Technical Information
Malicious functions
Reads files which store third party applications passwords
- %APPDATA%\thunderbird\profiles.ini
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\applicantform_en.doc
- %APPDATA%\mozilla\firefox\profiles.ini
- %HOMEPATH%\desktop\contoso.cer
Modifies file system
Creates the following files
- <Current directory>\newtonsoft.json.dll
- %LOCALAPPDATA%\gdipfontcachev1.dat
Sets the 'hidden' attribute to the following files
- <Current directory>\newtonsoft.json.dll
Moves the following system files
- from %WINDIR%\dtcinstall.log to %WINDIR%\dtcinstall.log.cloud
Moves the following files
- from %ProgramFiles%\microsoft office\document themes 14\adjacency.thmx to %ProgramFiles%\microsoft office\document themes 14\adjacency.thmx.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1253.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1253.txt.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif.cloud
- from %ProgramFiles%\winrar\license.txt to %ProgramFiles%\winrar\license.txt.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143753.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143753.gif.cloud
- from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-synch-l1-2-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-synch-l1-2-0.dll.cloud
- from %ProgramFiles%\microsoft office\office14\accddslm.dll to %ProgramFiles%\microsoft office\office14\accddslm.dll.cloud
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite.cloud
- from %ProgramFiles%\java\jre1.8.0_45\bin\awt.dll to %ProgramFiles%\java\jre1.8.0_45\bin\awt.dll.cloud
- from %ProgramFiles%\microsoft office\media\office14\bullets\bd10254_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10254_.gif.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif.cloud
- from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-processthreads-l1-1-1.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-processthreads-l1-1-1.dll.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1254.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1254.txt.cloud
- from %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties to %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll.cloud
- from %ProgramFiles(x86)%\opera\launcher.exe to %ProgramFiles(x86)%\opera\launcher.exe.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1257.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1257.txt.cloud
- from %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx to %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1258.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1258.txt.cloud
- from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.cloud
- from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18181_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18181_.wmf.cloud
- from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.cloud
- from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\cyrillic.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\cyrillic.txt.cloud
- from %ProgramFiles(x86)%\mozilla firefox\distibution\policies.json to %ProgramFiles(x86)%\mozilla firefox\distibution\policies.json.cloud
- from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.cloud
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.cloud
- from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18180_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18180_.wmf.cloud
- from %ProgramFiles%\microsoft office\media\office14\autoshap\autoshap.dll to %ProgramFiles%\microsoft office\media\office14\autoshap\autoshap.dll.cloud
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1252.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1252.txt.cloud
- from %ProgramFiles%\microsoft office\document themes 14\aspect.thmx to %ProgramFiles%\microsoft office\document themes 14\aspect.thmx.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-bold.otf.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\j0149627.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0149627.wmf.cloud
- from %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk to %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\corpchar.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\corpchar.txt.cloud
- from %ProgramFiles%\microsoft office\media\office14\1033\office10.mml to %ProgramFiles%\microsoft office\media\office14\1033\office10.mml.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\croatian.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\croatian.txt.cloud
- from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.dll.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-boldit.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-boldit.otf.cloud
- from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-localization-l1-2-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-localization-l1-2-0.dll.cloud
- from %ProgramFiles(x86)%\mozilla firefox\browser\override.ini to %ProgramFiles(x86)%\mozilla firefox\browser\override.ini.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143752.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143752.gif.cloud
- from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\zdingbat.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\zdingbat.txt.cloud
- from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.comrpcchannel.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.comrpcchannel.dll.cloud
- from %TEMP%\armui.ini to %TEMP%\armui.ini.cloud
- from %ProgramFiles%\microsoft office\stationery\1033\jungle.gif to %ProgramFiles%\microsoft office\stationery\1033\jungle.gif.cloud
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.cloud
- from %ProgramFiles%\microsoft office\media\office14\bullets\bd10253_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10253_.gif.cloud
- from %ProgramFiles%\microsoft office\office14\accddsf.dll to %ProgramFiles%\microsoft office\office14\accddsf.dll.cloud
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.cloud
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.cloud
- from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.cloud
- from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.cloud
- from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.cloud
- from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.adapter.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.adapter.dll.cloud
- from %ProgramFiles%\microsoft office\document themes 14\austin.thmx to %ProgramFiles%\microsoft office\document themes 14\austin.thmx.cloud
- from %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.cloud
- from %ProgramFiles%\java\jre1.8.0_45\bin\dcpr.dll to %ProgramFiles%\java\jre1.8.0_45\bin\dcpr.dll.cloud
- from %ProgramFiles(x86)%\steam\steam.exe to %ProgramFiles(x86)%\steam\steam.exe.cloud
- from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.cloud
- from %ProgramFiles%\microsoft office\media\office14\bullets\bd10263_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10263_.gif.cloud
- from %ProgramFiles%\java\jre1.8.0_45\bin\decora_sse.dll to %ProgramFiles%\java\jre1.8.0_45\bin\decora_sse.dll.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\j0157995.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0157995.wmf.cloud
- from %ProgramFiles%\microsoft office\media\office14\bullets\bd10264_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10264_.gif.cloud
- from %ProgramFiles%\microsoft office\media\office14\lines\bd10256_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd10256_.gif.cloud
- from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json.cloud
- from %ProgramFiles%\microsoft office\document themes 14\clarity.thmx to %ProgramFiles%\microsoft office\document themes 14\clarity.thmx.cloud
- from %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json to %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00516l.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00516l.gif.cloud
- from %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js to %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js.cloud
- from %ProgramFiles%\microsoft office\media\office14\lines\bd10289_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd10289_.gif.cloud
- from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-convert-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-convert-l1-1-0.dll.cloud
- from %ProgramFiles(x86)%\steam\logs\bootstrap_log.txt to %ProgramFiles(x86)%\steam\logs\bootstrap_log.txt.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00531l.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00531l.gif.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00673l.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00673l.gif.cloud
- from %ProgramFiles%\winrar\rarext32.dll to %ProgramFiles%\winrar\rarext32.dll.cloud
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk.cloud
- from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.cloud
- from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4.cloud
- from %ProgramFiles%\java\jre1.8.0_45\bin\deploy.dll to %ProgramFiles%\java\jre1.8.0_45\bin\deploy.dll.cloud
- from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\system.addin.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\system.addin.dll.cloud
- from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaprojectui.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaprojectui.dll.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\iceland.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\iceland.txt.cloud
- from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaclientpkgui.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaclientpkgui.dll.cloud
- from %ProgramFiles%\microsoft office\office14\accicons.exe to %ProgramFiles%\microsoft office\office14\accicons.exe.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143749.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143749.gif.cloud
- from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.cloud
- from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json.cloud
- from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.designtime.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.designtime.dll.cloud
- from %ProgramFiles%\microsoft office\media\office14\lines\bd10219_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd10219_.gif.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143754.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143754.gif.cloud
- from %ProgramFiles%\microsoft office\media\office14\bullets\bd10255_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10255_.gif.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe.cloud
- from %ProgramFiles%\microsoft office\document themes 14\black tie.thmx to %ProgramFiles%\microsoft office\document themes 14\black tie.thmx.cloud
- from %ProgramFiles%\microsoft office\templates\1033\adjacencyresume.dotx to %ProgramFiles%\microsoft office\templates\1033\adjacencyresume.dotx.cloud
- from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-timezone-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-timezone-l1-1-0.dll.cloud
- from %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties to %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.cloud
- from %ProgramFiles%\java\jre1.8.0_45\bin\bci.dll to %ProgramFiles%\java\jre1.8.0_45\bin\bci.dll.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif.cloud
- from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.cloud
- from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.cloud
- from %ProgramFiles%\winrar\rar.exe to %ProgramFiles%\winrar\rar.exe.cloud
- from %ProgramFiles%\winrar\rar.txt to %ProgramFiles%\winrar\rar.txt.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\j0157763.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0157763.wmf.cloud
- from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18182_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18182_.wmf.cloud
- from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-conio-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-conio-l1-1-0.dll.cloud
- from %ProgramFiles%\microsoft office\templates\1033\apothecaryletter.dotx to %ProgramFiles%\microsoft office\templates\1033\apothecaryletter.dotx.cloud
- from %ProgramFiles%\microsoft office\document themes 14\civic.thmx to %ProgramFiles%\microsoft office\document themes 14\civic.thmx.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll.cloud
- from %ProgramFiles%\winrar\rarext.dll to %ProgramFiles%\winrar\rarext.dll.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\j0149887.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0149887.wmf.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\greek.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\greek.txt.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143758.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143758.gif.cloud
- from %ProgramFiles%\microsoft office\media\office14\office10.mmw to %ProgramFiles%\microsoft office\media\office14\office10.mmw.cloud
- from %ProgramFiles%\microsoft office\document themes 14\apothecary.thmx to %ProgramFiles%\microsoft office\document themes 14\apothecary.thmx.cloud
- from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.cloud
- from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\microsoft.synchronization.dll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\microsoft.synchronization.dll.cloud
- from %ProgramFiles%\java\jre1.8.0_45\license to %ProgramFiles%\java\jre1.8.0_45\license.cloud
- from %ProgramFiles%\winrar\7zxa.dll to %ProgramFiles%\winrar\7zxa.dll.cloud
- from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceme35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceme35.dll.cloud
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.cloud
- from %ProgramFiles%\mozilla firefox\accessiblehandler.dll to %ProgramFiles%\mozilla firefox\accessiblehandler.dll.cloud
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.cloud
- from %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json to %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json.cloud
- from %ProgramFiles%\mozilla thunderbird\accessiblemarshal.dll to %ProgramFiles%\mozilla thunderbird\accessiblemarshal.dll.cloud
- from %ProgramFiles%\mozilla firefox\accessiblemarshal.dll to %ProgramFiles%\mozilla firefox\accessiblemarshal.dll.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif.cloud
- from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.cloud
- from %ProgramFiles%\windows sidebar\settings.ini to %ProgramFiles%\windows sidebar\settings.ini.cloud
- from %ProgramFiles%\java\jre1.8.0_45\readme.txt to %ProgramFiles%\java\jre1.8.0_45\readme.txt.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143746.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143746.gif.cloud
- from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.cloud
- from %ProgramFiles%\microsoft office\media\office14\office10.dll to %ProgramFiles%\microsoft office\media\office14\office10.dll.cloud
- from %ProgramFiles%\java\jre1.8.0_45\release to %ProgramFiles%\java\jre1.8.0_45\release.cloud
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.cloud
- from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\documents.library-ms.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\j0090070.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0090070.wmf.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\j0088542.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0088542.wmf.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif.cloud
- from %ProgramFiles%\microsoft office\document themes 14\angles.thmx to %ProgramFiles%\microsoft office\document themes 14\angles.thmx.cloud
- from %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.cloud
- from %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets to %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\cagcat10.dll to %ProgramFiles%\microsoft office\media\cagcat10\cagcat10.dll.cloud
- from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceca35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceca35.dll.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143743.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143743.gif.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143744.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143744.gif.cloud
- from %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.dll to %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.dll.cloud
- from %ProgramFiles%\microsoft office\stationery\1033\currency.gif to %ProgramFiles%\microsoft office\stationery\1033\currency.gif.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif.cloud
- from %ProgramFiles%\mozilla firefox\accessible.tlb to %ProgramFiles%\mozilla firefox\accessible.tlb.cloud
- from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l1-2-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l1-2-0.dll.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.cloud
- from %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.sqlserverce.dll to %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.sqlserverce.dll.cloud
- from %ProgramFiles%\microsoft office\templates\1033\adjacencyletter.dotx to %ProgramFiles%\microsoft office\templates\1033\adjacencyletter.dotx.cloud
- from %ProgramFiles%\microsoft office\templates\1033\adjacencymergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\adjacencymergeletter.dotx.cloud
- from %ProgramFiles%\mozilla thunderbird\accessible.tlb to %ProgramFiles%\mozilla thunderbird\accessible.tlb.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\cagcat10.mmw to %ProgramFiles%\microsoft office\media\cagcat10\cagcat10.mmw.cloud
- from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcecompact35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcecompact35.dll.cloud
- from %ProgramFiles%\mozilla thunderbird\accessiblehandler.dll to %ProgramFiles%\mozilla thunderbird\accessiblehandler.dll.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\elphrg01.wav to %ProgramFiles%\microsoft office\media\cagcat10\elphrg01.wav.cloud
- from %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf to %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.cloud
- from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceer35en.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceer35en.dll.cloud
- from %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.server.dll to %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.server.dll.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.cloud
- from %ProgramFiles%\java\jre1.8.0_45\copyright to %ProgramFiles%\java\jre1.8.0_45\copyright.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif.cloud
- from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\feedsync.dll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\feedsync.dll.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143745.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143745.gif.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\symbol.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\symbol.txt.cloud
- from %ProgramFiles(x86)%\microsoft office\office14\authzax.dll to %ProgramFiles(x86)%\microsoft office\office14\authzax.dll.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif.cloud
- from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-oblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-oblique.otf.cloud
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json.cloud
- from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaclientpkg.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaclientpkg.dll.cloud
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4.cloud
- from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\microsoft.visualstudio.tools.applications.project.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\microsoft.visualstudio.tools.applications.project.dll.cloud
- from %ProgramFiles%\microsoft office\office14\accdds.dll to %ProgramFiles%\microsoft office\office14\accdds.dll.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd.otf.cloud
- from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite.cloud
- from %ProgramFiles%\winrar\ace32loader.exe to %ProgramFiles%\winrar\ace32loader.exe.cloud
- from %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.cloud
- from %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll to %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll.cloud
- from %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.cloud
- from %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets to %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets.cloud
- from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaproject.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaproject.dll.cloud
- from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.cloud
- from %ProgramFiles%\microsoft office\stationery\1033\judgesch.gif to %ProgramFiles%\microsoft office\stationery\1033\judgesch.gif.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif.cloud
- from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\adodb.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\adodb.dll.cloud
- from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\videos.library-ms.cloud
- from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\synchronization.rll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\synchronization.rll.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143750.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143750.gif.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif.cloud
- from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.cloud
- from %ProgramFiles%\winrar\descript.ion to %ProgramFiles%\winrar\descript.ion.cloud
- from %ProgramFiles(x86)%\steam\uninstall.exe to %ProgramFiles(x86)%\steam\uninstall.exe.cloud
- from %ProgramFiles%\microsoft office\stationery\1033\offisupp.gif to %ProgramFiles%\microsoft office\stationery\1033\offisupp.gif.cloud
- from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif.cloud
- from %ProgramFiles%\microsoft office\document themes 14\apex.thmx to %ProgramFiles%\microsoft office\document themes 14\apex.thmx.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1250.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1250.txt.cloud
- from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf.cloud
- from %ProgramFiles%\winrar\default.sfx to %ProgramFiles%\winrar\default.sfx.cloud
- from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll.cloud
- from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\music.library-ms.cloud
- from %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk to %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.cloud
- from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\pictures.library-ms.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\j0090386.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0090386.wmf.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\j0149407.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0149407.wmf.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1251.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1251.txt.cloud
- from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcese35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcese35.dll.cloud
- from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143748.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143748.gif.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp.cloud
- from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\synchronization.dll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\synchronization.dll.cloud
- from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.cloud
- from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\centeuro.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\centeuro.txt.cloud
- from %ProgramFiles%\microsoft office\media\cagcat10\j0149481.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0149481.wmf.cloud
- from %TEMP%\adobearm.log to %TEMP%\adobearm.log.cloud
- from %ProgramFiles%\microsoft office\stationery\1033\dadshirt.gif to %ProgramFiles%\microsoft office\stationery\1033\dadshirt.gif.cloud
- from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.cloud
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.cloud
- from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l2-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l2-1-0.dll.cloud
- from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceoledb35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceoledb35.dll.cloud
- from %ProgramFiles%\winrar\default64.sfx to %ProgramFiles%\winrar\default64.sfx.cloud
- from %ProgramFiles%\microsoft office\templates\1033\apothecarymergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\apothecarymergeletter.dotx.cloud
Modifies the following files
- C:\kms\kms_vl_all_aio.cmd
- %ProgramFiles%\microsoft office\templates\1033\adjacencyletter.dotx
- %ProgramFiles%\java\jre1.8.0_45\copyright
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
- %ALLUSERSPROFILE%\mozilla\updates\e7cf176e110c211b\update-config.json
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.msi
- %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm
- %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.cfg
- %ProgramFiles%\mozilla firefox\accessible.tlb
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif
- %ProgramFiles%\microsoft office\stationery\1033\currency.gif
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.msi
- %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143744.gif
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif
- %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143743.gif
- %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json
- %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets
- %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- %ProgramFiles%\microsoft office\document themes 14\adjacency.thmx
- %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi
- D:\install.log
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
- C:\kms\kms_vl_all_aio_debug.log
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
- %ALLUSERSPROFILE%\sun\java\java update\jaureglist.xml
Modifies multiple files.
Substitutes the following executable files
- %ALLUSERSPROFILE%\Microsoft\IdentityCRL\ppcrlui.dll
- %ALLUSERSPROFILE%\Oracle\Java\javapath\javaws.exe
- %ALLUSERSPROFILE%\Package Cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\VC_redist.x86.exe
- %ALLUSERSPROFILE%\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\VC_redist.x64.exe
- %ALLUSERSPROFILE%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Substitutes the following files
- %ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini
- %ALLUSERSPROFILE%\Microsoft\OFFICE\MySharePoints.ico
- %ALLUSERSPROFILE%\Microsoft\MF\Active.GRL
- %ALLUSERSPROFILE%\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm
- %ALLUSERSPROFILE%\Package Cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm
- %ALLUSERSPROFILE%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
- %ALLUSERSPROFILE%\Microsoft\MF\Pending.GRL
- %ALLUSERSPROFILE%\Package Cache\{6CD9E9ED-906D-4196-8DC3-F987D2F6615F}v14.29.30133\packages\vcRuntimeMinimum_amd64\cab1.cab
- %ALLUSERSPROFILE%\Microsoft\OFFICE\SharePointPortalSite.ico
- %ALLUSERSPROFILE%\Microsoft\RAC\StateData\RacDatabase.sdf
- %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\MSS.chk
- %ALLUSERSPROFILE%\Package Cache\{F1B0FB3A-E0EA-47A6-9383-3650655403B0}v14.16.27024\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
- %ALLUSERSPROFILE%\Package Cache\{9D29FC96-9EEE-4253-943F-96B3BBFDD0B6}v14.16.27024\packages\vcRuntimeAdditional_amd64\cab1.cab
- %ALLUSERSPROFILE%\Package Cache\{6CD9E9ED-906D-4196-8DC3-F987D2F6615F}v14.29.30133\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
- %ALLUSERSPROFILE%\Microsoft\OFFICE\SharePointTeamSite.ico
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
