Trojan.Encoder.38014

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\dshca

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\PROCEXP152] 'ImagePath' = '<DRIVERS>\PROCEXP152.SYS'

Creates the following services

'PROCEXP152' <DRIVERS>\PROCEXP152.SYS

Creates the following files on removable media

<Drive name for removable media>:\#readme_ann#.rtf
<Drive name for removable media>:\disclosuredetails.xlsx
<Drive name for removable media>:\contractualdeadlines.zip
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\about.html
<Drive name for removable media>:\systisoft.pem
<Drive name for removable media>:\productos.zip
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\dag2_panel1_320_ref.mov
<Drive name for removable media>:\block.png

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

deletes volume shadow copies.

Reads files which store third party applications passwords

%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

<Current directory>\nwaixkr3.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\js\nls\ja-jp\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\js\plugins\rhp\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\js\nls\ca-es\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\js\nls\hu-hu\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\js\nls\ru-ru\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\css\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\js\nls\en-gb\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\ja-jp\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\js\nls\sv-se\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\js\nls\de-de\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\js\nls\hr-hr\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\js\nls\root\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\js\nls\zh-tw\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\en-gb\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\sl-si\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\css\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\js\nls\ca-es\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\js\nls\fr-fr\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\desktop-connector-files\js\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\app\dev\nls\da-dk\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\app\dev\nls\hr-hr\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\app\dev\nls\root\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\app-api\dev\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\eu-es\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\core\dev\nls\nl-nl\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\js\nls\pt-br\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\en-gb\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\tracker\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\sl-si\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\js\nls\fi-fi\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\js\nls\pl-pl\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\js\nls\uk-ua\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\js\nls\fr-fr\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\js\plugins\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\js\nls\de-de\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\js\nls\sv-se\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\css\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\js\nls\zh-cn\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\css\#readme_ann#.rtf
%ProgramFiles(x86)%\opera\29.0.1795.47\localization\#readme_ann#.rtf
%ProgramFiles(x86)%\opera\assets\#readme_ann#.rtf
%ProgramFiles(x86)%\steam\public\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\queries\#readme_ann#.rtf
%ProgramFiles%\microsoft office\templates\1033\access\datatype\#readme_ann#.rtf
%ProgramFiles%\microsoft office\templates\1033\access\part\#readme_ann#.rtf
%ProgramFiles%\microsoft office\templates\1033\access\wss\#readme_ann#.rtf
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\#readme_ann#.rtf
%ProgramFiles%\mozilla firefox\browser\features\#readme_ann#.rtf
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\#readme_ann#.rtf
%ProgramFiles%\mozilla thunderbird\defaults\messenger\#readme_ann#.rtf
%ProgramFiles%\winrar\#readme_ann#.rtf
%ALLUSERSPROFILE%\microsoft help\#readme_ann#.rtf
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\#readme_ann#.rtf
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\#readme_ann#.rtf
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\#readme_ann#.rtf
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\#readme_ann#.rtf
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\#readme_ann#.rtf
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\#readme_ann#.rtf
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\#readme_ann#.rtf
C:\users\public\videos\sample videos\#readme_ann#.rtf
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\#readme_ann#.rtf
%ProgramFiles(x86)%\opera\29.0.1795.47\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\js\nls\fi-fi\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\js\nls\pl-pl\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\js\nls\uk-ua\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\css\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\js\nls\ja-jp\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\css\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\js\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\js\nls\fi-fi\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files\js\nls\en-il\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files\js\nls\sv-se\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\js\nls\pt-br\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform\pmp\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\#readme_ann#.rtf
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\#readme_ann#.rtf
%ALLUSERSPROFILE%\microsoft\rac\statedata\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\#readme_ann#.rtf
%ProgramFiles%\java\jre1.8.0_45\lib\#readme_ann#.rtf
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\#readme_ann#.rtf
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\#readme_ann#.rtf
%ProgramFiles%\java\jre1.8.0_45\lib\ext\#readme_ann#.rtf
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\#readme_ann#.rtf
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\#readme_ann#.rtf
%ProgramFiles%\java\jre1.8.0_45\lib\security\#readme_ann#.rtf
%ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\#readme_ann#.rtf
C:\users\public\pictures\sample pictures\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\#readme_ann#.rtf
<Current directory>\pogvpyul.txt
%APPDATA%\e8twwqjg.bmp
%APPDATA%\1x12flwj.bat
%APPDATA%\kpq2vnjs.vbs
<Current directory>\o5ytnmck.exe
<Current directory>\d1yiub2f.bat
<Current directory>\bad_4d9cc4425af00cc4.txt
<Current directory>\elog_4d9cc4425af00cc4.txt
%ProgramFiles%\microsoft office\office14\1033\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\1033\quickstyles\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\dummy\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\document parts\1033\14\#readme_ann#.rtf
%ProgramFiles%\java\jre1.8.0_45\#readme_ann#.rtf
%ProgramFiles%\microsoft office\templates\1033\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\samples\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\#readme_ann#.rtf
%ProgramFiles%\microsoft office\clipart\pub60cor\#readme_ann#.rtf
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\#readme_ann#.rtf
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\#readme_ann#.rtf
%ProgramFiles%\microsoft office\media\cagcat10\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\toolbmps\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\#readme_ann#.rtf
%HOMEPATH%\desktop\#readme_ann#.rtf
<Current directory>\176.100.243.133_log.txt
%ProgramFiles%\microsoft office\templates\1033\fax\#readme_ann#.rtf
%ProgramFiles%\microsoft office\stationery\1033\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\sounds\things\#readme_ann#.rtf
%TEMP%\o5ytnmck64.exe
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\media\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\onenote\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\outlookautodiscover\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\pagesize\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\proof\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\pubba\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\pubwiz\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\#readme_ann#.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\xml files\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\library\#readme_ann#.rtf
%ProgramFiles%\mozilla thunderbird\isp\#readme_ann#.rtf
%HOMEPATH%\favorites\links for united states\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\forms\1033\#readme_ann#.rtf
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\#readme_ann#.rtf
%ProgramFiles%\microsoft office\document themes 14\#readme_ann#.rtf
%ProgramFiles%\microsoft office\document themes 14\theme colors\#readme_ann#.rtf
%ProgramFiles%\microsoft office\document themes 14\theme effects\#readme_ann#.rtf
%ProgramFiles%\microsoft office\document themes 14\theme fonts\#readme_ann#.rtf
%ProgramFiles%\microsoft office\media\office14\autoshap\#readme_ann#.rtf
%ProgramFiles%\microsoft office\media\office14\bullets\#readme_ann#.rtf
%ProgramFiles%\microsoft office\media\office14\lines\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\servers\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\groove\sounds\people\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\1033\pubftscm\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\1033\pubspapr\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\accwiz\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\bibliography\sort\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\bibliography\style\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\borders\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\convert\#readme_ann#.rtf
%ProgramFiles%\microsoft office\office14\convert\1033\#readme_ann#.rtf
<DRIVERS>\procexp152.sys
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\#readme_ann#.rtf
%HOMEPATH%\favorites\msn websites\#readme_ann#.rtf

Deletes the following files

<Current directory>\pogvpyul.txt
<DRIVERS>\procexp152.sys
%APPDATA%\kpq2vnjs.vbs
<SYSTEM32>\tasks\dshca

Moves the following files

from %ProgramFiles%\microsoft office\office14\1033\prottpln.xls to %ProgramFiles%\microsoft office\office14\1033\[askhelp@protonmail.com].7tbawrhs-3t3noclr.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\radio.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].8zld3rg5-srv6svwn.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0390072.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].swmrikt8-wku2gyis.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099166.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].pzrhiqzc-yqzoirve.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\date.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].k4fcrpl1-awsrwrkn.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0386267.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].xfhqcbwv-38bcn1yt.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099150.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].yvgtq8zo-kou0hmky.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\inactivetabimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\[askhelp@protonmail.com].lnrzczjx-mchrzktx.ann
from %ProgramFiles%\microsoft office\templates\1033\originreport.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].vhi2hmya-2j3bybyz.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\addtoviewarrow.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\[askhelp@protonmail.com].3xdejgrr-n3m477f4.ann
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\words.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\[askhelp@protonmail.com].sivbushp-pstdsplo.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].evujmkb5-ifa79vqu.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382955.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].ulek7x4j-eldadv2v.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_auto.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].oxfzve0m-y83pg6br.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382931.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].bhw4ktjc-vccu0qrw.ann
from %ProgramFiles%\microsoft office\stationery\1033\notebook.jpg to %ProgramFiles%\microsoft office\stationery\1033\[askhelp@protonmail.com].gqcqsip2-uglzpkav.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382967.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].bhmcmikp-8ftjxjib.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341475.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].zdanxrgx-2e2lxly2.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph03379i.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].0wua1izy-v862wjqd.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\contact.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].lvog31pi-lu3bmdby.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341557.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].julajk89-d1czt4xe.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341344.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].iuc2encc-af2vlu2m.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0313896.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].slm9f1mt-q875cytf.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0287643.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].wice2d0m-hmrtnbl9.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0178932.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].a7ugyyke-kftnwibu.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0175361.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].arei1xgl-umxbb78w.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\spacebackupicons.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].yoxio4ey-tk5ldyvj.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02412k.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].iak60jc4-cdjspktl.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0144773.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].z8ysvtrf-kfdelkm1.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].arpyzrq4-gqsbgmvf.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\calendarviewbuttonimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\[askhelp@protonmail.com].zuvyerbj-t4oekvhg.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\shared16x16images.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].4hlolyeg-rlu9tpsz.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierbackgroundrtl.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].nkgbm1fa-tgcpi5vz.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\zoomicons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\[askhelp@protonmail.com].nwzyetgs-yollw315.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\dataviewiconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].3m1ywgqy-t2fvom8t.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\activetabimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\[askhelp@protonmail.com].z09wbfsn-wnhpaqic.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\briefcaseicon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\[askhelp@protonmail.com].muxmng4d-qyv1ojvt.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\meetingicon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\[askhelp@protonmail.com].kdkvainv-preeacyp.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdisabledownarrow.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].l1spqpeo-5m2idwci.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formtoolimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\[askhelp@protonmail.com].pc3p77tb-elmjso9w.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382969.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].kjfs1inl-rw9kw4de.ann
from %ProgramFiles%\microsoft office\templates\1033\medianresume.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].elcoebln-el2ibpre.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0216153.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].uqukgbza-mjn0dxzt.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph01179j.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].wnp3y0co-f0u9wnei.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382944.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].zhfsmrpp-ywtu6sno.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0386485.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].lflbgr7o-o0vohagh.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0178459.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].mzwvg5nx-d6nfesm6.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\numeric.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].grwxpztb-hxvb3uqd.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02759j.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].uz5unuzs-xoqmrmir.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0148798.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].hdwxiom7-mr7nhhnn.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341554.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].nqdlrcnb-crezeoey.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0145373.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].xnqftxzn-flqmnvpl.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341328.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].lvpoph0a-9vjvy4md.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382958.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].xjlh95nm-qszukabk.ann
from %ProgramFiles%\microsoft office\templates\1033\executiveresume.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].tyxznexy-ktbe4qro.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382939.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].caaqrvhh-zpssi3f0.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341742.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].bj1avcvr-d0yg17uv.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0145895.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].uacg0gwb-s2gxlwsz.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0309567.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].7l5idkml-9th5ee2m.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph01221k.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].cee3qiwo-rny6h4fy.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0384862.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].ob2h0gjp-2dw6oyft.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\statictext.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].j8pdw6sy-eq9mtuwy.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\digitalink.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].mmvcnwlc-mftuwmza.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341645.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].lve1sh7p-00n7tzen.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\addtoviewarrow.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\[askhelp@protonmail.com].pkzwc3zf-58tdr47p.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\form_statusimage.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].6ox4iytp-1ntqwnor.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\messageboxiconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].q3wseq2v-fhmznuhc.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0387337.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].oe5wlq5j-srlhquoq.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contactlow.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].gz0t6wta-yty27kk5.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382960.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].vyg6o9be-vs0bxy8o.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdownarrow.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].n1xu8b06-qf7v6afp.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\informationicon.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].p76jr7rj-kpi7ba5x.ann
from %ProgramFiles%\microsoft office\media\cagcat10\j0302827.jpg to %ProgramFiles%\microsoft office\media\cagcat10\[askhelp@protonmail.com].hqobvi6u-jr3jppu1.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0315580.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].j0ovdbwl-sjt9uzg1.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02829j.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].7eexaxfs-kmwbdj36.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph03425i.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].8utwvh8y-wzp42bdh.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\tipsimage.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].po8yukrw-pskfzikd.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formtoolimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\[askhelp@protonmail.com].ayve01q8-tvmbq5lz.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\formsviewattachmenticons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\[askhelp@protonmail.com].kunmujr6-1qlw35io.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\tabon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\[askhelp@protonmail.com].scjwiive-m1uteiy7.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\textview.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].xtrqp4t8-afkukdgg.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\image.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].esvwvnzd-k846sxhk.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\button.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].zkd1ompy-wx6txnr0.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\computericon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\[askhelp@protonmail.com].uh6ewrcd-sptn0wkj.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_high.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].xj0k6tx5-rudf6lj9.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\webtoolimages16x16.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].igoksxlb-xvndsyuv.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\outofsynciconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].lxud6mam-ulrlsh0o.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsviewattachmenticons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\[askhelp@protonmail.com].iii92jrs-q9pufcjs.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\messageattachmenticonimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].w9qycjwe-wphwet07.ann
from %ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar to %ProgramFiles%\java\jre1.8.0_45\lib\[askhelp@protonmail.com].br7onhjo-fjvfxltr.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph03143i.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].5290rkyk-sqaqz1g5.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02028k.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].mgkvtti8-twzmwis7.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0387604.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].xuldmqmj-tc0ohaxf.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0384895.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].buvtbtmd-qgikqxam.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382963.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].gtybuuuv-mbtwo30r.ann
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\[askhelp@protonmail.com].9fryqxic-hnemgyrh.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\calendartooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].aixevkcp-ohaay5lb.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].27ugupcv-t8aoocob.ann
from %ProgramFiles%\microsoft office\templates\1033\equityreport.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].gbjnmnlm-34s58zfy.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\dataset.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[askhelp@protonmail.com].agbpxgec-tgfrdra7.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\mdiparent.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[askhelp@protonmail.com].ajfeucuj-p7w5sg8t.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfig.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[askhelp@protonmail.com].qlwymelr-ddzvyfdb.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099186.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].dwpqil0r-s0blcgro.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04134_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].b1acvvoe-qn9xomzg.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099156.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].qm9rirer-fblyzza2.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01216_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].srx6vz2k-uac3mnf1.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\an00914_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].hzbyt886-vqwmnef4.ann
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansdemibold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\[askhelp@protonmail.com].amfpfoix-br00drpu.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].hmrxglrv-wazth1ea.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].opmacy07-ch0aafbs.ann
from %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\[askhelp@protonmail.com].0zvticrf-uspsmjna.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\form.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[askhelp@protonmail.com].jqw6gbqq-qynbixn9.ann
from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_45\[askhelp@protonmail.com].akmberuw-mtpqnlkm.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\usercontrol.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[askhelp@protonmail.com].sn1rs9qn-seidp4zl.ann
from %ProgramFiles%\java\jre1.8.0_45\lib\security\javaws.policy to %ProgramFiles%\java\jre1.8.0_45\lib\security\[askhelp@protonmail.com].4caniykp-rpkh7tmb.ann
from %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar to %ProgramFiles%\java\jre1.8.0_45\lib\[askhelp@protonmail.com].lpjai1pe-siglopes.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttoolseticonimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\[askhelp@protonmail.com].z1pvtzbq-tzmegnrf.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0182689.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].zahel9fy-745sgewr.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382950.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].k8dohjsi-9r9moaoq.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0177257.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].j8r6svto-pwohyrtu.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\logindialogbackground.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].nhhujcvu-hcb0nntf.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0145212.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].zkvtt9jq-jpky7k5w.ann
from %ProgramFiles%\microsoft office\media\cagcat10\j0302953.jpg to %ProgramFiles%\microsoft office\media\cagcat10\[askhelp@protonmail.com].cnmw5ywi-oknvis5o.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099168.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].dwvdrwb5-h1xqgink.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099154.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].zbeuxlen-zvrecvmy.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02897j.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].yx4cvkz6-upmgmslg.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph01239k.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].zgtjvm79-fbwi2pcd.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0146142.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].q5cfhthr-jhru6xih.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0387578.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].qdksdiqz-ivn1wgu4.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382961.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].b81iuxgv-bxex3kat.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\splashscreen.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[askhelp@protonmail.com].lkbn3yqp-qnnoufih.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382947.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].8ii7cixp-jozjzt9s.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dataset.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[askhelp@protonmail.com].2x5srb7n-nwmesriw.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382836.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].qpncynuc-yytpkucp.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resourceinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[askhelp@protonmail.com].x1pkjzv5-ysmebrjg.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfo.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[askhelp@protonmail.com].2qgbiire-rkrenhxp.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0384885.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].tj76lpte-ibivefqd.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\assemblyinfointernal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[askhelp@protonmail.com].f2v2dj2a-ap9x2wvb.ann
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\[askhelp@protonmail.com].eojanf6d-z75cnjf2.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\verisignlogo.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].xsodrqfh-z5n32rma.ann
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\[askhelp@protonmail.com].ebl4p0bl-rdzyoxwa.ann
from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\[askhelp@protonmail.com].5yup91yl-ajfoyo9c.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382926.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].ez7mo8tw-2npy5kfa.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341561.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].potopi3y-mbm3vvzq.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341447.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].pkiga3gg-rezhpvxe.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0313970.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].avaunphh-mrejtxvk.ann
from %ProgramFiles%\microsoft office\stationery\1033\pinelumb.jpg to %ProgramFiles%\microsoft office\stationery\1033\[askhelp@protonmail.com].b9tgdrhv-lvkl37ya.ann
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\[askhelp@protonmail.com].bdnvlp7r-fitn4rrl.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0287645.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].jhhadhjq-r5pylfsi.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projectstatusicons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\[askhelp@protonmail.com].elaanb5w-rfjq63up.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\viewheaderpreview.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\[askhelp@protonmail.com].tzitgyoi-axlgrl9j.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\textarea.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].8utfhq3y-4htniz4x.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\embeddedview.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].ls7ctkyx-bjceqigo.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\attachments.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].kydtptz3-vhecxaez.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadicon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].rci3qshx-qpxotfu5.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_filehigh.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].vzae7uwn-pfcm8lsg.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifieruparrow.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].nrojarjm-lvnhrd5s.ann
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\[askhelp@protonmail.com].enio1piq-gywq5x7p.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099187.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].vsgrdflj-cdfqiusi.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099165.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].lboksuue-queykadg.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\logintool24x24images.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].lknbiyc0-jypgx0qi.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0202045.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].8vb1gckz-dzdcejd3.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0177806.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].64vio9ia-dkdcxmd6.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0148309.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].jjk6xknk-lyre33a4.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0145272.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].o5humvr1-oy686ips.ann
from %ProgramFiles%\microsoft office\templates\1033\executivereport.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].v4jxbogt-5yqezd3e.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099185.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].mtiwdy0b-sfoyxfgy.ann
from %ProgramFiles%\microsoft office\media\cagcat10\j0315447.jpg to %ProgramFiles%\microsoft office\media\cagcat10\[askhelp@protonmail.com].labfkppq-b9dyfwdq.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\outlinetooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].bapqczgt-sgs8qpte.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph03041i.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].wsurhpjl-qbvskc0b.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph01931j.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].jbgldxah-u6ad5ry9.ann
from %ProgramFiles%\microsoft office\templates\1033\equitymergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].gkaoh9zf-a4e9wfxq.ann
from %ProgramFiles%\microsoft office\templates\1033\apothecarymergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].wr0agzwx-jmzfp9um.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0387591.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].uepi0f3u-akydd8qm.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\perspective.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].kromaq0n-cnaihrl4.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099155.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].ra7xki5y-0llme17x.ann
from %ProgramFiles%\microsoft office\templates\1033\fax\originfax.dotx to %ProgramFiles%\microsoft office\templates\1033\fax\[askhelp@protonmail.com].w6ei8bch-rhubbyqg.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0313974.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].lxafvzfu-iejpgtll.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\textbox.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].ry3krx7q-8iwcwjlm.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\heading.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].6aivclmv-wirbwn7o.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\break.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].ojgimwy4-iqivpooq.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0384900.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].sspqh5u2-sgxny4al.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadiconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].3eiplklj-y5qlxiqa.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382965.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].wjb7m70x-cj1wmndk.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382952.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].2ro3uw69-rqjykwsc.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0384888.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].fpjllkzy-xtb57spz.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0289430.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].6goybabj-93s61zoh.ann
from %ProgramFiles%\microsoft office\office14\1033\prottplv.doc to %ProgramFiles%\microsoft office\office14\1033\[askhelp@protonmail.com].f5tjnjhc-tesxqhjz.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_fileoff.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].ti065r87-argqeu21.ann
from %ProgramFiles%\microsoft office\templates\1033\originmergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].nd2mipst-jrcf45kd.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382927.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].ng0cx5fb-fjucurvv.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\webtooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].gj6hkbf2-uix7mosh.ann
from %ProgramFiles%\microsoft office\templates\1033\medianreport.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].xdbwz020-v0gu6e1k.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341634.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].3npu9wio-ocabytst.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\distinctive.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].j3wqrcuv-tpthbu8l.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341448.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].jhw4npcl-9qdz5l3y.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\classic.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].pmbwa6mr-zljz6syl.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382962.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].bsx2sg24-uclj8opf.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382948.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].n304sy8b-od1ip1s3.ann
from %ProgramFiles%\microsoft office\office14\1033\prottplv.xls to %ProgramFiles%\microsoft office\office14\1033\[askhelp@protonmail.com].3o8uxnip-sxqatfyr.ann
from %ProgramFiles%\microsoft office\templates\1033\essentialresume.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].cwdlgwqf-pww0z2sf.ann
from %ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].5f3427et-ewvhgkvk.ann
from %ProgramFiles%\microsoft office\templates\1033\adjacencymergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].0yzh5bty-n6mgxwta.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\formal.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].osx6xnt4-eut4eopm.ann
from %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls to %ProgramFiles%\microsoft office\office14\samples\[askhelp@protonmail.com].wbbf8t1j-nqexa9ap.ann
from %ProgramFiles%\microsoft office\templates\1033\adjacencyletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].2vsc3vhv-grud8egg.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\addtoviewarrow.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\[askhelp@protonmail.com].ji3ilckt-acsblifr.ann
from %ProgramFiles%\microsoft office\templates\1033\orielreport.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].nwd54nvc-tt0ygyzl.ann
from %ProgramFiles%\microsoft office\templates\1033\urbanmergefax.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].qfbyjuym-hthzzzie.ann
from %ProgramFiles%\microsoft office\templates\1033\orielmergefax.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].rxenbyqq-oi17acnh.ann
from %ProgramFiles%\microsoft office\templates\1033\fax\orielfax.dotx to %ProgramFiles%\microsoft office\templates\1033\fax\[askhelp@protonmail.com].qm5ocnbv-g0j0enad.ann
from %ProgramFiles%\microsoft office\templates\1033\essentialmergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].t8mrxtyu-us64sajl.ann
from %ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].hyr75tzd-dgbzdtzr.ann
from %ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx to %ProgramFiles%\microsoft office\office14\document parts\1033\14\[askhelp@protonmail.com].duqnhscj-eafbbt6j.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\elegant.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].3lmbz93j-mnqdqyyp.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\fancy.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].mbndeoun-rqjzryte.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\traditional.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].ukry7es7-abm6uayw.ann
from %ProgramFiles%\microsoft office\templates\1033\urbanreport.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].bwrquudn-3jpdhbsq.ann
from %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].avuyb6kg-m9imssup.ann
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[askhelp@protonmail.com].fdc6oso1-nbve0bej.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0382925.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].nhdof43g-zoeyixgt.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341559.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].dnhnm9f1-wfns7yun.ann
from %ProgramFiles%\microsoft office\templates\1033\urbanmergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].jqchkmko-jushrxdl.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341439.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].istm739d-jayxjsta.ann
from %ProgramFiles%\microsoft office\templates\1033\orielmergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].dsakcyju-mdkqntc1.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0313965.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].esn9hbbs-wr6vampc.ann
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\enutxt.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\[askhelp@protonmail.com].ttrtrsd3-lgel3exg.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0287644.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].9szdhmgl-ria3qsgw.ann
from %ProgramFiles%\microsoft office\templates\1033\fax\urbanfax.dotx to %ProgramFiles%\microsoft office\templates\1033\fax\[askhelp@protonmail.com].dszsuklg-ufnmlobq.ann
from %ProgramFiles%\microsoft office\templates\1033\essentialreport.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].zgjndeng-06mwj9qy.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0175428.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].i8ookapp-wws0eegq.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0145904.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].gs8zgt4e-2ihqm7mo.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0145168.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].qodi0kci-pqntoziw.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099167.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].kfxyvyyf-dy4wqzty.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099152.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].6ixouxiu-wshtfsab.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0179963.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].uhwgdtnz-1tlsavua.ann
from %ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].dkdrymkk-lyvhjxwu.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttaskicon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\[askhelp@protonmail.com].ig1euupq-z9ojqqun.ann
from %ProgramFiles%\microsoft office\stationery\1033\seamarbl.jpg to %ProgramFiles%\microsoft office\stationery\1033\[askhelp@protonmail.com].bfou0ow4-lvowe9jx.ann
from %ProgramFiles%\microsoft office\templates\1033\equitymergefax.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].1zpq4c9r-bewuwt2x.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099148.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].fjsy8r4n-o0acj7sn.ann
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\standardbusiness.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\[askhelp@protonmail.com].3bquyf7r-52u9n4ac.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0145707.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].iz1r9bjf-pp81c25u.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099189.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].ldrn3r8i-hxrc7nko.ann
from %ProgramFiles%\microsoft office\templates\1033\apothecaryletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].u3ay6pwi-kyxqmimd.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\newsprint.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].zdsjvnnt-trouuvxe.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0149118.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].8tc6ewzo-2mpqywkl.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099161.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].3vbm2ntm-pjjkbyfz.ann
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\dynamic.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\[askhelp@protonmail.com].8hdjotyi-npynrk7e.ann
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\adobeid.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\[askhelp@protonmail.com].aai0zxyf-reefb9fw.ann
from %ProgramFiles%\microsoft office\templates\1033\urbanresume.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].scn1dyil-1kj2akgc.ann
from %ProgramFiles%\microsoft office\templates\1033\orielresume.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].vdjfsz2v-zaaeteez.ann
from %ProgramFiles%\microsoft office\templates\1033\medianletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].gecz9o6v-ld0hggzv.ann
from %ProgramFiles%\microsoft office\templates\1033\executiveletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].xfvsoxdf-kcqfygxl.ann
from %ProgramFiles%\microsoft office\templates\1033\blog.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].ntsdvxlm-5km949xg.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099145.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].nrviqqrs-jbioqxm7.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0321179.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].dmdmwzct-bemomy8e.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0309705.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].jg3mqnj8-7qf4ilvs.ann
from %ProgramFiles%\microsoft office\templates\1033\executivenewsletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].jkmj8dwv-27k0vzms.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099157.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].lb7jdoz9-no9pmqqc.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0287642.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].0o2vrouu-kxalaolc.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0178639.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].xygu31t6-qqrjla5m.ann
from %ProgramFiles%\microsoft office\templates\1033\apothecarynewsletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].jr9ygcsv-acdmtz4k.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341534.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].djnxhrqu-l1sq8k9a.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0174952.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].lx6ln5uf-rwagsdfe.ann
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[askhelp@protonmail.com].fdmfcoac-mut5qbji.ann
from %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].hkdeepyx-t6cov9si.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\simple.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].n8pgs0ko-lyszfggm.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\default.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].bhczzdwy-lohxed5y.ann
from %ProgramFiles%\microsoft office\templates\1033\originmergefax.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].t7hlygnq-w1m6m9o2.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0145879.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].akq9lhpa-kysambfq.ann
from %ProgramFiles%\microsoft office\templates\1033\medianmergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].t8fohqiq-cepy9oya.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0309598.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].ta4kweho-ei2btdpq.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099191.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].qor8kuej-34qwprpe.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0227558.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].exholf9z-3lp5uiuv.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0178523.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].2ngu0m0z-tnjjsrs3.ann
from %ProgramFiles%\microsoft office\templates\1033\orielletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].5jeuqakf-kvfsyrq1.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\manuscript.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].cpqsrvjt-whxt2hni.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\defaultblackandwhite.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].nsjgrrje-mpma4zw1.ann
from %ProgramFiles%\microsoft office\templates\1033\medianmergefax.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].69eqnah6-yzhsoulq.ann
from %ProgramFiles%\microsoft office\templates\1033\fax\medianfax.dotx to %ProgramFiles%\microsoft office\templates\1033\fax\[askhelp@protonmail.com].tukam2fv-0gb0jeyf.ann
from %ProgramFiles%\microsoft office\templates\1033\executivemergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].ufqpvnfw-tkwescpg.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\messagehistoryiconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].a2tfugcj-fiqxo6rb.ann
from %ProgramFiles%\microsoft office\templates\1033\equityletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].dfjqslup-jtvxs4uy.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\usercontrol.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[askhelp@protonmail.com].dgm4imu4-skkxcdqy.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\emptydatabase.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[askhelp@protonmail.com].0ioug4wr-hi0l1st8.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\picturestooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].fxn2tsok-gkqollfb.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\createspaceimage.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].ghlec9wq-uikuhil4.ann
from %ProgramFiles%\microsoft office\templates\1033\essentialletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].03msusyx-mzej4ali.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\class.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[askhelp@protonmail.com].kvysj3pi-pnktd1a9.ann
from %ProgramFiles%\microsoft office\templates\1033\adjacencyresume.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].kzyzaro0-td9vd0lc.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph03205i.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].oziqr9bl-5okrwv7a.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02053j.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].xsf0bhuh-pqgmyaa4.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\modern.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].nbt7zi1q-czqzl2ly.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0387882.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].umgjjhbp-lyajfscb.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settingsinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[askhelp@protonmail.com].zsozacuk-9y2gllxd.ann
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0341654.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\[askhelp@protonmail.com].ycgrx5y5-1pigqntg.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\splashimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\[askhelp@protonmail.com].0pixcjvf-ndrnqz9n.ann
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\thatch.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\[askhelp@protonmail.com].qwkiwhzy-hkedg5io.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formtoolimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\[askhelp@protonmail.com].mgzpdtdk-030h4yek.ann
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\defaultid.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\[askhelp@protonmail.com].vkdwvcee-rqsvlrq8.ann
from %ProgramFiles%\microsoft office\templates\1033\originresume.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].ugxtezaj-zybpftz9.ann
from %ProgramFiles%\microsoft office\templates\1033\urbanletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].gbfps1tt-ayjteduw.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\unformattednumeric.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].vqtpy2tl-wctlwkip.ann
from %ProgramFiles%\microsoft office\templates\1033\office word 2003 look.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].65es6j5m-gsxuyeby.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\line.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].i1zh9yjs-dtzk5epf.ann
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\[askhelp@protonmail.com].cvyyam3k-cdmcqvdm.ann
from %ProgramFiles%\microsoft office\templates\1033\fax\equityfax.dotx to %ProgramFiles%\microsoft office\templates\1033\fax\[askhelp@protonmail.com].gtmtybcc-qyqyxfo6.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\checkbox.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\[askhelp@protonmail.com].fyinw7qc-qwfaath5.ann
from %ProgramFiles%\microsoft office\templates\1033\equityresume.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].6oay0edo-xblstorh.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\discussiontooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\[askhelp@protonmail.com].dpsbvlgv-vasmsrxg.ann
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_medium.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\[askhelp@protonmail.com].cgfipjip-2cq9fx5i.ann
from %ProgramFiles%\microsoft office\templates\1033\apothecaryresume.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].e8q3bdgs-nputpogy.ann
from %ProgramFiles%\microsoft office\templates\1033\originletter.dotx to %ProgramFiles%\microsoft office\templates\1033\[askhelp@protonmail.com].k0swzexm-tkuihezu.ann
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\wssfilestooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\[askhelp@protonmail.com].cdcplhql-lspneh35.ann
from %ProgramFiles%\microsoft office\office14\1033\prottpln.doc to %ProgramFiles%\microsoft office\office14\1033\[askhelp@protonmail.com].k2rmqn36-5pt0u6dk.ann
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\resourceinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[askhelp@protonmail.com].1lxmboza-f99gbzmo.ann

Modifies the following files

<Drive name for removable media>:\disclosuredetails.xlsx
%ProgramFiles%\microsoft office\templates\1033\essentialreport.dotx
%ProgramFiles%\microsoft office\templates\1033\urbanreport.dotx
%ProgramFiles%\microsoft office\templates\1033\orielreport.dotx
%ProgramFiles%\microsoft office\templates\1033\fax\urbanfax.dotx
%ProgramFiles%\microsoft office\templates\1033\essentialresume.dotx
%ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx
%ProgramFiles%\microsoft office\templates\1033\adjacencymergeletter.dotx
%ProgramFiles%\microsoft office\office14\1033\quickstyles\formal.dotx
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\sdszfo.docx
%ProgramFiles%\microsoft office\office14\samples\solvsamp.xls
%ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx
%ProgramFiles%\microsoft office\templates\1033\adjacencyletter.dotx
%ProgramFiles%\microsoft office\office14\1033\quickstyles\fancy.dotx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%ProgramFiles%\microsoft office\office14\1033\prottplv.xls
%ProgramFiles%\microsoft office\templates\1033\urbanmergefax.dotx
%ProgramFiles%\microsoft office\templates\1033\orielmergefax.dotx
%ProgramFiles%\microsoft office\templates\1033\fax\orielfax.dotx
%ProgramFiles%\microsoft office\templates\1033\essentialmergeletter.dotx
%ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx
%ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx
%ProgramFiles%\microsoft office\office14\1033\quickstyles\elegant.dotx
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%ProgramFiles%\microsoft office\office14\1033\prottpln.xls
%ProgramFiles%\microsoft office\templates\1033\fax\originfax.dotx
%ProgramFiles%\microsoft office\templates\1033\orielmergeletter.dotx

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Network activity

Connects to

'<LOCALNET>.21.15':445
'<LOCALNET>.21.126':445
'<LOCALNET>.21.122':139
'<LOCALNET>.21.124':445
'<LOCALNET>.21.120':139
'<LOCALNET>.21.125':445
'<LOCALNET>.21.119':139
'<LOCALNET>.21.123':445
'<LOCALNET>.21.121':139
'<LOCALNET>.21.127':445
'<LOCALNET>.21.123':139
'<LOCALNET>.21.121':445
'<LOCALNET>.21.118':139
'<LOCALNET>.21.120':445
'<LOCALNET>.21.114':139
'<LOCALNET>.21.119':445
'<LOCALNET>.21.116':139
'<LOCALNET>.21.118':445
'<LOCALNET>.21.115':139
'<LOCALNET>.21.122':445
'<LOCALNET>.21.104':445
'<LOCALNET>.21.125':139
'<LOCALNET>.21.134':139
'<LOCALNET>.21.135':445
'<LOCALNET>.21.133':139
'<LOCALNET>.21.137':445
'<LOCALNET>.21.132':139
'<LOCALNET>.21.136':445
'<LOCALNET>.21.131':139
'<LOCALNET>.21.134':445
'<LOCALNET>.21.133':445
'<LOCALNET>.21.131':445
'<LOCALNET>.21.132':445
'<LOCALNET>.21.130':139
'<LOCALNET>.21.129':139
'<LOCALNET>.21.128':139
'<LOCALNET>.21.127':139
'<LOCALNET>.21.130':445
'<LOCALNET>.21.126':139
'<LOCALNET>.21.129':445
'<LOCALNET>.21.124':139
'<LOCALNET>.21.117':445
'<LOCALNET>.21.117':139
'<LOCALNET>.21.112':139
'<LOCALNET>.21.116':445
'<LOCALNET>.21.111':139
'<LOCALNET>.21.98':445
'<LOCALNET>.21.103':445
'<LOCALNET>.21.98':139
'<LOCALNET>.21.102':445
'<LOCALNET>.21.100':139
'<LOCALNET>.21.101':445
'<LOCALNET>.21.95':139
'<LOCALNET>.21.99':445
'<LOCALNET>.21.97':139
'<LOCALNET>.21.96':139
'<LOCALNET>.21.105':445
'<LOCALNET>.21.100':445
'<LOCALNET>.21.94':139
'<LOCALNET>.21.97':445
'<LOCALNET>.21.92':139
'<LOCALNET>.21.95':445
'<LOCALNET>.21.93':139
'<LOCALNET>.21.96':445
'<LOCALNET>.21.91':139
'<LOCALNET>.21.138':445
'<LOCALNET>.21.128':445
'<LOCALNET>.21.99':139
'<LOCALNET>.21.106':445
'<LOCALNET>.21.101':139
'<LOCALNET>.21.115':445
'<LOCALNET>.21.113':139
'<LOCALNET>.21.114':445
'<LOCALNET>.21.110':139
'<LOCALNET>.21.113':445
'<LOCALNET>.21.108':139
'<LOCALNET>.21.112':445
'<LOCALNET>.21.107':139
'<LOCALNET>.21.111':445
'<LOCALNET>.21.109':139
'<LOCALNET>.21.110':445
'<LOCALNET>.21.106':139
'<LOCALNET>.21.108':445
'<LOCALNET>.21.104':139
'<LOCALNET>.21.107':445
'<LOCALNET>.21.105':139
'<LOCALNET>.21.109':445
'<LOCALNET>.21.103':139
'<LOCALNET>.21.102':139
'<LOCALNET>.21.147':139
'<LOCALNET>.21.182':445
'<LOCALNET>.21.139':445
'<LOCALNET>.21.170':445
'<LOCALNET>.21.168':139
'<LOCALNET>.21.167':139
'<LOCALNET>.21.169':139
'<LOCALNET>.21.166':139
'<LOCALNET>.21.168':445
'<LOCALNET>.21.169':445
'<LOCALNET>.21.167':445
'<LOCALNET>.21.172':445
'<LOCALNET>.21.171':445
'<LOCALNET>.21.164':139
'<LOCALNET>.21.163':139
'<LOCALNET>.21.162':139
'<LOCALNET>.21.165':445
'<LOCALNET>.21.164':445
'<LOCALNET>.21.163':445
'<LOCALNET>.21.162':445
'<LOCALNET>.21.161':139
'<LOCALNET>.21.166':445
'<LOCALNET>.21.136':139
'<LOCALNET>.21.173':445
'<LOCALNET>.21.181':139
'<LOCALNET>.21.180':139
'<LOCALNET>.21.179':139
'<LOCALNET>.21.181':445
'<LOCALNET>.21.178':139
'<LOCALNET>.21.180':445
'<LOCALNET>.21.177':139
'<LOCALNET>.21.179':445
'<LOCALNET>.21.175':139
'<LOCALNET>.21.176':139
'<LOCALNET>.21.178':445
'<LOCALNET>.21.174':139
'<LOCALNET>.21.177':445
'<LOCALNET>.21.173':139
'<LOCALNET>.21.176':445
'<LOCALNET>.21.175':445
'<LOCALNET>.21.172':139
'<LOCALNET>.21.171':139
'<LOCALNET>.21.174':445
'<LOCALNET>.21.159':139
'<LOCALNET>.21.165':139
'<LOCALNET>.21.158':139
'<LOCALNET>.21.160':139
'<LOCALNET>.21.161':445
'<LOCALNET>.21.140':139
'<LOCALNET>.21.144':139
'<LOCALNET>.21.147':445
'<LOCALNET>.21.148':445
'<LOCALNET>.21.145':139
'<LOCALNET>.21.143':139
'<LOCALNET>.21.146':445
'<LOCALNET>.21.142':139
'<LOCALNET>.21.144':445
'<LOCALNET>.21.145':445
'<LOCALNET>.21.146':139
'<LOCALNET>.21.143':445
'<LOCALNET>.21.139':139
'<LOCALNET>.21.141':139
'<LOCALNET>.21.142':445
'<LOCALNET>.21.138':139
'<LOCALNET>.21.140':445
'<LOCALNET>.21.135':139
'<LOCALNET>.21.141':445
'<LOCALNET>.21.137':139
'<LOCALNET>.21.94':445
'<LOCALNET>.21.150':445
'<LOCALNET>.21.151':445
'<LOCALNET>.21.149':445
'<LOCALNET>.21.160':445
'<LOCALNET>.21.159':445
'<LOCALNET>.21.158':445
'<LOCALNET>.21.157':139
'<LOCALNET>.21.156':139
'<LOCALNET>.21.155':139
'<LOCALNET>.21.154':139
'<LOCALNET>.21.157':445
'<LOCALNET>.21.152':139
'<LOCALNET>.21.156':445
'<LOCALNET>.21.155':445
'<LOCALNET>.21.151':139
'<LOCALNET>.21.153':139
'<LOCALNET>.21.154':445
'<LOCALNET>.21.150':139
'<LOCALNET>.21.152':445
'<LOCALNET>.21.149':139
'<LOCALNET>.21.153':445
'<LOCALNET>.21.148':139
'<LOCALNET>.21.170':139
'<LOCALNET>.21.90':139
'<LOCALNET>.21.83':445
'<LOCALNET>.21.31':139
'<LOCALNET>.21.34':445
'<LOCALNET>.21.33':445
'<LOCALNET>.21.30':139
'<LOCALNET>.21.28':139
'<LOCALNET>.21.32':445
'<LOCALNET>.21.29':139
'<LOCALNET>.21.31':445
'<LOCALNET>.21.36':445
'<LOCALNET>.21.32':139
'<LOCALNET>.21.28':445
'<LOCALNET>.21.26':139
'<LOCALNET>.21.25':139
'<LOCALNET>.21.29':445
'<LOCALNET>.21.23':139
'<LOCALNET>.21.27':445
'<LOCALNET>.21.21':139
'<LOCALNET>.21.26':445
'<LOCALNET>.21.27':139
'<LOCALNET>.21.2':139
'<LOCALNET>.21.37':445
'<LOCALNET>.21.46':445
'<LOCALNET>.21.47':445
'<LOCALNET>.21.42':139
'<LOCALNET>.21.43':139
'<LOCALNET>.21.45':445
'<LOCALNET>.21.41':139
'<LOCALNET>.21.44':445
'<LOCALNET>.21.38':139
'<LOCALNET>.21.43':445
'<LOCALNET>.21.40':139
'<LOCALNET>.21.42':445
'<LOCALNET>.21.39':139
'<LOCALNET>.21.41':445
'<LOCALNET>.21.36':139
'<LOCALNET>.21.38':445
'<LOCALNET>.21.37':139
'<LOCALNET>.21.40':445
'<LOCALNET>.21.39':445
'<LOCALNET>.21.33':139
'<LOCALNET>.21.24':139
'<LOCALNET>.21.30':445
'<LOCALNET>.21.25':445
'<LOCALNET>.21.22':139
'<LOCALNET>.21.23':445
'<LOCALNET>.21.17':139
'<LOCALNET>.21.2':445
'<LOCALNET>.21.3':139
'<LOCALNET>.21.4':445
'<LOCALNET>.21.5':139
'<LOCALNET>.21.10':139
'<LOCALNET>.21.12':445
'<LOCALNET>.21.8':139
'<LOCALNET>.21.5':445
'<LOCALNET>.21.10':445
'<LOCALNET>.21.12':139
'<LOCALNET>.21.15':139
'<LOCALNET>.21.3':445
'<LOCALNET>.21.8':445
'<LOCALNET>.21.19':139
'<LOCALNET>.21.1':139
'<LOCALNET>.21.17':445
'<LOCALNET>.21.19':445
'<LOCALNET>.21.1':445
'<LOCALNET>.21.44':139
'<LOCALNET>.21.34':139
'<LOCALNET>.21.18':445
'<LOCALNET>.21.6':445
'<LOCALNET>.21.14':445
'<LOCALNET>.21.13':139
'<LOCALNET>.21.24':445
'<LOCALNET>.21.21':445
'<LOCALNET>.21.20':139
'<LOCALNET>.21.22':445
'<LOCALNET>.21.16':139
'<LOCALNET>.21.11':139
'<LOCALNET>.21.20':445
'<LOCALNET>.21.13':445
'<LOCALNET>.21.7':139
'<LOCALNET>.21.9':139
'<LOCALNET>.21.11':445
'<LOCALNET>.21.6':139
'<LOCALNET>.21.16':445
'<LOCALNET>.21.18':139
'<LOCALNET>.21.9':445
'<LOCALNET>.21.14':139
'<LOCALNET>.21.7':445
'<LOCALNET>.21.4':139
'<LOCALNET>.21.62':445
'<LOCALNET>.21.88':139
'<LOCALNET>.21.49':445
'<LOCALNET>.21.81':445
'<LOCALNET>.21.77':139
'<LOCALNET>.21.80':445
'<LOCALNET>.21.76':139
'<LOCALNET>.21.79':445
'<LOCALNET>.21.75':139
'<LOCALNET>.21.78':445
'<LOCALNET>.21.74':139
'<LOCALNET>.21.79':139
'<LOCALNET>.21.78':139
'<LOCALNET>.21.72':139
'<LOCALNET>.21.73':139
'<LOCALNET>.21.75':445
'<LOCALNET>.21.74':445
'<LOCALNET>.21.71':139
'<LOCALNET>.21.70':139
'<LOCALNET>.21.73':445
'<LOCALNET>.21.72':445
'<LOCALNET>.21.77':445
'<LOCALNET>.21.48':445
'<LOCALNET>.21.82':445
'<LOCALNET>.21.92':445
'<LOCALNET>.21.89':139
'<LOCALNET>.21.91':445
'<LOCALNET>.21.90':445
'<LOCALNET>.21.87':139
'<LOCALNET>.21.86':139
'my####rnalip.com':80
'<LOCALNET>.21.89':445
'<LOCALNET>.21.88':445
'<LOCALNET>.21.85':139
'<LOCALNET>.21.84':139
'<LOCALNET>.21.87':445
'<LOCALNET>.21.83':139
'<LOCALNET>.21.86':445
'<LOCALNET>.21.82':139
'<LOCALNET>.21.85':445
'<LOCALNET>.21.81':139
'<LOCALNET>.21.84':445
'<LOCALNET>.21.80':139
'<LOCALNET>.21.69':139
'<LOCALNET>.21.76':445
'<LOCALNET>.21.68':139
'<LOCALNET>.21.71':445
'<LOCALNET>.21.67':139
'<LOCALNET>.21.50':139
'<LOCALNET>.21.56':139
'<LOCALNET>.21.54':139
'<LOCALNET>.21.57':445
'<LOCALNET>.21.52':139
'<LOCALNET>.21.55':445
'<LOCALNET>.21.51':139
'<LOCALNET>.21.56':445
'<LOCALNET>.21.54':445
'<LOCALNET>.21.53':139
'<LOCALNET>.21.61':445
'<LOCALNET>.21.52':445
'<LOCALNET>.21.49':139
'<LOCALNET>.21.51':445
'<LOCALNET>.21.48':139
'<LOCALNET>.21.53':445
'<LOCALNET>.21.46':139
'<LOCALNET>.21.50':445
'<LOCALNET>.21.47':139
'<LOCALNET>.21.45':139
'<LOCALNET>.21.93':445
'<LOCALNET>.21.55':139
'<LOCALNET>.21.60':445
'<LOCALNET>.21.59':445
'<LOCALNET>.21.70':445
'<LOCALNET>.21.68':445
'<LOCALNET>.21.69':445
'<LOCALNET>.21.67':445
'<LOCALNET>.21.66':139
'<LOCALNET>.21.66':445
'<LOCALNET>.21.65':139
'<LOCALNET>.21.58':139
'<LOCALNET>.21.64':139
'<LOCALNET>.21.63':139
'<LOCALNET>.21.65':445
'<LOCALNET>.21.60':139
'<LOCALNET>.21.64':445
'<LOCALNET>.21.62':139
'<LOCALNET>.21.63':445
'<LOCALNET>.21.58':445
'<LOCALNET>.21.61':139
'<LOCALNET>.21.59':139
'<LOCALNET>.21.57':139
'<LOCALNET>.21.182':139

TCP

HTTP GET requests

http://my####rnalip.com/raw

UDP

DNS ASK my####rnalip.com

Miscellaneous

Creates and executes the following

'<Current directory>\nwaixkr3.exe' -n
'%WINDIR%\syswow64\wscript.exe' //B //Nologo "%APPDATA%\kPQ2VNJS.vbs"
'<Current directory>\o5ytnmck.exe' -accepteula "bod_r.TTF" -nobanner
'%TEMP%\o5ytnmck64.exe' -accepteula "bod_r.TTF" -nobanner
'%WINDIR%\syswow64\cmd.exe' /C copy /V /Y "<Full path to file>" "<Current directory>\NWaiXkR3.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"<Current directory>\PoGVPyuL.txt"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "%APPDATA%\E8TWWQJG.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Contro...' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C wscript //B //Nologo "%APPDATA%\kPQ2VNJS.vbs"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C schtasks /Create /tn DSHCA /tr "%APPDATA%\1x12fLwj.bat" /sc minute /mo 5 /RL HIGHEST /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\D1yIub2F.bat" "%ProgramFiles%\DVD Maker\bod_r.TTF""' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C schtasks /Run /I /tn DSHCA' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "%APPDATA%\1x12fLwj.bat"' (with hidden window)
'<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C copy /V /Y "<Full path to file>" "<Current directory>\NWaiXkR3.exe"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Exec Unrestricted try {start-process -FilePath "vssadmin" -ArgumentList "delete","shadows","/all","/quiet" -WindowStyle Hidden} catch {}
'%WINDIR%\syswow64\cmd.exe' /c O5ytnMck.exe -accepteula "bod_r.TTF" -nobanner
'<SYSTEM32>\cmd.exe' /c "%APPDATA%\1x12fLwj.bat"
'%WINDIR%\syswow64\takeown.exe' /F "%ProgramFiles%\DVD Maker\bod_r.TTF"
'<SYSTEM32>\taskeng.exe' {8FEC917E-C053-4CF6-882E-38A17D36B40C} S-1-5-21-1238866942-1249195528-555854008-1000:erjjjgbpve\user:Interactive:[1]
'%WINDIR%\syswow64\cacls.exe' "%ProgramFiles%\DVD Maker\bod_r.TTF" /E /G user:F /C
'%WINDIR%\syswow64\attrib.exe' -R -A -S "%ProgramFiles%\DVD Maker\bod_r.TTF"
'%WINDIR%\syswow64\schtasks.exe' /Run /I /tn DSHCA
'%WINDIR%\syswow64\cmd.exe' /C schtasks /Run /I /tn DSHCA
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\D1yIub2F.bat" "%ProgramFiles%\DVD Maker\bod_r.TTF""
'%WINDIR%\syswow64\schtasks.exe' /Create /tn DSHCA /tr "%APPDATA%\1x12fLwj.bat" /sc minute /mo 5 /RL HIGHEST /F
'%WINDIR%\syswow64\cmd.exe' /C schtasks /Create /tn DSHCA /tr "%APPDATA%\1x12fLwj.bat" /sc minute /mo 5 /RL HIGHEST /F
'%WINDIR%\syswow64\reg.exe' add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "%APPDATA%\E8TWWQJG.bmp" /f
'%WINDIR%\syswow64\cmd.exe' /C wscript //B //Nologo "%APPDATA%\kPQ2VNJS.vbs"
'%WINDIR%\syswow64\cmd.exe' /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "%APPDATA%\E8TWWQJG.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Contro...
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
'%WINDIR%\syswow64\cmd.exe' /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"<Current directory>\PoGVPyuL.txt"
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\schtasks.exe' /Delete /TN DSHCA /F

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial