Trojan.Encoder.38469

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Classes\shitfile\shell\open\command] '' = '"C:\svchost.exe" "%1"'

Creates the following files on removable media

<Drive name for removable media>:\svchost.exe
<Drive name for removable media>:\your file has been encrypted!.txt
<Drive name for removable media>:\readme.txt

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

<Current directory>\your file has been encrypted!.txt
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextservicearray.txt.shit
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextservicedayi.txt.shit
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextservicesimplifiedquanpin.txt.shit
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextservicesimplifiedshuangpin.txt.shit
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextservicesimplifiedzhengma.txt.shit
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextserviceyi.txt.shit
%TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.shit
%ProgramFiles(x86)%\windows nt\tabletextservice\tabletextserviceamharic.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_vietnamese.txt.shit
C:\users\public\music\sample music\kalimba.mp3.shit
C:\users\public\music\sample music\maid with the flaxen hair.mp3.shit
C:\users\public\music\sample music\sleep away.mp3.shit
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.bak.shit
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.shit
%TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.shit
%ProgramFiles(x86)%\windows sidebar\gadgets\rssfeeds.gadget\images\16-on-black.gif.shit
%ProgramFiles(x86)%\windows sidebar\gadgets\weather.gadget\images\1px.gif.shit
%WINDIR%\microsoft.net\framework\v3.0\windows workflow foundation\sql\en\tracking_schema.sql.shit
%ProgramFiles(x86)%\windows sidebar\gadgets\rssfeeds.gadget\images\rsslogo.gif.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_polish.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_hungarian.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_italian.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_japanese.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_korean.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_koreana.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_latam.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_thai.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_ukrainian.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_turkish.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_romanian.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_russian.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_schinese.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_spanish.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_swedish.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_tchinese.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_norwegian.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_portuguese.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_greek.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_german.txt.shit
%TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\installroles.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\installsqlstate.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\installsqlstatetemplate.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\installwebeventsqlprovider.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallcommon.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallmembership.sql.shit
%TEMP%\dd_vcredistmsi12db.txt.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\installpersonalization.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\installpersistsqlstate.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallsqlstate.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallsqlstatetemplate.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallwebeventsqlprovider.sql.shit
%WINDIR%\microsoft.net\framework\v3.0\windows workflow foundation\sql\en\sqlpersistenceservice_logic.sql.shit
%WINDIR%\microsoft.net\framework\v3.0\windows workflow foundation\sql\en\sqlpersistenceservice_schema.sql.shit
%WINDIR%\microsoft.net\framework\v3.0\windows workflow foundation\sql\en\tracking_logic.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallpersistsqlstate.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallroles.sql.shit
%TEMP%\dd_vcredistui12db.txt.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallpersonalization.sql.shit
%TEMP%\dd_setuputility.txt.shit
%TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.shit
%TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.shit
%TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.shit
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.shit
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.shit
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.shit
%WINDIR%\ehome\en-us\playready_eula_oem.txt.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\installmembership.sql.shit
%WINDIR%\microsoft.net\framework\v2.0.50727\installcommon.sql.shit
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.shit
%WINDIR%\ocsetup_cbs_uninstall_searchengine-client-package.txt.shit
%WINDIR%\ehome\createdisc\styles\ntsc\symphony\symphony\symphony.psd.shit
%WINDIR%\ehome\createdisc\styles\pal\symphony\symphony\symphony.psd.shit
%WINDIR%\ehome\en-us\epgtos.txt.shit
%WINDIR%\ehome\en-us\playready_eula.txt.shit
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.shit
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_same_reviewers.gif.shit
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_gb_euro.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\ind_prog.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress-indeterminate.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner2x.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner_dark.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\progress_spinner_dark2x.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\icons_ie8.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\adobe_spinner_mini.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\adobe_spinner.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-left.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-right-pressed.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-right.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-up-pressed.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-up.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\icons_ie8.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-down-pressed.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-left-pressed.gif.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_english.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\arrow-down.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tr.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\rss.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_issue.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_lg.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\server_ok.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\stop_collection_data.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\submission_history.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner_2x.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner_int_2x.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner_int.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationinacrobat.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnoffnotificationintray.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationinacrobat.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\turnonnotificationintray.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\warning.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\a12_spinner.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\tl.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\trash.gif.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_french.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_finnish.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\close.svg.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\wordnet_license.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\readme_en_us.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\added.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_ca\excluded.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\added.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_gb\excluded.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\icons_ie8.gif.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme_en_gb.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\license.txt.shit
%ProgramFiles(x86)%\steam\logs\bootstrap_log.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_brazilian.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_bulgarian.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_czech.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_danish.txt.shit
%ProgramFiles(x86)%\steam\public\steambootstrapper_dutch.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\added.txt.shit
%ProgramFiles(x86)%\opera\29.0.1795.47\resources\license.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\a12-pdf.svg.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\excluded.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\icons_ie8.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\help.svg.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\images\progress.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\symbol.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\zdingbat.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_ca.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_th_en_ca_v2.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\changelog.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\affdescription.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_us_posix.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\adobe\products.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_ca\list.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_gb\list.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_us\list.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_en_ca.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_gb.txt.shit
%CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_us.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_shared.gif.shit
%WINDIR%\microsoft.net\framework\v3.5\sql\en\dropsqlpersistenceproviderlogic.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\installcommon.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallwebeventsqlprovider.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\alert_lrg.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\deselectedtab_1x1.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\folder.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\selectedtab_rightcorner.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallsqlstatetemplate.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallsqlstate.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\helpicon_solid.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\image1.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\image2.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\selectedtab_1x1.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\headergradient_tall.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\gradient_onwhite.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\installpersistsqlstate.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\yellowcorner.gif.shit
%WINDIR%\microsoft.net\framework64\v3.5\sql\en\dropsqlpersistenceproviderlogic.sql.shit
%WINDIR%\microsoft.net\framework64\v3.5\sql\en\dropsqlpersistenceproviderschema.sql.shit
%WINDIR%\microsoft.net\framework64\v3.5\sql\en\sqlpersistenceproviderlogic.sql.shit
%WINDIR%\microsoft.net\framework64\v3.5\sql\en\sqlpersistenceproviderschema.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\installcommon.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallpersistsqlstate.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallroles.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallpersonalization.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\installroles.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\installsqlstate.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\installsqlstatetemplate.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\installwebeventsqlprovider.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallcommon.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallmembership.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\installmembership.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\installpersonalization.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\dropsqlpersistenceproviderschema.sql.shit
%WINDIR%\syswow64\migwiz\postmigres\web\base_images\appinstalled.gif.shit
%WINDIR%\syswow64\migwiz\postmigres\web\base_images\clickdownexpanded.gif.shit
%WINDIR%\syswow64\migwiz\postmigres\web\base_images\clickdownnormal.gif.shit
%WINDIR%\syswow64\migwiz\postmigres\web\base_images\documents.gif.shit
%WINDIR%\syswow64\migwiz\postmigres\web\base_images\failure.gif.shit
%WINDIR%\syswow64\migwiz\postmigres\web\base_images\programs.gif.shit
%WINDIR%\syswow64\drivers\gmreadme.txt.shit
%WINDIR%\syswow64\en-us\erofflps.txt.shit
%WINDIR%\syswow64\migwiz\postmigres\web\base_images\system.gif.shit
%WINDIR%\syswow64\printing_admin_scripts\en-us\prncnfg.vbs.shit
%WINDIR%\syswow64\printing_admin_scripts\en-us\prndrvr.vbs.shit
%WINDIR%\syswow64\printing_admin_scripts\en-us\prnjobs.vbs.shit
%WINDIR%\syswow64\printing_admin_scripts\en-us\prnmngr.vbs.shit
%WINDIR%\syswow64\printing_admin_scripts\en-us\prnport.vbs.shit
%WINDIR%\syswow64\printing_admin_scripts\en-us\prnqctl.vbs.shit
%WINDIR%\syswow64\migwiz\postmigres\web\base_images\users.gif.shit
%WINDIR%\syswow64\msdtc\trace\msdtcvtr.bat.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\yellowcorner.gif.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif.shit
%WINDIR%\syswow64\winrm.cmd.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\dropsqlworkflowinstancestoreschema.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlpersistenceproviderlogic.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlpersistenceproviderschema.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlpersistenceservice_logic.sql.shit
%WINDIR%\syswow64\winrm.vbs.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql.shit
<SYSTEM32>\catroot2\dberr.txt.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlpersistenceservice_schema.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\tracking_schema.sql.shit
%WINDIR%\performance\winsat\clip_1080_5sec_mpeg2_hd_15mbps.mpg.shit
%WINDIR%\performance\winsat\clip_480i_5sec_6mbps_new.mpg.shit
%WINDIR%\performance\winsat\clip_480p_5sec_6mbps_new.mpg.shit
%WINDIR%\syswow64\slmgr.vbs.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlworkflowinstancestorelogic.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlworkflowinstancestoreschema.sql.shit
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\tracking_logic.sql.shit
%WINDIR%\microsoft.net\framework\v3.5\sql\en\sqlpersistenceproviderlogic.sql.shit
%WINDIR%\microsoft.net\framework\v3.5\sql\en\dropsqlpersistenceproviderschema.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\selectedtab_1x1.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onwhite.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\headergradient_tall.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\helpicon_solid.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image1.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\folder.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image2.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_rightcorner.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\yellowcorner.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_1x1.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\deselectedtab_1x1.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderschema.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\selectedtab_leftcorner.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\installmembership.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\installpersistsqlstate.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\installpersonalization.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\installroles.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstate.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\alert_lrg.gif.shit
%WINDIR%\microsoft.net\framework\v3.5\sql\en\sqlpersistenceproviderschema.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallwebeventsqlprovider.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstatetemplate.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersistsqlstate.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersonalization.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallroles.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstate.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstatetemplate.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\installwebeventsqlprovider.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallcommon.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallmembership.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\selectedtab_rightcorner.gif.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_logic.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallwebeventsqlprovider.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\alert_lrg.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\alert_sml.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\aspx_file.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\branding_full2.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallroles.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallpersonalization.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallsqlstatetemplate.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\deselectedtab_1x1.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\headergradient_tall.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\helpicon_solid.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\image1.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\image2.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\requiredbang.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\folder.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\gradient_onblue.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\gradient_onwhite.gif.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallsqlstate.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestoreschema.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderlogic.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_schema.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestorelogic.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschema.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_logic.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_schema.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallpersistsqlstate.sql.shit
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderschema.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallmembership.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\installcommon.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\installroles.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\installsqlstate.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\installsqlstatetemplate.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\installwebeventsqlprovider.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallcommon.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\installmembership.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\installpersistsqlstate.sql.shit
%WINDIR%\microsoft.net\framework64\v2.0.50727\installpersonalization.sql.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_email.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\review_browser.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_super.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\javaws.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\jce.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\jfxswt.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.shit
%ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.shit
%ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.shit
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\dnsns.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\management-agent.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\resources.jar.shit
%ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_widescreen_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_highlights_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_performance_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_photo_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_plain_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_postage_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_scrapbook_thumbnail.bmp.shit
%ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_babypink_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_glass_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\scene_button_style_default_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\shadowonlyframe_buttongraphic.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\shadowonlyframe_selectionsubpicture.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\shadowonlyframe_videoinset.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\whitedot.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\babyblue.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_travel_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangle_specialocc_thumbnail.bmp.shit
%ProgramFiles%\microsoft office\office14\groove\sounds\people\whistling.wav.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\postage_videoinset.png.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_slateblue.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_texturedblue.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_velvetrose.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\rtf_choosefont.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\rtf_italic.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\rtf_spellcheck.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\rtf_underline.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_premium.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\sunec.jar.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_olivegreen.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\generic.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\main.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\person.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\response.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\background.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\background.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\background.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\background.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_groove.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\sunpkcs11.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\zipfs.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_lightspirit.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\sunjce_provider.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\security\local_policy.jar.shit
%ProgramFiles%\java\jre1.8.0_45\lib\security\us_export_policy.jar.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_casual.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_country.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_earthy.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_greentea.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif.shit
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif.shit
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\document.gif.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\postage_buttongraphic.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\navigationright_buttongraphic.png.shit
%CommonProgramFiles%\microsoft shared\stationery\garden.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\greenbubbles.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\handprints.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\monet.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\notebook.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\orangecircles.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\cave_drawings.gif.shit
%CommonProgramFiles%\microsoft shared\stationery\stars.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\blue_gradient.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\psychedelic.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\roses.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\sand_paper.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\shadesofblue.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\small_news.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\softblue.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\pine_lumber.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\peacock.jpg.shit
%CommonProgramFiles%\microsoft shared\stationery\pretty_peacock.jpg.shit
%CommonProgramFiles%\microsoft shared\ink\en-us\split.avi.shit
%CommonProgramFiles%\microsoft shared\ink\en-us\boxed-correct.avi.shit
C:\svchost.exe
C:\your file has been encrypted!.txt
C:\readme.txt
C:\kms\kms_vl_all_aio.cmd.shit
D:\svchost.exe
D:\your file has been encrypted!.txt
%CommonProgramFiles%\microsoft shared\stationery\bears.jpg.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\postage_selectionsubpicture.png.shit
<Current directory>\readme.txt
%CommonProgramFiles%\microsoft shared\ink\en-us\boxed-delete.avi.shit
%CommonProgramFiles%\microsoft shared\ink\en-us\boxed-join.avi.shit
%CommonProgramFiles%\microsoft shared\ink\en-us\boxed-split.avi.shit
%CommonProgramFiles%\microsoft shared\ink\en-us\correct.avi.shit
%CommonProgramFiles%\microsoft shared\ink\en-us\delete.avi.shit
%CommonProgramFiles%\microsoft shared\ink\en-us\join.avi.shit
%CommonProgramFiles%\microsoft shared\ink\flickanimation.avi.shit
D:\readme.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\attention.gif.shit
%CommonProgramFiles%\microsoft shared\stationery\connectivity.gif.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\cloud_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\dot.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\heart_buttongraphic.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\heart_glass_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\heart_selectionsubpicture.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\heart_videoinset.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\menu_style_default_thumbnail.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\circle_videoinset.png.shit
%CommonProgramFiles%\microsoft shared\stationery\tanspecks.jpg.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\circle_selectionsubpictureb.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\navigationright_selectionsubpicture.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\navigationup_buttongraphic.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\navigationup_selectionsubpicture.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\photoedge_buttongraphic.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\photoedge_selectionsubpicture.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\photoedge_videoinset.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\navigationleft_selectionsubpicture.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\navigationleft_buttongraphic.png.shit
%CommonProgramFiles%\microsoft shared\stationery\stucco.gif.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\circle_glass_thumbnail.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\4to3squareframe_selectionsubpicture.png.shit
%CommonProgramFiles%\microsoft shared\stationery\wrinkled_paper.gif.shit
%CommonProgramFiles%\services\verisign.bmp.shit
%ProgramFiles%\dvd maker\shared\dissolveanother.png.shit
%ProgramFiles%\dvd maker\shared\dissolvenoise.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\16to9squareframe_buttongraphic.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\16to9squareframe_selectionsubpicture.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\circle_selectionsubpicturea.png.shit
%CommonProgramFiles%\microsoft shared\stationery\tiki.gif.shit
%CommonProgramFiles%\microsoft shared\stationery\white_chocolate.jpg.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\4to3squareframe_videoinset.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\blackrectangle.bmp.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\circleround_glass.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\circleround_selectionsubpicture.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\circleround_videoinset.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\circle_buttongraphic.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\4to3squareframe_buttongraphic.png.shit
%ProgramFiles%\dvd maker\shared\dvdstyles\16to9squareframe_videoinset.png.shit
%ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_casual.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_italic.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_pressed.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_spellcheck.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_underline.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\background.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\background.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_increaseindent.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_hyperlink.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_justify.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\background.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_alignleft.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_alignright.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_bullets.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_center.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_choosecolor.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\background.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\attention.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\macroprogress.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_groove.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_decreaseindent.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_olivegreen.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_texturedblue.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_velvetrose.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\button_left.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\button_left_over.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\button_mid.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_decreaseindent.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_premium.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_choosefont.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\button_mid_over.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_alignleft.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_alignright.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_bullets.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_center.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_choosecolor.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\button_right.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\button_right_over.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\macroprogress.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_slateblue.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_hyperlink.gif.shit
%ProgramFiles%\windows nt\tabletextservice\tabletextserviceamharic.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_all.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\email_initiator.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\ended_review_or_form.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\end_review.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_distributed.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\br.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\bl.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\distribute_form.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_received.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\open_original_form.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\pdf.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviewers.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_joined.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\reviews_sent.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\forms_super.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\form_responses.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\info.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\create_form.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_increaseindent.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_justify.gif.shit
%ProgramFiles%\windows nt\tabletextservice\tabletextservicearray.txt.shit
%ProgramFiles%\windows nt\tabletextservice\tabletextservicedayi.txt.shit
%ProgramFiles%\windows nt\tabletextservice\tabletextservicesimplifiedquanpin.txt.shit
%ProgramFiles%\windows nt\tabletextservice\tabletextservicesimplifiedshuangpin.txt.shit
%ProgramFiles%\windows nt\tabletextservice\tabletextservicesimplifiedzhengma.txt.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\add_reviewer.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_pressed.gif.shit
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.shit
%ProgramFiles%\windows nt\tabletextservice\tabletextserviceyi.txt.shit
%ProgramFiles%\windows sidebar\gadgets\weather.gadget\images\1px.gif.shit
%ProgramFiles%\winrar\license.txt.shit
%ProgramFiles%\winrar\rar.txt.shit
%ProgramFiles%\winrar\readme.txt.shit
%ProgramFiles%\winrar\whatsnew.txt.shit
%ProgramFiles%\windows sidebar\gadgets\mediacenter.gadget\images\gadget_waitcursor.gif.shit
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\images\16-on-black.gif.shit
%ProgramFiles%\windows sidebar\gadgets\rssfeeds.gadget\images\rsslogo.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_lightspirit.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_greentea.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_country.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\attention.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_casual.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_country.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_earthy.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_formshomepage.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_formshomepageblank.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_right_over.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\button_left.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_right_disable.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_lightspirit.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_olivegreen.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_premium.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_slateblue.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_texturedblue.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_velvetrose.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_greentea.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_formshomepageslice.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_groove.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_mid_over.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_texturedblue.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_formshomepage.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_formshomepageblank.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_greentea.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_groove.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_lightspirit.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_olivegreen.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_right.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\button_left_over.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_earthy.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_velvetrose.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_left.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_left_disable.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_left_over.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_mid.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\button_mid_disable.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_slateblue.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_premium.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\menu_arrow.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\button_mid.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\tab_on.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\header.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\tab_off.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\tab_on.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\background.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\header.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\tab_off.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\tab_on.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\background.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\tab_off.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_country.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_earthy.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_formshomepage.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_formshomepageblank.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_formshomepageslice.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\tab_on.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\attention.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_casual.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\background.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\tab_off.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\button_mid_over.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\button_right_over.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\macroprogress.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_alignleft.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_alignright.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_bullets.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_center.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_choosecolor.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\button_right.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_choosefont.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_increaseindent.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_italic.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_justify.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_pressed.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_underline.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\background.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\button.gif.shit
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\rtf_decreaseindent.gif.shit
%WINDIR%\syswow64\printing_admin_scripts\en-us\pubprn.vbs.shit
%WINDIR%\syswow64\windowspowershell\v1.0\examples\profile.ps1.shit

Deletes the following files

%WINDIR%\ocsetup_cbs_uninstall_searchengine-client-package.txt
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\help.jpg
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\helpicon_solid.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\image1.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\image2.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\selectedtab_1x1.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\selectedtab_rightcorner.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\topgradrepeat.jpg
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\yellowcorner.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\header.bmp
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\splashscreen.bmp
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\watermark.bmp
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1025\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1028\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1029\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1030\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1031\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1032\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1033\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1035\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1036\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\headergradient_tall.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1037\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\gradient_onwhite.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\folder.gif
%WINDIR%\microsoft.net\framework64\v3.5\sql\en\dropsqlpersistenceproviderschema.sql
%WINDIR%\microsoft.net\framework64\v3.5\sql\en\sqlpersistenceproviderlogic.sql
%WINDIR%\microsoft.net\framework64\v3.5\sql\en\sqlpersistenceproviderschema.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\installcommon.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\installmembership.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\installpersistsqlstate.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\installpersonalization.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\installroles.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\installsqlstate.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\installsqlstatetemplate.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\installwebeventsqlprovider.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallcommon.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallmembership.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallpersistsqlstate.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallpersonalization.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallroles.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallsqlstate.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallsqlstatetemplate.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\uninstallwebeventsqlprovider.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\alert_lrg.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\aspdotnet_logo.jpg
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\darkblue_grad.jpg
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\deselectedtab_1x1.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1040\eula.rtf
<SYSTEM32>\catroot2\dberr.txt
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1041\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1043\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1044\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1045\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1046\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1049\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1053\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1055\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\2052\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\2070\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\3076\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\3082\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\dropsqlpersistenceproviderschema.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\dropsqlworkflowinstancestoreschema.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlpersistenceproviderlogic.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlpersistenceproviderschema.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlpersistenceservice_logic.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlpersistenceservice_schema.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlworkflowinstancestorelogic.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\sqlworkflowinstancestoreschema.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\tracking_logic.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\sql\en\tracking_schema.sql
%WINDIR%\softwaredistribution\datastore\datastore.edb
%WINDIR%\syswow64\license.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1042\eula.rtf
%WINDIR%\microsoft.net\framework64\v3.5\sql\en\dropsqlpersistenceproviderlogic.sql
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1041\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1038\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1042\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1043\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1044\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1045\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1046\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1049\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1053\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1055\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\2052\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\2070\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\3076\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\3082\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\header.bmp
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\splashscreen.bmp
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\watermark.bmp
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1025\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1028\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1029\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1030\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1031\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1032\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1033\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1035\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1036\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\extended\1037\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1038\eula.rtf
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\client\1040\eula.rtf
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\yellowcorner.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_1x1.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstate.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\installsqlstatetemplate.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\installwebeventsqlprovider.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallcommon.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallmembership.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersistsqlstate.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallpersonalization.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallroles.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstate.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallsqlstatetemplate.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\uninstallwebeventsqlprovider.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\alert_lrg.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspdotnet_logo.jpg
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\aspx_file.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\darkblue_grad.jpg
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\deselectedtab_1x1.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\folder.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onblue.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\gradient_onwhite.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\headergradient_tall.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\help.jpg
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\helpicon_solid.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image1.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\image2.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\installroles.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\installpersonalization.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\installmembership.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\installcommon.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\installmembership.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\installpersistsqlstate.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\installpersonalization.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\installroles.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\installsqlstate.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\installsqlstatetemplate.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\installwebeventsqlprovider.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallcommon.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallmembership.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallpersistsqlstate.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallpersonalization.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallroles.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallsqlstate.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallsqlstatetemplate.sql
%WINDIR%\microsoft.net\framework\v2.0.50727\uninstallwebeventsqlprovider.sql
%WINDIR%\microsoft.net\framework\v3.0\windows workflow foundation\sql\en\sqlpersistenceservice_logic.sql
%WINDIR%\microsoft.net\framework\v3.0\windows workflow foundation\sql\en\sqlpersistenceservice_schema.sql
%WINDIR%\microsoft.net\framework\v3.0\windows workflow foundation\sql\en\tracking_logic.sql
%WINDIR%\microsoft.net\framework\v3.0\windows workflow foundation\sql\en\tracking_schema.sql
%WINDIR%\microsoft.net\framework\v3.5\sql\en\dropsqlpersistenceproviderlogic.sql
%WINDIR%\microsoft.net\framework\v3.5\sql\en\dropsqlpersistenceproviderschema.sql
%WINDIR%\microsoft.net\framework\v3.5\sql\en\sqlpersistenceproviderlogic.sql
%WINDIR%\microsoft.net\framework\v3.5\sql\en\sqlpersistenceproviderschema.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\installcommon.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\installpersistsqlstate.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallmembership.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_leftcorner.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallroles.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallsqlstate.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallsqlstatetemplate.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallwebeventsqlprovider.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\alert_lrg.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\alert_sml.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\aspdotnet_logo.jpg
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\aspx_file.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\branding_full2.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\darkblue_grad.jpg
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\deselectedtab_1x1.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\folder.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\gradient_onblue.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\gradient_onwhite.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\headergradient_tall.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\help.jpg
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\helpicon_solid.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\image1.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\image2.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\requiredbang.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\security_watermark.jpg
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\selectedtab_1x1.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\selectedtab_leftcorner.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\selectedtab_rightcorner.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\topgradrepeat.jpg
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallpersonalization.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallpersistsqlstate.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\uninstallcommon.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\selectedtab_rightcorner.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\topgradrepeat.jpg
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_leftcorner.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\unselectedtab_rightcorner.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\yellowcorner.gif
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlpersistenceproviderschema.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestorelogic.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\dropsqlworkflowinstancestoreschema.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderlogic.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceproviderschema.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_logic.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlpersistenceservice_schema.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestorelogic.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\sqlworkflowinstancestoreschema.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_logic.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\sql\en\tracking_schema.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\installcommon.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\installmembership.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\installpersistsqlstate.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\installpersonalization.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\installroles.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\installsqlstate.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\installsqlstatetemplate.sql
%WINDIR%\microsoft.net\framework64\v2.0.50727\installwebeventsqlprovider.sql
%WINDIR%\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\security_watermark.jpg
%WINDIR%\syswow64\windowspowershell\v1.0\examples\profile.ps1

Moves the following files

from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.shit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.shit

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'C:\svchost.exe' a
'D:\svchost.exe' a
'<Drive name for removable media>:\svchost.exe' a
'C:\svchost.exe' a' (with hidden window)
'D:\svchost.exe' a' (with hidden window)
'<Drive name for removable media>:\svchost.exe' a' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial