Trojan.Encoder.34206

Technical Information

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.mspphqghumeayln
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 06.wmacswtwkkxlcbhu
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 07.wmaqkvcswjebkrjq
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 08.wmalpgfgratzbsgv
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 09.wmauvzifnhyxwjs&
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 10.wmajavwauxpannaГЁ
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\speech recognition.lnkzwudwdfzlktbg
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\calculator.lnkqdxgyyiudsjvx
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\desktop.iniezkmesbjlkyer
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\displayswitch.lnkrtahnexhuqmjx
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\math input panel.lnkicbmusqdklasr
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 03.wmacgmmvedewdmf
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 05.wmaqecihluilgmfu
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\networkprojection.lnkzfwyucpabqsex
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\snipping tool.lnkitllplxelrdkx
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sound recorder.lnkexdtquvptteyc
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sticky notes.lnkhtlqlbbbvoqoГЁ
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\system restore.lnkdoyjwpyatmleГЁ
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\task scheduler.lnkyqsvkpamsvbmГї
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\tabtip.lnklirizxoqptqqГЁ
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\desktop.ininxmsyamptlzaГЁ
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise.lnkhdkcrfvbeiyis
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell.lnkpvfvpzhyujabf
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\wordpad.lnktqwwtbkdogket
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\paint.lnkffunqpkfnnber
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\remote desktop connection.lnkcbbcjpdyjlibt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\component services.lnkzletbqexkrqos
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\acrobat reader dc.lnkmhibyxrnxsxro
%ALLUSERSPROFILE%\microsoft\windows\ringtones\desktop.inizubuacclfkcy
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.000dnilqadojskkj
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.001vfxahhjmboclg
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.002jarintdwcldv
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000dxropbyjzwyy
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.001ojuothwmlvrg
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.002lfzdzdbtubxu
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\windows.edboffvncrswsaz
%ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmpzuvldvybsuxk
%ALLUSERSPROFILE%\microsoft\user account pictures\user.bmpbmfzvrtnovid
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 01.wmazobghtuoxraj
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.002jtlntxmrjxxwo
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 02.wmavprecwgxxpsw
%ALLUSERSPROFILE%\microsoft\windows\caches\cversions.2.dbnsnqivmvubcw
%ALLUSERSPROFILE%\microsoft\windows\caches\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.dbxtwwtaidyaxy
%ALLUSERSPROFILE%\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.dbqleprxibexxy
%ALLUSERSPROFILE%\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.dbfvsddygthcuy
%ALLUSERSPROFILE%\microsoft\windows\caches\{84c252b6-5dca-4ae7-94d3-461f67359cd9}.2.ver0x0000000000000001.dbyfwpjsfybglg
%ALLUSERSPROFILE%\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.dbzmbintattnho
%ALLUSERSPROFILE%\microsoft\windows\drm\blackbox.binwzabsdnvqhkfГё
%ALLUSERSPROFILE%\microsoft\windows\drm\drmstore.hdscmofisfrfqgv\
%ALLUSERSPROFILE%\microsoft\windows\drm\v3ks.blapmvorpjfzslz
%ALLUSERSPROFILE%\microsoft\windows\drm\v3ks.secmpjjnehrykxj
%ALLUSERSPROFILE%\microsoft\windows\caches\{1573b5e2-35f5-4eaf-bec0-4e35d1d995f6}.2.ver0x0000000000000002.dbtfsrqtmknepb
%ALLUSERSPROFILE%\microsoft\windows\caches\{1e8814b6-8f2d-4b97-87f6-9370f7eb40b7}.2.ver0x0000000000000001.dbhowejazhkwcm
%ALLUSERSPROFILE%\microsoft\windows\caches\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.dbmtpixxxlzqys
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.rest.trx_dllnayxqkqoyzwmx
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\computer management.lnkiernaplqyjpqw
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 upload center.lnkaalkicsnxuco-
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft onenote 2010.lnkxwxqmndhldtt[
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft outlook 2010.lnkxsknxteznjsqv
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft powerpoint 2010.lnktfbccfqmwhbv[
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft publisher 2010.lnkssiigvijsuxi9
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft sharepoint workspace 2010.lnkicaahmkwywttq
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft word 2010.lnkjzppkwlbmjahg
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\mirc help.lnkegyrhlthxwgjr
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\mirc.lnkprwvhshzyavqk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\readme.txt.lnkyecztozoabnak
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 language preferences.lnkivahqatmsckm{
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla firefox.lnkeuiozioiuozxВ§
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office picture manager.lnkvtykrxawzadj{
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pidgin.lnkispqnzomcwvaГ§
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\uninstall qip 2012.lnkaihfshccxhuu-
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar help.lnkjbfrjpcgdjdre
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar.lnkwdnposrjgdrq{
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\xps viewer.lnkrvqtvppazhlt)
%ALLUSERSPROFILE%\microsoft\windows\start menu\windows update.lnkjqvcclpeztsjk
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\report.werpynzfrotqpoxq
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\report.wermwhhwewnvcbvz
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\report.werdkuzififrtwqq
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txtqeojueqbnskwr
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla thunderbird.lnkqtihwauroqrdГЎ
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft clip organizer.lnkrnuwkmsyqcpux
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\qip 2012.lnkwwqqtmiuuyvgq
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\digital certificate for vba projects.lnkzghutifklgkl\
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft infopath filler 2010.lnktnqwtoetonxwe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\desktop.iniksvloidzfpirw
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\iscsi initiator.lnkotakudkpedupr
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\memory diagnostics tool.lnkkczlhwuskdne
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 configuration.lnkvdcplbklpjmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 wizards.lnkfdcyqtrcvvvt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\performance monitor.lnkrffvpekkqmcu
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\print management.lnkpryjauteuvcz
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\security configuration management.lnkvicthrxsxclp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\services.lnkrgdlwxfaigay
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\system configuration.lnkrueicufdiamh
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\task scheduler.lnktkbxotdirxxg
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\windows firewall with advanced security.lnkvzqmeyrovfic
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\event viewer.lnkwycztwzzvewx
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\windows powershell modules.lnkhqnivfjzauqf
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\check for updates.lnksjvwzxssqxnje
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\configure java.lnkomuyjnjuwrsyc
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\x264 vfw (x86).lnkyayzkhuhjrjsГ§
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\help\frequently asked questions.lnkxsbziyrvgqmlq
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\uninstall k-lite codec pack.lnkuckbsepjeisz-
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\documentation.lnkfnwywmxxgdpy`
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\tools.lnkbhcwhlsyoyhg9
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft access 2010.lnkmgopprzaxqmo~
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft excel 2010.lnkmsyhgagiupjq@
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft infopath designer 2010.lnkbzxthtopotmi9
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.001sqfqwehtxdzut
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\desktop.inidftgmopsrgpuВЁ
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\settings.diatlggkytbiolym
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.000bvqopqfoviusf
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.002nwafxwhgbibas
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.001eskmkhssmvno\
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\dexplore.ctmxvfbcgkcfqckГ«
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\dexplore.ctmcotzgkubmjrmГѕ
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\dexplore.ctmbsztsshfroef›
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\dexplore.ctmwsjrxjhguzyuГѕ
%ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\dexplore.ctmiqflduuveoowx
%ALLUSERSPROFILE%\microsoft\network\downloader\qmgr0.datqcudhnefnjhaГі
%ALLUSERSPROFILE%\microsoft\network\downloader\qmgr1.datimuczfskuidux
%ALLUSERSPROFILE%\microsoft\office\assetlibrary.icoburiswtbrecuГј
%ALLUSERSPROFILE%\microsoft\office\documentrepository.icoykabfcvkdzezВЃ
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\dexplore.ctmwkbarxbgfcbcГѕ
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\dexplore.ctmwkbjzwucwljfГѕ
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\dexplore.ctmtrehbbcpxifb€
%ALLUSERSPROFILE%\microsoft\office\mysharepoints.icotoidukuhjzefx
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\envelopr.dll.trx_dllamceroswitdp—
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\grintl32.dll.trx_dlltpcclifkeljyГ«
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\grintl32.rest.trx_dlltihrcqaybnefl
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\mapir.dll.trx_dllxnxvgzedyyhnГѕ
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\mor6int.rest.trx_dllgycdrudmphmef
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\msointl.dll.trx_dllckotrwospofgГѕ
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\msointl.rest.trx_dllhfozqvlqfxwwz
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\omsintl.dll.trx_dllkmfxdyygmdcax
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\onintl.dll.trx_dllszsgovsodkjgГі
%ALLUSERSPROFILE%\microsoft\office\mysite.icoczzzbfkqdpqzВµ
%ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.icoikfobucdhthxВё
%ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.icodjgkjelrlpax
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\dexplore.ctmrimpmyhchzrik
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\dexplore.ctmvfajfrmxothoГҐ
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\onintl.rest.trx_dllhcwmbmxrmhuy‘
%ALLUSERSPROFILE%\adobe\arm\s\10428\adobearmhelper.exeggbwkfnqduxw
%ALLUSERSPROFILE%\adobe\arm\s\armmanifest.msifnfozvsrtkjp
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.inirepggxrpnrvy
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.mspstmwcysyycqp
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msievikeffmznim
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cabkkasvwsrenzk
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exeycxfxtlsgyps
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.inifadpooefxzbc
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1doejuvpvaboyg
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1wpoeylfpbnplj8
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1wvrvipyamyehw
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\readerdcmanifest.msilfdxfircvscx
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1hqnqrqpmxujjl
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.lckncbxcoksfzkv
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1qatxdknlyjyhf
%ALLUSERSPROFILE%\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0eeixjswnkkufnu
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0eepsajlfvgubfas
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0eeaovlzylntrkd0
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0eecpwsrtesjwhd3
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\dbgclr.ctmizcobzcnfwlq6
%ALLUSERSPROFILE%\microsoft\identitycrl\ppcrlconfig.dllowkjilefraamГ¤
%ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xmlqnjwjmwaxxmn$
%ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xmlsnhhlqqrzudl1
%ALLUSERSPROFILE%\microsoft\mf\active.grltfzotcjtnzxuo
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1doovaowuxwhms
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5cc2.tmp.werinternalmetadata.xmlzeewzkaojursv
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\data sources (odbc).lnkoubvjsebalwnl
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.dll.trx_dllfyqgajqkcklzВЈ
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\stintl.dll.trx_dllwkegjccvhhrj~
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.datjomonxrqyjzg
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\racwmidatabase.sdfinrnnzwacxxa
%ALLUSERSPROFILE%\microsoft\rac\statedata\racdatabase.sdfedrwudxzrfus
%ALLUSERSPROFILE%\microsoft\rac\statedata\racmetadata.datewjtboxvynfh
%ALLUSERSPROFILE%\microsoft\rac\statedata\racwmidatabookmarks.datkstcenaumnddГ
%ALLUSERSPROFILE%\microsoft\rac\statedata\racwmieventdata.datxfdmvzcautdci
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.crwlckxaaydzsxttn
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.gthrobbgqngvvpjgd
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss.chkojoglmkxgbfc›
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dlldnmphnqkamhu
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss.logpypckqchbddzГІ
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\cache.datzkkldacllteo
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.cibsqfcihubsjol
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.widelsotflbgsfn
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.wsbpcuzsrupchyn
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.000vzhcpqugriwni
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.001iqxdfjpwpxfbl
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.002lkpnpeelfjmt0
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.000kuqpzomwnlmbw
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.001upmktlptndmpe
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.002dsydsgvfpenet
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.000mwborifsuqhc
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mssres00002.jrscclmznmjugwwi
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\dexplore.ctmeyhjugixwtbvВє
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.dirllmsqsghmcph0
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dllrktrffaclvgrВі
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dllmausjgmhcmhg
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\wwintl.rest.trx_dlloqylobcwqxkz
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.dll.trx_dllowqrwwwpzsqmi
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.rest.trx_dlletogepspxnvjn
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dlliupalyynmkmnd
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dlluvklhsecdwra™
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dllcgfmzkgipdfos
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\envelopr.dll.trx_dlldkjmjqwiqpuo\
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.dll.trx_dllqhimvfvuzwyvv
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.rest.trx_dllijgfullkjduhf
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mapir.dll.trx_dllsjafbtlkmfqrx
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mor6int.rest.trx_dllmyjfjnhhssqc
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dllrarxsvkhtqdig
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.dll.trx_dlltydteamdcjbpu
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\omsintl.dll.trx_dlljwlgrsmeaear
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\onintl.rest.trx_dllwtvjsjbaoiojl
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.dll.trx_dlllwhypnvruihof
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.rest.trx_dllswkifygtydhaВі
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dllcwyhsgewzmtg\
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\ppintl.rest.trx_dllonzltjhgauhns
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dllihreqgjfwkjsf
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dllmtpjhaefqzaac
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dlluldrchjccdyr6
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\sgres.dll.trx_dllfvvrivuyeegfl
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visbrres.dll.trx_dllivdrcygurqdrf
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.rest.trx_dllrhtnegyiwxgcd
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visintl.dll.trx_dlledakubnfgupr
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ppintl.rest.trx_dllfmbisgekyrgzz
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5cd2.tmp.hdmpqgsczvhhujzu!

Modifies the following files

%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.msp
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\dexplore.ctm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\dexplore.ctm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\dexplore.ctm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\dexplore.ctm
%ALLUSERSPROFILE%\microsoft\mf\pending.grl
%ALLUSERSPROFILE%\microsoft\mf\active.grl
%ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xml
%ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xml
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\dbgclr.ctm
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%ALLUSERSPROFILE%\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.msp
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini
%ALLUSERSPROFILE%\adobe\arm\s\armmanifest.msi
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\readerdcmanifest.msi
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\dexplore.ctm
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\dexplore.ctm

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial