Trojan.Encoder.37940

Technical Information

To ensure autorun and distribution

Infects the following executable files

%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\envelopr.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pubwzint.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\onintl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\ppintl.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\sgres.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visbrres.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\wwintl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\stintl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\visintl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mor6int.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ppintl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pub6intl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outlwvw.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ppintl.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mapir.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\sgres.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\visbrres.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\omsintl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\onintl.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\ppintl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\stintl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visintl.dll.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\wwintl.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.rest.trx_dll
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasdlta.vdm

Creates the following files on removable media

<Drive name for removable media>:\inc-readme.html
<Drive name for removable media>:\inc-readme.txt
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\garden.htm
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\advice_process.htm

Modifies file system

Creates the following files

C:\inc-readme.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\inc-readme.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\inc-readme.html
%ALLUSERSPROFILE%\microsoft\rac\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\outbound\inc-readme.html
%ALLUSERSPROFILE%\microsoft\rac\outbound\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\inc-readme.html
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\inc-readme.html
%ALLUSERSPROFILE%\microsoft\rac\statedata\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\inc-readme.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\rac\temp\inc-readme.html
%ALLUSERSPROFILE%\microsoft\search\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\inc-readme.html
%ALLUSERSPROFILE%\microsoft\search\data\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\inc-readme.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\temp\inc-readme.html
%ALLUSERSPROFILE%\microsoft\search\data\temp\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\inc-readme.html
%ALLUSERSPROFILE%\microsoft\user account pictures\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\inc-readme.html
%ALLUSERSPROFILE%\microsoft\rac\temp\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\search\inc-readme.html
%ALLUSERSPROFILE%\microsoft\vault\inc-readme.html
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\ehome\logs\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\inc-readme.html
%ALLUSERSPROFILE%\microsoft\identitycrl\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\media player\inc-readme.html
%ALLUSERSPROFILE%\microsoft\media player\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\mf\inc-readme.html
%ALLUSERSPROFILE%\microsoft\mf\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\inc-readme.html
%ALLUSERSPROFILE%\microsoft\msdn\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\inc-readme.html
%ALLUSERSPROFILE%\microsoft\ehome\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\8.0\inc-readme.html
%ALLUSERSPROFILE%\microsoft\network\connections\inc-readme.html
%ALLUSERSPROFILE%\microsoft\network\connections\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\inc-readme.html
%ALLUSERSPROFILE%\microsoft\network\downloader\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\office\inc-readme.html
%ALLUSERSPROFILE%\microsoft\office\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\inc-readme.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\inc-readme.html
%ALLUSERSPROFILE%\microsoft\msdn\8.0\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\network\inc-readme.html
%ALLUSERSPROFILE%\microsoft\network\inc-readme.txt
%ALLUSERSPROFILE%\adobe\arm\inc-readme.html
%ALLUSERSPROFILE%\microsoft\vault\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows nt\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\wpd\inc-readme.html
%ALLUSERSPROFILE%\microsoft\wpd\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\inc-readme.html
%ALLUSERSPROFILE%\microsoft\wwansvc\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows nt\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\support\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\support\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\ehome\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\ehome\logs\inc-readme.html
%ALLUSERSPROFILE%\microsoft\drm\server\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\drm\server\inc-readme.html
%ALLUSERSPROFILE%\microsoft\drm\inc-readme.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\inc-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\inc-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\inc-readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\inc-readme.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\inc-readme.txt
C:\perflogs\inc-readme.html
C:\perflogs\inc-readme.txt
C:\perflogs\admin\inc-readme.html
C:\perflogs\admin\inc-readme.txt
%ALLUSERSPROFILE%\inc-readme.html
%ALLUSERSPROFILE%\inc-readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\inc-readme.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\inc-readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\inc-readme.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\inc-readme.html
%ALLUSERSPROFILE%\adobe\inc-readme.html
<Current directory>\inc-readme.html
<Current directory>\inc-readme.txt
C:\kms\inc-readme.html
C:\kms\inc-readme.txt
D:\inc-readme.html
D:\inc-readme.txt
C:\msocache\inc-readme.html
C:\msocache\inc-readme.txt
C:\msocache\all users\inc-readme.html
C:\msocache\all users\inc-readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\inc-readme.html
C:\inc-readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\inc-readme.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\inc-readme.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\inc-readme.html
%ALLUSERSPROFILE%\microsoft help\inc-readme.html
%ALLUSERSPROFILE%\microsoft\windows defender\inc-readme.html
%ALLUSERSPROFILE%\adobe\inc-readme.txt
%ALLUSERSPROFILE%\adobe\arm\s\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\device\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\task\inc-readme.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\devicesync\inc-readme.html
%ALLUSERSPROFILE%\microsoft\devicesync\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\drm\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\task\inc-readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\inc-readme.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\inc-readme.html
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\inc-readme.html
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\inc-readme.txt
%ALLUSERSPROFILE%\adobe\setup\inc-readme.html
%ALLUSERSPROFILE%\adobe\setup\inc-readme.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\inc-readme.html
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\inc-readme.html
%ALLUSERSPROFILE%\microsoft\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\inc-readme.html
%ALLUSERSPROFILE%\microsoft\assistance\inc-readme.txt
%ALLUSERSPROFILE%\adobe\arm\s\inc-readme.html
%ALLUSERSPROFILE%\microsoft\assistance\client\inc-readme.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\inc-readme.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\inc-readme.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\inc-readme.html
%ALLUSERSPROFILE%\microsoft\crypto\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\inc-readme.html
%ALLUSERSPROFILE%\microsoft\crypto\dss\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\inc-readme.html
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\inc-readme.html
%ALLUSERSPROFILE%\microsoft\assistance\client\inc-readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\inc-readme.txt
%ALLUSERSPROFILE%\adobe\arm\inc-readme.txt
%ALLUSERSPROFILE%\microsoft help\inc-readme.txt

Modifies the following files

C:\kms\kms_vl_all_aio.cmd
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\tileimage.bmp
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
D:\install.log
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\split.avi
C:\kms\kms_vl_all_aio_debug.log
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial