Trojan.Encoder.38692

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '{4461224A-7171-AB9C-E118-E1E7D9586D2C}' = '"%APPDATA%\SharpSvn Project\Advanced SharpSvn\sharpsvn.exe"'

Creates the following files on removable media

<Drive name for removable media>:\restore-my-files.txt
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\about.htm
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

deletes volume shadow copies.

Modifies file system

Creates the following files

%APPDATA%\sharpsvn project\advanced sharpsvn\7-zip.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en\stylesheets\start_page_landing.css
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en\stylesheets\start_page.css
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en\html\startpage_topstrip_with_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en\html\startpage_topstrip_no_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en\html\startpage_landing.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en\html\startpage_connect_to_data_with_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en\html\startpage_connect_to_data_no_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en\html\startpage_banner.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\de\stylesheets\start_page_landing.css
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\de\stylesheets\start_page.css
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\de\html\startpage_topstrip_with_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\de\html\startpage_topstrip_no_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en_gb\html\startpage_banner.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\de\html\startpage_landing.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\de\html\startpage_connect_to_data_no_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\de\html\startpage_banner.html
%APPDATA%\sharpsvn project\advanced sharpsvn\qt5serialport.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\qt5quickwidgets.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\qclp-2.3.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\pthreadgc2.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\patterns\fr
%APPDATA%\sharpsvn project\advanced sharpsvn\patterns\es
%APPDATA%\sharpsvn project\advanced sharpsvn\patterns\en
%APPDATA%\sharpsvn project\advanced sharpsvn\patterns\de
%APPDATA%\sharpsvn project\advanced sharpsvn\mingwm10.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\microsoft.reportviewer.processingobjectmodel.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\de\html\startpage_connect_to_data_with_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\uninstall.exe
%ProgramFiles%\java\jre1.8.0_45\lib\security\restore-my-files.txt
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en_gb\html\startpage_landing.html
%ProgramFiles%\java\jre1.8.0_45\lib\management\restore-my-files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\jfr\restore-my-files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\restore-my-files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\ext\restore-my-files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\restore-my-files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\restore-my-files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\amd64\restore-my-files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\restore-my-files.txt
%ProgramFiles%\java\jre1.8.0_45\restore-my-files.txt
%ProgramFiles%\java\jre1.8.0_45\bin\server\restore-my-files.txt
C:\kms\restore-my-files.txt
D:\restore-my-files.txt
%APPDATA%\sharpsvn project\advanced sharpsvn\mapsources\tableau.tms
%APPDATA%\sharpsvn project\advanced sharpsvn\uninstall.ini
%APPDATA%\sharpsvn project\advanced sharpsvn\windowsinput.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\utilslib.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\themes\default.css
%APPDATA%\sharpsvn project\advanced sharpsvn\themes\cosmo.css
%APPDATA%\sharpsvn project\advanced sharpsvn\system.numerics.vectors.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\system.memory.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\system.buffers.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\sharpsvn.exe
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en_gb\stylesheets\start_page_landing.css
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en_gb\stylesheets\start_page.css
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en_gb\html\startpage_topstrip_with_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en_gb\html\startpage_topstrip_no_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en_gb\html\startpage_connect_to_data_no_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\res\public\en_gb\html\startpage_connect_to_data_with_mru.html
%APPDATA%\sharpsvn project\advanced sharpsvn\locale\fr\lc_messages\default.mo
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-hotkeylist.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-floatereditor.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-applicationlist.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-applicationeditor.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\codemirror-matchbrackets.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\codemirror-javascript-hint.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\codemirror-autorefresh.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\css\strokesplus-net-custom.css
%APPDATA%\sharpsvn project\advanced sharpsvn\html\css\codemirror.css
%APPDATA%\sharpsvn project\advanced sharpsvn\html\css\codemirror-show-hint.css
%APPDATA%\sharpsvn project\advanced sharpsvn\html\css\bootstrap.min.css
%APPDATA%\sharpsvn project\advanced sharpsvn\guide.pdf
%APPDATA%\sharpsvn project\advanced sharpsvn\fonts\license.txt
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-floaterlist.js
%APPDATA%\sharpsvn project\advanced sharpsvn\fonts\font awesome 5 free-regular-400.otf
%APPDATA%\sharpsvn project\advanced sharpsvn\filters\register.cmd
%APPDATA%\sharpsvn project\advanced sharpsvn\filters\license.rtf
%APPDATA%\sharpsvn project\advanced sharpsvn\filters\lc.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\filehelpers.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\docs\quick start.pdf
%APPDATA%\sharpsvn project\advanced sharpsvn\devexpress.sparkline.v14.2.core.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\dat\pdf_32x32.ico
%APPDATA%\sharpsvn project\advanced sharpsvn\dat\ico48.ico
%APPDATA%\sharpsvn project\advanced sharpsvn\dat\enc.ico
%APPDATA%\sharpsvn project\advanced sharpsvn\commonmanaged.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\common.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\bzip2.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\filters\unregister.cmd
%APPDATA%\sharpsvn project\advanced sharpsvn\imageformats\qgif4.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\locale\de\lc_messages\default.mo
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-ignorelist.js
%APPDATA%\sharpsvn project\advanced sharpsvn\license.txt
%APPDATA%\sharpsvn project\advanced sharpsvn\license.electron.txt
%APPDATA%\sharpsvn project\advanced sharpsvn\libogg-0.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\libmongoc-1.0.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\libgthread-2.0-0.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\libgmodule-2.0-0.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\libegl.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\libbson-1.0.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\images\icon.png
%APPDATA%\sharpsvn project\advanced sharpsvn\images\exeicon.png
%APPDATA%\sharpsvn project\advanced sharpsvn\images\app_plugin_control_32.png
%APPDATA%\sharpsvn project\advanced sharpsvn\images\app_plugin_control_16.png
%APPDATA%\sharpsvn project\advanced sharpsvn\locale\es\lc_messages\default.mo
%APPDATA%\sharpsvn project\advanced sharpsvn\imageformats\qjpeg4.dll
%APPDATA%\sharpsvn project\advanced sharpsvn\html\settings.html
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-utilities.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-toolbar.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-textexpansionlist.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-textexpansioneditor.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-stepsscript.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-stepslist.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-stepeditor.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-scripteditor.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-modals.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-menu.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-load.js
%APPDATA%\sharpsvn project\advanced sharpsvn\html\js\strokesplus-net-hotkeyeditor.js
%ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\restore-my-files.txt

Moves the following files

from %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04235_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04235_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04225_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04225_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04269_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04269_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04323_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04323_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04326_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04326_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04267_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04267_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04332_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04332_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04355_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04355_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04369_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04369_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04384_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04384_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04385_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04385_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04191_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04191_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\baby_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\baby_01.mid.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00160_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00160_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07831_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07831_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00173_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd06102_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd06102_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd05119_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd05119_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd06200_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd06200_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07761_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07761_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd07804_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd07804_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08758_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08758_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08773_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08773_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00116_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00116_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00146_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00146_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04117_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04117_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an03500_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an03500_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an02559_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02559_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00010_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00010_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01039_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01039_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01044_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01044_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01084_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01084_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01218_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01218_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00015_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00015_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00790_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00790_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00932_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00932_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00853_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00853_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01060_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01060_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00965_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00965_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01174_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01251_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01251_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an02724_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02724_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04108_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04108_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04174_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04196_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04196_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01545_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01545_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an02122_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an02122_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09031_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09031_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08808_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08808_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd08868_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd08868_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09662_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09662_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00270_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00270_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00269_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00269_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00273_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00273_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00296_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00296_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00274_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00274_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00985_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00985_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\boat.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\boat.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00390_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00390_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00524_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00524_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00648_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00648_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00921_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00921_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00932_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00932_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00923_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00923_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00392_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00392_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00076_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00076_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00078_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00078_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00526_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00526_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00525_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00525_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\boatinst.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\boatinst.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00092_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00092_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00100_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00100_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00135_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00135_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00136_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00136_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00145_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00145_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00174_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00174_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00200_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00200_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00184_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00184_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00186_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00186_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00224_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00224_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00267_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00267_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00262_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00262_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00265_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00265_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00261_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00261_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00105_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00105_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19695_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19695_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19828_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19828_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19827_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19827_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19986_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19986_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd20013_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd20013_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00130_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00130_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19988_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19988_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00008_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00008_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00012_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00012_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00045_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00045_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00122_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00122_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00148_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00148_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00152_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00152_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00194_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00194_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00242_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00242_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00248_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00248_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00234_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00234_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00195_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00195_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00254_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00254_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00247_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00247_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00252_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00252_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00438_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00438_.wmf.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc to %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties to %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\cursors.properties to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\cursors.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunpkcs11.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunpkcs11.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\dnsns.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\dnsns.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\javafx.properties to %ProgramFiles%\java\jre1.8.0_45\lib\javafx.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties to %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.access to %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.access.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunec.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunec.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.password.template to %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.password.template.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src to %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\zipfs.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\zipfs.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunjce_provider.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunjce_provider.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties to %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\management\snmp.acl.template to %ProgramFiles%\java\jre1.8.0_45\lib\management\snmp.acl.template.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\meta-index.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\management-agent.jar to %ProgramFiles%\java\jre1.8.0_45\lib\management-agent.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties to %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg to %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg.lockbit
from %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties to %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\gray.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\gray.pf.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\srgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\srgb.pf.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar to %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\classlist to %ProgramFiles%\java\jre1.8.0_45\lib\classlist.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\currency.data to %ProgramFiles%\java\jre1.8.0_45\lib\currency.data.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\copyright to %ProgramFiles%\java\jre1.8.0_45\copyright.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_de.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_de.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_fr.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_fr.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties to %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_pt_br.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_pt_br.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_sv.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_sv.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_cn.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_cn.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_hk.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_hk.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ko.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ko.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_tw.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_tw.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja to %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\net.properties to %ProgramFiles%\java\jre1.8.0_45\lib\net.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt to %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\jce.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jce.jar.lockbit
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql70.xsl.lockbit
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql90.xsl.lockbit
from %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll.lockbit
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sybase.xsl.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif.lockbit
from %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll to %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif.lockbit
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl.lockbit
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings to %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\javaws.jar to %ProgramFiles%\java\jre1.8.0_45\lib\javaws.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklist to %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklist.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\jfxswt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jfxswt.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\default.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\default.jfc.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklisted.certs to %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklisted.certs.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\management\management.properties to %ProgramFiles%\java\jre1.8.0_45\lib\management\management.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\security\javaws.policy to %ProgramFiles%\java\jre1.8.0_45\lib\security\javaws.policy.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\security\java.policy to %ProgramFiles%\java\jre1.8.0_45\lib\security\java.policy.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties to %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\security\local_policy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\security\local_policy.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar to %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\security\trusted.libraries to %ProgramFiles%\java\jre1.8.0_45\lib\security\trusted.libraries.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\security\us_export_policy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\security\us_export_policy.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\sound.properties to %ProgramFiles%\java\jre1.8.0_45\lib\sound.properties.lockbit
from %ProgramFiles%\java\jre1.8.0_45\license to %ProgramFiles%\java\jre1.8.0_45\license.lockbit
from %ProgramFiles%\java\jre1.8.0_45\readme.txt to %ProgramFiles%\java\jre1.8.0_45\readme.txt.lockbit
from %ProgramFiles%\java\jre1.8.0_45\release to %ProgramFiles%\java\jre1.8.0_45\release.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar to %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\security\cacerts to %ProgramFiles%\java\jre1.8.0_45\lib\security\cacerts.lockbit
from %ProgramFiles%\java\jre1.8.0_45\lib\security\java.security to %ProgramFiles%\java\jre1.8.0_45\lib\security\java.security.lockbit
from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.lockbit
from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.lockbit
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as80.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as80.xsl.lockbit
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as90.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\as90.xsl.lockbit
from %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\informix.xsl to %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\informix.xsl.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif.lockbit
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00439_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00439_.wmf.lockbit

Modifies the following files

<Drive name for removable media>:\correct.avi
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf
%ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\gray.pf
%ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties
%ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg
%ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties
%ProgramFiles%\java\jre1.8.0_45\copyright
%ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt
%ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa
C:\kms\kms_vl_all_aio_debug.log
D:\install.log
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\dial.bmp
%ProgramFiles%\java\jre1.8.0_45\lib\classlist
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'<LOCALNET>.5.0':135
'<LOCALNET>.5.174':445
'<LOCALNET>.5.174':135
'<LOCALNET>.5.173':445
'<LOCALNET>.5.173':135
'<LOCALNET>.5.172':445
'<LOCALNET>.5.172':135
'<LOCALNET>.5.171':445
'<LOCALNET>.5.171':135
'<LOCALNET>.5.170':445
'<LOCALNET>.5.170':135
'<LOCALNET>.5.169':445
'<LOCALNET>.5.169':135
'<LOCALNET>.5.168':445
'<LOCALNET>.5.167':445
'<LOCALNET>.5.175':445
'<LOCALNET>.5.167':135
'<LOCALNET>.5.166':445
'<LOCALNET>.5.166':135
'<LOCALNET>.5.165':445
'<LOCALNET>.5.165':135
'<LOCALNET>.5.164':445
'<LOCALNET>.5.164':135
'<LOCALNET>.5.163':445
'<LOCALNET>.5.163':135
'<LOCALNET>.5.162':445
'<LOCALNET>.5.162':135
'<LOCALNET>.5.161':445
'<LOCALNET>.5.168':135
'<LOCALNET>.5.160':135
'<LOCALNET>.5.176':135
'<LOCALNET>.5.190':445
'<LOCALNET>.5.190':135
'<LOCALNET>.5.189':445
'<LOCALNET>.5.189':135
'<LOCALNET>.5.188':445
'<LOCALNET>.5.188':135
'<LOCALNET>.5.187':445
'<LOCALNET>.5.187':135
'<LOCALNET>.5.186':445
'<LOCALNET>.5.186':135
'<LOCALNET>.5.185':445
'<LOCALNET>.5.185':135
'<LOCALNET>.5.184':445
'<LOCALNET>.5.161':135
'<LOCALNET>.5.175':135
'<LOCALNET>.5.183':135
'<LOCALNET>.5.182':445
'<LOCALNET>.5.182':135
'<LOCALNET>.5.181':445
'<LOCALNET>.5.181':135
'<LOCALNET>.5.180':445
'<LOCALNET>.5.180':135
'<LOCALNET>.5.179':445
'<LOCALNET>.5.179':135
'<LOCALNET>.5.178':445
'<LOCALNET>.5.178':135
'<LOCALNET>.5.177':445
'<LOCALNET>.5.177':135
'<LOCALNET>.5.183':445
'<LOCALNET>.5.176':445
'<LOCALNET>.5.160':445
'<LOCALNET>.5.159':445
'<LOCALNET>.5.191':445
'<LOCALNET>.5.136':445
'<LOCALNET>.5.142':445
'<LOCALNET>.5.142':135
'<LOCALNET>.5.141':445
'<LOCALNET>.5.141':135
'<LOCALNET>.5.140':445
'<LOCALNET>.5.140':135
'<LOCALNET>.5.139':445
'<LOCALNET>.5.139':135
'<LOCALNET>.5.138':445
'<LOCALNET>.5.138':135
'<LOCALNET>.5.137':445
'<LOCALNET>.5.137':135
'<LOCALNET>.5.143':135
'<LOCALNET>.5.143':445
'<LOCALNET>.5.191':135
'<LOCALNET>.5.135':135
'<LOCALNET>.5.134':445
'<LOCALNET>.5.134':135
'<LOCALNET>.5.133':445
'<LOCALNET>.5.133':135
'<LOCALNET>.5.132':445
'<LOCALNET>.5.132':135
'<LOCALNET>.5.131':445
'<LOCALNET>.5.131':135
'<LOCALNET>.5.130':445
'<LOCALNET>.5.130':135
'<LOCALNET>.5.129':445
'<LOCALNET>.5.135':445
'<LOCALNET>.5.184':135
'<LOCALNET>.5.144':135
'<LOCALNET>.5.152':135
'<LOCALNET>.5.152':445
'<LOCALNET>.5.158':445
'<LOCALNET>.5.158':135
'<LOCALNET>.5.157':445
'<LOCALNET>.5.157':135
'<LOCALNET>.5.156':445
'<LOCALNET>.5.156':135
'<LOCALNET>.5.155':445
'<LOCALNET>.5.155':135
'<LOCALNET>.5.154':445
'<LOCALNET>.5.154':135
'<LOCALNET>.5.153':445
'<LOCALNET>.5.153':135
'<LOCALNET>.5.159':135
'<LOCALNET>.5.144':445
'<LOCALNET>.5.145':135
'<LOCALNET>.5.151':135
'<LOCALNET>.5.150':445
'<LOCALNET>.5.150':135
'<LOCALNET>.5.149':445
'<LOCALNET>.5.149':135
'<LOCALNET>.5.148':445
'<LOCALNET>.5.148':135
'<LOCALNET>.5.147':445
'<LOCALNET>.5.147':135
'<LOCALNET>.5.146':445
'<LOCALNET>.5.146':135
'<LOCALNET>.5.145':445
'<LOCALNET>.5.151':445
'<LOCALNET>.5.88':135
'<LOCALNET>.5.192':135
'<LOCALNET>.5.238':445
'<LOCALNET>.5.238':135
'<LOCALNET>.5.237':445
'<LOCALNET>.5.237':135
'<LOCALNET>.5.236':445
'<LOCALNET>.5.236':135
'<LOCALNET>.5.235':445
'<LOCALNET>.5.235':135
'<LOCALNET>.5.234':445
'<LOCALNET>.5.234':135
'<LOCALNET>.5.233':445
'<LOCALNET>.5.233':135
'<LOCALNET>.5.232':445
'<LOCALNET>.5.239':135
'<LOCALNET>.5.232':135
'<LOCALNET>.5.231':135
'<LOCALNET>.5.230':445
'<LOCALNET>.5.230':135
'<LOCALNET>.5.229':445
'<LOCALNET>.5.229':135
'<LOCALNET>.5.228':445
'<LOCALNET>.5.228':135
'<LOCALNET>.5.227':445
'<LOCALNET>.5.227':135
'<LOCALNET>.5.226':445
'<LOCALNET>.5.226':135
'<LOCALNET>.5.225':445
'<LOCALNET>.5.225':135
'<LOCALNET>.5.231':445
'<LOCALNET>.5.224':445
'<LOCALNET>.5.129':135
'<LOCALNET>.5.224':135
'<LOCALNET>.5.254':445
'<LOCALNET>.5.254':135
'<LOCALNET>.5.253':445
'<LOCALNET>.5.253':135
'<LOCALNET>.5.252':445
'<LOCALNET>.5.252':135
'<LOCALNET>.5.251':445
'<LOCALNET>.5.251':135
'<LOCALNET>.5.250':445
'<LOCALNET>.5.250':135
'<LOCALNET>.5.249':445
'<LOCALNET>.5.249':135
'<LOCALNET>.5.248':445
'<LOCALNET>.5.240':135
'<LOCALNET>.5.239':445
'<LOCALNET>.5.247':135
'<LOCALNET>.5.246':445
'<LOCALNET>.5.246':135
'<LOCALNET>.5.245':445
'<LOCALNET>.5.245':135
'<LOCALNET>.5.244':445
'<LOCALNET>.5.244':135
'<LOCALNET>.5.243':445
'<LOCALNET>.5.243':135
'<LOCALNET>.5.242':445
'<LOCALNET>.5.242':135
'<LOCALNET>.5.241':445
'<LOCALNET>.5.241':135
'<LOCALNET>.5.247':445
'<LOCALNET>.5.240':445
'<LOCALNET>.5.136':135
'<LOCALNET>.5.223':135
'<LOCALNET>.5.216':135
'<LOCALNET>.5.206':135
'<LOCALNET>.5.205':445
'<LOCALNET>.5.205':135
'<LOCALNET>.5.204':445
'<LOCALNET>.5.204':135
'<LOCALNET>.5.203':445
'<LOCALNET>.5.203':135
'<LOCALNET>.5.202':445
'<LOCALNET>.5.202':135
'<LOCALNET>.5.201':445
'<LOCALNET>.5.201':135
'<LOCALNET>.5.200':445
'<LOCALNET>.5.207':135
'<LOCALNET>.5.200':135
'<LOCALNET>.5.199':135
'<LOCALNET>.5.198':445
'<LOCALNET>.5.198':135
'<LOCALNET>.5.197':445
'<LOCALNET>.5.197':135
'<LOCALNET>.5.196':445
'<LOCALNET>.5.196':135
'<LOCALNET>.5.195':445
'<LOCALNET>.5.195':135
'<LOCALNET>.5.194':445
'<LOCALNET>.5.194':135
'<LOCALNET>.5.193':445
'<LOCALNET>.5.193':135
'<LOCALNET>.5.199':445
'<LOCALNET>.5.223':445
'<LOCALNET>.5.192':445
'<LOCALNET>.5.206':445
'<LOCALNET>.5.222':445
'<LOCALNET>.5.222':135
'<LOCALNET>.5.221':445
'<LOCALNET>.5.221':135
'<LOCALNET>.5.220':445
'<LOCALNET>.5.220':135
'<LOCALNET>.5.219':445
'<LOCALNET>.5.219':135
'<LOCALNET>.5.218':445
'<LOCALNET>.5.218':135
'<LOCALNET>.5.217':445
'<LOCALNET>.5.217':135
'<LOCALNET>.5.216':445
'<LOCALNET>.5.208':135
'<LOCALNET>.5.207':445
'<LOCALNET>.5.215':135
'<LOCALNET>.5.214':445
'<LOCALNET>.5.214':135
'<LOCALNET>.5.213':445
'<LOCALNET>.5.213':135
'<LOCALNET>.5.212':445
'<LOCALNET>.5.212':135
'<LOCALNET>.5.211':445
'<LOCALNET>.5.211':135
'<LOCALNET>.5.210':445
'<LOCALNET>.5.210':135
'<LOCALNET>.5.209':445
'<LOCALNET>.5.209':135
'<LOCALNET>.5.215':445
'<LOCALNET>.5.208':445
'<LOCALNET>.5.128':445
'<LOCALNET>.5.128':135
'<LOCALNET>.5.127':445
'<LOCALNET>.5.39':445
'<LOCALNET>.5.45':445
'<LOCALNET>.5.45':135
'<LOCALNET>.5.44':445
'<LOCALNET>.5.44':135
'<LOCALNET>.5.43':445
'<LOCALNET>.5.43':135
'<LOCALNET>.5.42':445
'<LOCALNET>.5.42':135
'<LOCALNET>.5.41':445
'<LOCALNET>.5.41':135
'<LOCALNET>.5.40':445
'<LOCALNET>.5.40':135
'<LOCALNET>.5.23':135
'<LOCALNET>.5.46':445
'<LOCALNET>.5.32':135
'<LOCALNET>.5.38':135
'<LOCALNET>.5.37':445
'<LOCALNET>.5.37':135
'<LOCALNET>.5.36':445
'<LOCALNET>.5.36':135
'<LOCALNET>.5.35':445
'<LOCALNET>.5.35':135
'<LOCALNET>.5.34':445
'<LOCALNET>.5.34':135
'<LOCALNET>.5.33':445
'<LOCALNET>.5.33':135
'<LOCALNET>.5.32':445
'<LOCALNET>.5.38':445
'<LOCALNET>.5.39':135
'<LOCALNET>.5.47':135
'<LOCALNET>.5.55':135
'<LOCALNET>.5.55':445
'<LOCALNET>.5.61':445
'<LOCALNET>.5.61':135
'<LOCALNET>.5.60':445
'<LOCALNET>.5.60':135
'<LOCALNET>.5.59':445
'<LOCALNET>.5.59':135
'<LOCALNET>.5.58':445
'<LOCALNET>.5.58':135
'<LOCALNET>.5.57':445
'<LOCALNET>.5.57':135
'<LOCALNET>.5.56':445
'<LOCALNET>.5.56':135
'<LOCALNET>.5.62':135
'<LOCALNET>.5.47':445
'<LOCALNET>.5.48':135
'<LOCALNET>.5.54':135
'<LOCALNET>.5.53':445
'<LOCALNET>.5.53':135
'<LOCALNET>.5.52':445
'<LOCALNET>.5.52':135
'<LOCALNET>.5.51':445
'<LOCALNET>.5.51':135
'<LOCALNET>.5.50':445
'<LOCALNET>.5.50':135
'<LOCALNET>.5.49':445
'<LOCALNET>.5.49':135
'<LOCALNET>.5.48':445
'<LOCALNET>.5.54':445
'<LOCALNET>.5.255':135
'<LOCALNET>.5.62':445
'<LOCALNET>.5.30':445
'<LOCALNET>.5.7':135
'<LOCALNET>.5.13':445
'<LOCALNET>.5.13':135
'<LOCALNET>.5.12':445
'<LOCALNET>.5.12':135
'<LOCALNET>.5.11':445
'<LOCALNET>.5.11':135
'<LOCALNET>.5.10':445
'<LOCALNET>.5.10':135
'<LOCALNET>.5.9':445
'<LOCALNET>.5.9':135
'<LOCALNET>.5.8':445
'<LOCALNET>.5.8':135
'<LOCALNET>.5.31':135
'<LOCALNET>.5.14':445
'<LOCALNET>.5.6':445
'<LOCALNET>.5.6':135
'<LOCALNET>.5.5':445
'<LOCALNET>.5.5':135
'<LOCALNET>.5.4':445
'<LOCALNET>.5.4':135
'<LOCALNET>.5.3':445
'<LOCALNET>.5.3':135
'<LOCALNET>.5.2':445
'<LOCALNET>.5.2':135
'<LOCALNET>.5.1':445
'<LOCALNET>.5.1':135
'<LOCALNET>.5.0':445
'<LOCALNET>.5.7':445
'<LOCALNET>.5.31':445
'<LOCALNET>.5.15':135
'<LOCALNET>.5.16':445
'<LOCALNET>.5.15':445
'<LOCALNET>.5.30':135
'<LOCALNET>.5.29':445
'<LOCALNET>.5.29':135
'<LOCALNET>.5.28':445
'<LOCALNET>.5.28':135
'<LOCALNET>.5.27':445
'<LOCALNET>.5.27':135
'<LOCALNET>.5.26':445
'<LOCALNET>.5.26':135
'<LOCALNET>.5.25':445
'<LOCALNET>.5.25':135
'<LOCALNET>.5.24':445
'<LOCALNET>.5.16':135
'<LOCALNET>.5.24':135
'<LOCALNET>.5.14':135
'<LOCALNET>.5.22':445
'<LOCALNET>.5.22':135
'<LOCALNET>.5.21':445
'<LOCALNET>.5.21':135
'<LOCALNET>.5.20':445
'<LOCALNET>.5.20':135
'<LOCALNET>.5.19':445
'<LOCALNET>.5.19':135
'<LOCALNET>.5.18':445
'<LOCALNET>.5.18':135
'<LOCALNET>.5.17':445
'<LOCALNET>.5.17':135
'<LOCALNET>.5.23':445
'<LOCALNET>.5.248':135
'<LOCALNET>.5.63':135
'<LOCALNET>.5.64':445
'<LOCALNET>.5.111':445
'<LOCALNET>.5.111':135
'<LOCALNET>.5.110':445
'<LOCALNET>.5.110':135
'<LOCALNET>.5.109':445
'<LOCALNET>.5.109':135
'<LOCALNET>.5.108':445
'<LOCALNET>.5.108':135
'<LOCALNET>.5.107':445
'<LOCALNET>.5.107':135
'<LOCALNET>.5.106':445
'<LOCALNET>.5.106':135
'<LOCALNET>.5.105':445
'<LOCALNET>.5.63':445
'<LOCALNET>.5.105':135
'<LOCALNET>.5.104':135
'<LOCALNET>.5.103':445
'<LOCALNET>.5.103':135
'<LOCALNET>.5.102':445
'<LOCALNET>.5.102':135
'<LOCALNET>.5.101':445
'<LOCALNET>.5.101':135
'<LOCALNET>.5.100':445
'<LOCALNET>.5.100':135
'<LOCALNET>.5.99':445
'<LOCALNET>.5.99':135
'<LOCALNET>.5.98':445
'<LOCALNET>.5.98':135
'<LOCALNET>.5.104':445
'<LOCALNET>.5.97':445
'<LOCALNET>.5.97':135
'<LOCALNET>.5.113':445
'<LOCALNET>.5.112':445
'<LOCALNET>.5.127':135
'<LOCALNET>.5.126':445
'<LOCALNET>.5.126':135
'<LOCALNET>.5.125':445
'<LOCALNET>.5.125':135
'<LOCALNET>.5.124':445
'<LOCALNET>.5.124':135
'<LOCALNET>.5.123':445
'<LOCALNET>.5.123':135
'<LOCALNET>.5.122':445
'<LOCALNET>.5.122':135
'<LOCALNET>.5.121':445
'<LOCALNET>.5.113':135
'<LOCALNET>.5.121':135
'<LOCALNET>.5.112':135
'<LOCALNET>.5.119':445
'<LOCALNET>.5.119':135
'<LOCALNET>.5.118':445
'<LOCALNET>.5.118':135
'<LOCALNET>.5.117':445
'<LOCALNET>.5.117':135
'<LOCALNET>.5.116':445
'<LOCALNET>.5.116':135
'<LOCALNET>.5.115':445
'<LOCALNET>.5.115':135
'<LOCALNET>.5.114':445
'<LOCALNET>.5.114':135
'<LOCALNET>.5.120':445
'<LOCALNET>.5.64':135
'<LOCALNET>.5.120':135
'<LOCALNET>.5.46':135
'<LOCALNET>.5.79':445
'<LOCALNET>.5.79':135
'<LOCALNET>.5.77':445
'<LOCALNET>.5.77':135
'<LOCALNET>.5.76':445
'<LOCALNET>.5.76':135
'<LOCALNET>.5.75':445
'<LOCALNET>.5.75':135
'<LOCALNET>.5.74':445
'<LOCALNET>.5.74':135
'<LOCALNET>.5.73':445
'<LOCALNET>.5.73':135
'<LOCALNET>.5.72':445
'<LOCALNET>.5.95':445
'<LOCALNET>.5.72':135
'<LOCALNET>.5.71':135
'<LOCALNET>.5.70':445
'<LOCALNET>.5.70':135
'<LOCALNET>.5.69':445
'<LOCALNET>.5.69':135
'<LOCALNET>.5.68':445
'<LOCALNET>.5.68':135
'<LOCALNET>.5.67':445
'<LOCALNET>.5.67':135
'<LOCALNET>.5.66':445
'<LOCALNET>.5.66':135
'<LOCALNET>.5.65':445
'<LOCALNET>.5.65':135
'<LOCALNET>.5.71':445
'<LOCALNET>.5.96':445
'<LOCALNET>.5.96':135
'<LOCALNET>.5.81':445
'<LOCALNET>.5.80':445
'<LOCALNET>.5.95':135
'<LOCALNET>.5.94':445
'<LOCALNET>.5.94':135
'<LOCALNET>.5.93':445
'<LOCALNET>.5.93':135
'<LOCALNET>.5.92':445
'<LOCALNET>.5.92':135
'<LOCALNET>.5.91':445
'<LOCALNET>.5.91':135
'<LOCALNET>.5.90':445
'<LOCALNET>.5.90':135
'<LOCALNET>.5.89':445
'<LOCALNET>.5.81':135
'<LOCALNET>.5.89':135
'<LOCALNET>.5.80':135
'<LOCALNET>.5.87':445
'<LOCALNET>.5.87':135
'<LOCALNET>.5.86':445
'<LOCALNET>.5.86':135
'<LOCALNET>.5.85':445
'<LOCALNET>.5.85':135
'<LOCALNET>.5.84':445
'<LOCALNET>.5.84':135
'<LOCALNET>.5.83':445
'<LOCALNET>.5.83':135
'<LOCALNET>.5.82':445
'<LOCALNET>.5.82':135
'<LOCALNET>.5.88':445
'<LOCALNET>.5.255':445

Miscellaneous

Creates and executes the following

'%APPDATA%\sharpsvn project\advanced sharpsvn\sharpsvn.exe'
'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial