf.encrypting
<Drive name for removable media>:\pandp.rtf.encrypting.map
<Drive name for removable media>:\waterlandhealthkano.rtf.encrypting
<Drive name for removable media>:\waterlandhealthkano.rtf.encrypting.map
<Drive name for removable media>:\krsweden.rtf.encrypting
<Drive name for removable media>:\krsweden.rtf.encrypting.map
<Drive name for removable media>:\pubnet_855.rtf.encrypting
<Drive name for removable media>:\guide_reorganization_mapping.xls.encrypting.map
<Drive name for removable media>:\ksearch_esa_talk.ppt.encrypting
<Drive name for removable media>:\ksearch_esa_talk.ppt.encrypting.map
<Drive name for removable media>:\sim_gametheory_to_finance.ppt.encrypting
<Drive name for removable media>:\mjewmjuyoda5lmpwzw==.encrypted
<Drive name for removable media>:\parnas_01.jpg.encrypting
<Drive name for removable media>:\parnas_01.jpg.encrypting.map
<Drive name for removable media>:\nwfieldnotes1966.docx.encrypting
<Drive name for removable media>:\nwfieldnotes1966.docx.encrypting.map
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx.encrypting
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx.encrypting.map
<Drive name for removable media>:\2.jpg.encrypting
<Drive name for removable media>:\c2rzemzvlmrvy3g=.encrypted
<Drive name for removable media>:\weeklysheet1215.doc.encrypting.map
<Drive name for removable media>:\february_catalogue__2015.doc.encrypting
<Drive name for removable media>:\february_catalogue__2015.doc.encrypting.map
<Drive name for removable media>:\correct.avi.encrypting
<Drive name for removable media>:\correct.avi.encrypting.map
<Drive name for removable media>:\delete.avi.encrypting
<Drive name for removable media>:\delete.avi.encrypting.map
<Drive name for removable media>:\decryption_ids.txt
<Drive name for removable media>:\weeklysheet1215.doc.encrypting
<Drive name for removable media>:\my5qcgc=.encrypted
<Drive name for removable media>:\2.jpg.encrypting.map
<Drive name for removable media>:\spanner.mov.encrypting.map
<Drive name for removable media>:\sim_gametheory_to_finance.ppt.encrypting.map
<Drive name for removable media>:\10thingscondoms.pdf.encrypting
<Drive name for removable media>:\proposaltemplates.ppt.encrypting
<Drive name for removable media>:\proposaltemplates.ppt.encrypting.map
<Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt.encrypting
<Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt.encrypting.map
<Drive name for removable media>:\metac.ppt.encrypting
<Drive name for removable media>:\metac.ppt.encrypting.map
<Drive name for removable media>:\bc01.pdf.encrypting
<Drive name for removable media>:\bc01.pdf.encrypting.map
<Drive name for removable media>:\10thingscondoms.pdf.encrypting.map
<Drive name for removable media>:\spanner.mov.encrypting
<Drive name for removable media>:\bg9tnjaylnbkzg==.encrypted
<Drive name for removable media>:\fil_20060629111052.pdf.encrypting
<Drive name for removable media>:\fil_20060629111052.pdf.encrypting.map
<Drive name for removable media>:\mjaxns0wmi13b3jtcy1uyw5vcgfydgljbgutdg94awnpdhkucgrm.encrypted
<Drive name for removable media>:\51.mp4.encrypting
<Drive name for removable media>:\51.mp4.encrypting.map
<Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4.encrypting
<Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4.encrypting.map
<Drive name for removable media>:\price.zip.encrypting.map
<Drive name for removable media>:\price.zip.encrypting

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "<Current directory>\"

Reads files which store third party applications passwords

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Modifies file system

Creates the following files

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\494bf419e40d26ec80a426c8fc08f5e8_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\resources.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\natives_blob.bin.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\decryption_ids.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\how to recovery files.txt
%LOCALAPPDATA%\iconcache.db.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\snapshot_blob.bin.encrypting.map
%LOCALAPPDATA%\decryption_ids.txt
C:\users\public\pictures\sample pictures\tulips.jpg.encrypting.map
C:\users\public\pictures\sample pictures\penguins.jpg.encrypting.map
C:\users\public\pictures\sample pictures\lighthouse.jpg.encrypting.map
C:\users\public\pictures\sample pictures\koala.jpg.encrypting.map
C:\users\public\pictures\sample pictures\jellyfish.jpg.encrypting.map
C:\users\public\pictures\sample pictures\hydrangeas.jpg.encrypting.map
C:\users\public\pictures\sample pictures\desert.jpg.encrypting.map
%LOCALAPPDATA%\how to recovery files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\how to recovery files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\decryption_ids.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\chrome.7z.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fa.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\et.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\es.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\es-419.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\en-us.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\en-gb.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\el.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\de.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\da.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\cs.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ca.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\bn.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\bg.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ar.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\am.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\decryption_ids.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\how to recovery files.txt
C:\users\public\pictures\sample pictures\chrysanthemum.jpg.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fi.pak.encrypting.map
C:\users\public\pictures\sample pictures\decryption_ids.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\th.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\te.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ta.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\sw.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\sv.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\sr.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\sk.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\tr.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ru.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-pt.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-br.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\pl.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\pa.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\nn.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\nl.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\nb.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ro.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\uk.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\uz.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\vi.pak.encrypting.map
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\decryption_ids.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\how to recovery files.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\decryption_ids.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\how to recovery files.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\decryption_ids.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\how to recovery files.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\racwmieventdata.dat.encrypting.map
%ALLUSERSPROFILE%\microsoft\rac\statedata\decryption_ids.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\how to recovery files.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.dat.encrypting.map
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\decryption_ids.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\how to recovery files.txt
%ProgramFiles(x86)%\windows sidebar\gadgets\slideshow.gadget\images\decryption_ids.txt
%ProgramFiles(x86)%\windows sidebar\gadgets\slideshow.gadget\images\how to recovery files.txt
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\zu.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-tw.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-cn.pak.encrypting.map
C:\users\public\pictures\sample pictures\how to recovery files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fil.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fr.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\gu.pak.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\y29va2llcy5zcwxpdgu=.encrypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.db.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\decryption_ids.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\how to recovery files.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\mzg3mdexmjcynhjzzwdtbm9pdhrldc1lcy5zcwxpdgu=.encrypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\zw5pz21hawwuc3fsaxrl.encrypted
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.encrypting.map
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\decryption_ids.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\how to recovery files.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\startupcache\startupcache.8.little.encrypting.map
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\startupcache\decryption_ids.txt
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\startupcache\how to recovery files.txt
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\decryption_ids.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\decryption_ids.txt
<Current directory>\selfdelete.bat
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.encrypting.map
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.encrypting.map
%HOMEPATH%\desktop\ovp25012015.doc.encrypting.map
%HOMEPATH%\desktop\lisp_success.doc.encrypting.map
%HOMEPATH%\desktop\join.avi.encrypting.map
%HOMEPATH%\desktop\glidescope_review_rev_010.docx.encrypting.map
%HOMEPATH%\desktop\zmlszv9wxzawmdawmdawxzeznze1otc1otiuzg9jea==.encrypted
%HOMEPATH%\desktop\delete.avi.encrypting.map
%HOMEPATH%\desktop\adhd_and_obesity.docx.encrypting.map
%HOMEPATH%\desktop\000814251_video_01.avi.encrypting.map
%HOMEPATH%\desktop\decryption_ids.txt
%HOMEPATH%\desktop\how to recovery files.txt
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\d2viyxbwc3n0b3jllnnxbgl0zq==.encrypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cgvybwlzc2lvbnmuc3fsaxrl.encrypted
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.db.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.encrypting.map
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\how to recovery files.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\how to recovery files.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\new\edb00001.log.encrypting.map
%LOCALAPPDATA%\microsoft\windows mail\backup\new\decryption_ids.txt
%LOCALAPPDATA%\microsoft\windows mail\backup\new\how to recovery files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ko.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\nl.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\nb.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ms.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\mr.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ml.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\lv.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\lt.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\kn.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\pt-br.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ja.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\it.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\id.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\hu.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\hr.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\hi.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\he.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ms.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ro.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\pt-pt.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sk.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\pl.pak.encrypting.map
%LOCALAPPDATA%\microsoft\windows mail\edb00001.log.encrypting.map
%LOCALAPPDATA%\microsoft\windows mail\edb.log.encrypting.map
%LOCALAPPDATA%\microsoft\windows mail\decryption_ids.txt
%LOCALAPPDATA%\microsoft\windows mail\how to recovery files.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\zh-tw.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\zh-cn.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\vi.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\uk.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\tr.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\th.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\te.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ta.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sw.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sv.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sr.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sl.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ru.pak.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\mk.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-us.pak.encrypting.map
%ProgramFiles%\microsoft office\office14\1033\how to recovery files.txt
%ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting.map
%ProgramFiles%\microsoft office\office14\t0nssemurefu.encrypted
%ProgramFiles%\microsoft office\office14\te9ps1vqlkrbva==.encrypted
%ProgramFiles%\microsoft office\office14\engdic.dat.encrypting.map
%ProgramFiles%\microsoft office\office14\decryption_ids.txt
%ProgramFiles%\microsoft office\office14\how to recovery files.txt
%ProgramFiles%\microsoft office\office14\1033\decryption_ids.txt
%ProgramFiles%\microsoft office\clipart\pub60cor\uegwmjgyououslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodczmzcuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq5mdauslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4otuuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4odguslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4oduuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5nzauslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting.map
%ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting.map
%ProgramFiles%\microsoft office\office14\1033\t1vurk9sts5eqvq=.encrypted
%ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting.map
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting.map
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting.map
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting.map
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\decryption_ids.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\how to recovery files.txt
%ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting.map
%ProgramFiles%\microsoft office\office14\samples\decryption_ids.txt
%ProgramFiles%\microsoft office\office14\samples\how to recovery files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\sw5mb1bhdghxzwxjb21lsw1hz2uuanbn.encrypted
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\decryption_ids.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\how to recovery files.txt
%ProgramFiles%\microsoft office\office14\groove\toolbmps\tg9naw5eawfsb2dcywnrz3jvdw5klmpwzw==.encrypted
%ProgramFiles%\microsoft office\office14\groove\toolbmps\decryption_ids.txt
%ProgramFiles%\microsoft office\office14\groove\toolbmps\how to recovery files.txt
%ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting.map
%ProgramFiles%\microsoft office\office14\1033\ufnsq0hmvfmurefu.encrypted
%ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njkuslbh.encrypted
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njyuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mjyuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi4mzyuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjaymjc1ntguslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjaxnzc4mdyuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjaxndkxmtguslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjaxndg3ntcuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjaxnduymtiuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjawotkxnjyuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\decryption_ids.txt
%ProgramFiles%\microsoft office\clipart\pub60cor\how to recovery files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting.map
%ProgramFiles%\java\jre1.8.0_45\lib\decryption_ids.txt
%ProgramFiles%\java\jre1.8.0_45\lib\how to recovery files.txt
%ALLUSERSPROFILE%\key
%ProgramFiles%\microsoft office\clipart\pub60cor\sjawotkxoteuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzguslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njmuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njeuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntkuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntuuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntquslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntiuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntauslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndcuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndquslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndiuslbh.encrypted
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njcuslbh.encrypted
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting.map
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\how to recovery files.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\decryption_ids.txt
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\da.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\cs.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ca.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\bn.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\bg.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\be.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\az.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\el.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\de.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\how to recovery files.txt
%ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.bin.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_250_percent.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_200_percent.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_150_percent.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_100_percent.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\af.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\lv.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-gb.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\lt.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ko.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\kk.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ja.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\it.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\id.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\hu.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\hr.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\hi.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\gd.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\fy.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr-ca.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\fil.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\fi.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\es.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\es-419.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\decryption_ids.txt
%ProgramFiles(x86)%\opera\29.0.1795.47\natives_blob.bin.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\decryption_ids.txt
%ProgramFiles(x86)%\opera\29.0.1795.47\how to recovery files.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\decryption_ids.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\decryption_ids.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\how to recovery files.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\how to recovery files.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\rgvmyxvsdelelnbkzg==.encrypted
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\decryption_ids.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\how to recovery files.txt
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\decryption_ids.txt
%ProgramFiles%\windows sidebar\gadgets\slideshow.gadget\images\how to recovery files.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\me.pak.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\decryption_ids.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\how to recovery files.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\how to recovery files.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\qwrvymvjrc5wzgy=.encrypted
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\u3bsyxnou2nyzwvulnppca==.encrypted
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\decryption_ids.txt
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\how to recovery files.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\icudt26l.dat.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\decryption_ids.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\how to recovery files.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\zwrpdf9wzgzfcg9zdgvylmpwzw==.encrypted
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\decryption_ids.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\how to recovery files.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\rhluyw1pyy5wzgy=.encrypted
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\decryption_ids.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\how to recovery files.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\words.pdf.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\decryption_ids.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.encrypting.map
nul

Deletes the following files

%ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\lt.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\lv.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ml.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\mr.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ms.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\nb.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\nl.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\pl.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\pt-br.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\pt-pt.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ro.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\en-us.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ru.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sl.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sr.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sv.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sw.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ta.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\te.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\th.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\tr.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\uk.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\vi.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\zh-cn.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\kn.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ko.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ja.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\it.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\id.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\snapshot_blob.bin.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\chrome.7z.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\am.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ar.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\bg.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\bn.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\ca.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\cs.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\da.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\de.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\el.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\zh-tw.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\sk.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\en-gb.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\es.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\et.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fa.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fi.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fil.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\fr.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\gu.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\he.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\hi.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\hr.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\hu.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\resources.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\es-419.pak.encrypting.map
%HOMEPATH%\desktop\adhd_and_obesity.docx.encrypting.map
<Drive name for removable media>:\1sm_price.zip.encrypting.map
%LOCALAPPDATA%\microsoft\windows mail\backup\new\edb00001.log.encrypting.map
<Drive name for removable media>:\fil_20060629111052.pdf.encrypting.map
<Drive name for removable media>:\10thingscondoms.pdf.encrypting.map
<Drive name for removable media>:\bc01.pdf.encrypting.map
<Drive name for removable media>:\metac.ppt.encrypting.map
<Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt.encrypting.map
<Drive name for removable media>:\proposaltemplates.ppt.encrypting.map
<Drive name for removable media>:\sim_gametheory_to_finance.ppt.encrypting.map
<Drive name for removable media>:\ksearch_esa_talk.ppt.encrypting.map
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt.encrypting.map
<Drive name for removable media>:\roozenedowebinar.pptx.encrypting.map
<Drive name for removable media>:\middaugh_keynote.pptx.encrypting.map
%LOCALAPPDATA%\microsoft\windows mail\edb.log.encrypting.map
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx.encrypting.map
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx.encrypting.map
<Drive name for removable media>:\indogerman2010.pptx.encrypting.map
<Drive name for removable media>:\fungalnameauthors.rtf.encrypting.map
<Drive name for removable media>:\pubnet_855.rtf.encrypting.map
<Drive name for removable media>:\krsweden.rtf.encrypting.map
<Drive name for removable media>:\waterlandhealthkano.rtf.encrypting.map
<Drive name for removable media>:\pandp.rtf.encrypting.map
<Drive name for removable media>:\price030215.xls.encrypting.map
<Drive name for removable media>:\guide_reorganization_mapping.xls.encrypting.map
<Drive name for removable media>:\al.xlsx.encrypting.map
<Drive name for removable media>:\disclosuredetails.xlsx.encrypting.map
<Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4.encrypting.map
<Drive name for removable media>:\51.mp4.encrypting.map
<Drive name for removable media>:\spanner.mov.encrypting.map
<Drive name for removable media>:\2.jpg.encrypting.map
<Drive name for removable media>:\parnas_01.jpg.encrypting.map
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.db.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.db.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.encrypting.map
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.encrypting.map
%LOCALAPPDATA%\microsoft\windows mail\edb00001.log.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\natives_blob.bin.encrypting.map
%HOMEPATH%\desktop\000814251_video_01.avi.encrypting.map
%HOMEPATH%\desktop\glidescope_review_rev_010.docx.encrypting.map
%HOMEPATH%\desktop\join.avi.encrypting.map
%HOMEPATH%\desktop\lisp_success.doc.encrypting.map
%HOMEPATH%\desktop\ovp25012015.doc.encrypting.map
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.encrypting.map
<Drive name for removable media>:\delete.avi.encrypting.map
<Drive name for removable media>:\correct.avi.encrypting.map
<Drive name for removable media>:\february_catalogue__2015.doc.encrypting.map
<Drive name for removable media>:\weeklysheet1215.doc.encrypting.map
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx.encrypting.map
<Drive name for removable media>:\nwfieldnotes1966.docx.encrypting.map
%LOCALAPPDATA%\thunderbird\profiles\rehh7ft5.default-release\startupcache\startupcache.8.little.encrypting.map
%HOMEPATH%\desktop\delete.avi.encrypting.map
<Drive name for removable media>:\waterresourcesag.pptx.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\zu.pak.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\words.pdf.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\icudt26l.dat.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\natives_blob.bin.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_100_percent.pak.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_200_percent.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_250_percent.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.bin.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\af.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\az.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\be.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\bg.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\bn.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ca.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\cs.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\da.pak.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf.encrypting.map
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.encrypting.map
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\de.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\opera_150_percent.pak.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting.map
%ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting.map
%ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting.map
%ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting.map
%ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting.map
%ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting.map
%ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting.map
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting.map
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting.map
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting.map
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting.map
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting.map
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting.map
%ProgramFiles%\microsoft office\office14\engdic.dat.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ja.pak.encrypting.map
%LOCALAPPDATA%\iconcache.db.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-us.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\sr.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\sv.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\sw.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ta.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\te.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\th.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\tr.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\uk.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\uz.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\vi.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-cn.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\el.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-tw.pak.encrypting.map
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.dat.encrypting.map
%ALLUSERSPROFILE%\microsoft\rac\statedata\racwmieventdata.dat.encrypting.map
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu.encrypting.map
C:\users\public\pictures\sample pictures\chrysanthemum.jpg.encrypting.map
C:\users\public\pictures\sample pictures\desert.jpg.encrypting.map
C:\users\public\pictures\sample pictures\hydrangeas.jpg.encrypting.map
C:\users\public\pictures\sample pictures\jellyfish.jpg.encrypting.map
C:\users\public\pictures\sample pictures\koala.jpg.encrypting.map
C:\users\public\pictures\sample pictures\lighthouse.jpg.encrypting.map
C:\users\public\pictures\sample pictures\penguins.jpg.encrypting.map
C:\users\public\pictures\sample pictures\tulips.jpg.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ru.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\sk.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ro.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-pt.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-br.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\es.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\fi.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\fil.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr-ca.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\fy.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\gd.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\hi.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\hr.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\hu.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\id.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-gb.pak.encrypting.map
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\it.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ko.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\lt.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\lv.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\me.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\mk.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\ms.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\nb.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\nl.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\nn.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\pa.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\pl.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\es-419.pak.encrypting.map
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\kk.pak.encrypting.map
<Drive name for removable media>:\price.zip.encrypting.map

Moves the following files

from %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat to %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\kk.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\kk.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\kk.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\a2sucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ko.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ko.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ko.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\a28ucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\lt.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\lt.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\lt.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bhqucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\lv.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\lv.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\lv.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bhyucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\me.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\me.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\me.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bwuucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\it.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\it.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\mk.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\mk.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ms.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ms.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ms.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bxmucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nb.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nb.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nb.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bmiucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nl.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nl.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nl.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bmwucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nn.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nn.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\nn.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bm4ucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pa.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pa.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pa.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\cgeucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ja.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ja.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ja.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ameucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\it.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\axqucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\id.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\awqucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pl.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\cgwucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\es-419.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zx<File name>e5lnbhaw==.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\es.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\es.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\es.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zxmucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fi.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fi.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fi.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zmkucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fil.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fil.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fil.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zmlslnbhaw==.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr-ca.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr-ca.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr-ca.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\znitq0eucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pl.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pl.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-us.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zw4tvvmucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\mk.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bwsucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\gd.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\gd.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\gd.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\z2qucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hi.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hi.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hi.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\agkucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hr.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hr.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hr.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ahiucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hu.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hu.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\hu.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ahuucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\id.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\id.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fr.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zniucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fy.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fy.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\fy.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\znkucgfr.encrypted
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\slncexrlq29kzvdpbi5iaw4=.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-br.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-br.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-cn.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-cn.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-cn.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\emgtq04ucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-tw.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-tw.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zh-tw.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\emgtvfcucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zu.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zu.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zu.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\enuucgfr.encrypted
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.encrypting
from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.encrypting to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\zm9ybwhpc3rvcnkuc3fsaxrl.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.encrypting
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.encrypting to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\ywjvb2suc3fsaxrl.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\vi.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\dmkucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-us.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-us.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\vi.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\vi.pak.encrypting
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.encrypting to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\zmf2awnvbnmuc3fsaxrl.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.encrypting
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.encrypting to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\zm9ybwhpc3rvcnkuc3fsaxrl.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.encrypting
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.encrypting to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\z2xvymfslw1lc3nhz2vzlwrilnnxbgl0zq==.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.encrypting
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.encrypting to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\aglzdg9yes5zcwxpdgu=.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\key4.db.encrypting to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\a2v5nc5kyg==.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.encrypting
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.encrypting to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\b3blbnbncc5zcwxpdgu=.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cert9.db.encrypting to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\y2vyddkuzgi=.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.encrypting to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\ymxpc3quc3fsaxrl.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\es-419.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\es-419.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\uz.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\uz.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sw.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\c3cucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-pt.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\chqtufqucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ro.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ro.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ro.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\cm8ucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ru.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ru.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ru.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\cnuucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sk.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sk.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sk.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\c2sucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sr.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sr.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sr.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\c3iucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sv.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sv.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\uz.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\dxoucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-br.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\chqtqliucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-pt.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\pt-pt.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ta.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ta.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ta.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\dgeucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\te.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\te.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\te.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\dguucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\th.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\th.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\th.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\dggucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\tr.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\tr.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\tr.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\dhiucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\uk.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\uk.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\uk.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\dwsucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sw.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sw.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\sv.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\c3yucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-gb.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zw4tr0iucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-gb.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\en-gb.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\el.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zwwucgfr.encrypted
from %ProgramFiles%\microsoft office\office14\engdic.dat.encrypting to %ProgramFiles%\microsoft office\office14\ru5hreldlkrbva==.encrypted
from %ProgramFiles%\microsoft office\office14\outlfltr.dat to %ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting
from %ProgramFiles%\microsoft office\office14\outlfltr.dat.encrypting to %ProgramFiles%\microsoft office\office14\t1vutezmvfiurefu.encrypted
from %ProgramFiles%\microsoft office\office14\1033\actip10.hlp to %ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting
from %ProgramFiles%\microsoft office\office14\1033\actip10.hlp.encrypting to %ProgramFiles%\microsoft office\office14\1033\qunusvaxmc5itfa=.encrypted
from %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat to %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting
from %ProgramFiles%\microsoft office\office14\1033\psrchkey.dat.encrypting to %ProgramFiles%\microsoft office\office14\1033\ufnsq0hlrvkurefu.encrypted
from %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat to %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting
from %ProgramFiles%\microsoft office\office14\1033\psrchlex.dat.encrypting to %ProgramFiles%\microsoft office\office14\1033\ufnsq0hmrvgurefu.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ndguslbh.encrypted
from %ProgramFiles%\microsoft office\office14\engdic.dat to %ProgramFiles%\microsoft office\office14\engdic.dat.encrypting
from %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat to %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\academic.one.encrypting to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\qunbrevnsumut05f.encrypted
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\blank.one.encrypting to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\qkxbtksut05f.encrypted
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\business.one.encrypting to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\qlvtsu5fu1mut05f.encrypted
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.encrypting to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\revtsudorviut05f.encrypted
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting
from %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.encrypting to %ProgramFiles%\microsoft office\office14\1033\ufnsq0htuk4urefu.encrypted
from %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls to %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting
from %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls.encrypting to %ProgramFiles%\microsoft office\office14\samples\u09mvlnbtvauwext.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.encrypting
from %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\planners.one.encrypting to %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\uexbtk5fulmut05f.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njguslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mjuuslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mjcuslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzauslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzeuslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5mzkuslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodq4njiuslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntcuslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5ntguslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njauslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njiuslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\sjazodi5njuuslbh.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382968.jpg.encrypting
from %ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting to %ProgramFiles%\java\jre1.8.0_45\lib\dhpkyi5kyxq=.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.encrypting
from %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf to %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\uergu2lnuuzvcm1hbfjlcc5wzgy=.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_250_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_250_percent.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_250_percent.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\b3blcmffmjuwx3blcmnlbnqucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.bin to %ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.bin.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\snapshot_blob.bin.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\c25hchnob3rfymxvyi5iaw4=.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\af.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\af.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\af.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ywyucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\az.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\az.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\az.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\yxoucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\be.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\be.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\be.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ymuucgfr.encrypted
from %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.encrypting to %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\u3luy2hyb25pemf0aw9urxvsys5ydgy=.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_200_percent.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\b3blcmffmjawx3blcmnlbnqucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_200_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_200_percent.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bn.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ym4ucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ca.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ca.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ca.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\y2eucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\cs.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\cs.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\cs.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\y3mucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\da.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\da.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\da.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zgeucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\de.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\de.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\de.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\zguucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\el.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\el.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bg.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bg.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bn.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bn.pak.encrypting
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\mtq5ndg3memtotkxmi1dmtg0ltrdqzktqjqwms1bntngneq4reuyotaucgrm.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\localization\bg.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\localization\ymcucgfr.encrypted
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph01046j.jpg.encrypting to %ProgramFiles%\microsoft office\clipart\pub60cor\uegwmta0nkouslbh.encrypted
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef.pak.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\y2vmlnbhaw==.encrypted
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_100_percent.pak.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\y2vmxzewmf9wzxjjzw50lnbhaw==.encrypted
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\cef_200_percent.pak.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\y2vmxziwmf9wzxjjzw50lnbhaw==.encrypted
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\natives_blob.bin.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\bmf0axzlc19ibg9ilmjpbg==.encrypted
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\snapshot_blob.bin.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\c25hchnob3rfymxvyi5iaw4=.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\b3blcmffmti1x3blcmnlbnqucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_150_percent.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\b3blcmffmtuwx3blcmnlbnqucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_150_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_150_percent.pak.encrypting
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\u3rhbmrhcmrcdxnpbmvzcy5wzgy=.encrypted
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\zwrpdf9wzgzfcg9zdgvymnguanbn.encrypted
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\icudt26l.dat.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\icu\awn1zhqynmwuzgf0.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\natives_blob.bin to %ProgramFiles(x86)%\opera\29.0.1795.47\natives_blob.bin.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\natives_blob.bin.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\bmf0axzlc19ibg9ilmjpbg==.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\b3blcmeucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_100_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_100_percent.pak.encrypting
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_100_percent.pak.encrypting to %ProgramFiles(x86)%\opera\29.0.1795.47\b3blcmffmtawx3blcmnlbnqucgfr.encrypted
from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_125_percent.pak.encrypting
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.encrypting
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\words.pdf.encrypting to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\v29yzhmucgrm.encrypted
from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.encrypting to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cgxhy2vzlnnxbgl0zq==.encrypted

Modifies the following files

%ProgramFiles%\java\jre1.8.0_45\lib\tzdb.dat.encrypting
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg.encrypting
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382959.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg.encrypting
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382957.jpg.encrypting
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382955.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382954.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382952.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382950.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg.encrypting
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382947.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382944.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382942.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg.encrypting
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382938.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg.encrypting
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382930.jpg.encrypting
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg.encrypting
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382926.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg.encrypting
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382836.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0227558.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0177806.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0149118.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0148757.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0145212.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099191.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0099166.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382961.jpg
%ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg.encrypting

Modifies multiple files.

Deletes itself.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C "<Current directory>\SelfDelete.bat"
'%WINDIR%\syswow64\timeout.exe' /T 5 /NOBREAK
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "<Current directory>\"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "<Current directory>\SelfDelete.bat"' (with hidden window)

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial