Trojan.Encoder.38446

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\\readme.txt
<Drive name for removable media>:\calc.exe
<Drive name for removable media>:\168.jpg
<Drive name for removable media>:\region-north-karelia.jpg
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\trivial-merge.htm
<Drive name for removable media>:\browse.htm
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\winmine.exe
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\\readme.html
<Drive name for removable media>:\notepad.exe
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Injects code into

the following system processes:

<SYSTEM32>\vds.exe

Modifies file system

Creates the following files

C:\\readme.txt
D:\\readme.txt
C:\\readme.html
D:\\readme.html
%TEMP%\1576693964120002259.hta

Moves the following files

from %ProgramFiles%\java\jre1.8.0_45\bin\fxplugins.dll to %ProgramFiles%\java\jre1.8.0_45\bin\fxplugins.dll.2023lock
from %ProgramFiles%\microsoft office\office14\1033\quickstyles\traditional.dotx to %ProgramFiles%\microsoft office\office14\1033\quickstyles\traditional.dotx.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so00915_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so00915_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubwzint.dll to %ProgramFiles%\microsoft office\office14\1033\pubwzint.dll.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so00726_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so00726_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so00486_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so00486_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so00364_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so00364_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir4b.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir4b.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so00197_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so00197_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir41f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir41f.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\sl01395_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\sl01395_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\road_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\road_01.mid.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph03014_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph03014_.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir29f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir29f.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir15f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir15f.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir5f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir5f.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir45f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir45f.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\pe03513_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\pe03513_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir35f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir35f.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\pe02296_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\pe02296_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\pe01661_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\pe01661_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir28f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir28f.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so01568_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so01568_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\winword.dev_col.hxc to %ProgramFiles%\microsoft office\office14\1033\winword.dev_col.hxc.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0222019.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0222019.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\xlintl32.dll to %ProgramFiles%\microsoft office\office14\1033\xlintl32.dll.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0205582.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0205582.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0187423.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0187423.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0088542.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0088542.wmf.2023lock
from %ProgramFiles%\microsoft office\document themes 14\theme effects\opulent.eftx to %ProgramFiles%\microsoft office\document themes 14\theme effects\opulent.eftx.2023lock
from %ProgramFiles%\microsoft office\document themes 14\theme effects\composite.eftx to %ProgramFiles%\microsoft office\document themes 14\theme effects\composite.eftx.2023lock
from %ProgramFiles%\microsoft office\document themes 14\horizon.thmx to %ProgramFiles%\microsoft office\document themes 14\horizon.thmx.2023lock
from %ProgramFiles%\microsoft office\document themes 14\aspect.thmx to %ProgramFiles%\microsoft office\document themes 14\aspect.thmx.2023lock
from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143750.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143750.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na00389_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na00389_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01839_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01839_.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01304g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01304g.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01243_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01243_.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\tr00172_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\tr00172_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\tn00234_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\tn00234_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\sy01252_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\sy01252_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\sprng_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\sprng_01.mid.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so02413_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so02413_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so02054_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so02054_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir15f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir15f.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme46.css to %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme46.css.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\pe00640_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\pe00640_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0187817.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0187817.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0185786.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0185786.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\outlook_f_col.hxk to %ProgramFiles%\microsoft office\office14\1033\outlook_f_col.hxk.2023lock
from %ProgramFiles%\microsoft office\office14\1033\onintl.rest.idx_dll to %ProgramFiles%\microsoft office\office14\1033\onintl.rest.idx_dll.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0172067.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0172067.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\ois_col.hxc to %ProgramFiles%\microsoft office\office14\1033\ois_col.hxc.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0153514.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0153514.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\mspub.hxs to %ProgramFiles%\microsoft office\office14\1033\mspub.hxs.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0152898.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0152898.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0152690.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0152690.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0152556.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0152556.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0107658.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0107658.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0107480.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0107480.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0107308.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0107308.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0107154.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0107154.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0106222.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0106222.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0105504.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0105504.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0105368.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0105368.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0195788.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0195788.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0198226.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0198226.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0187895.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0187895.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0199483.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0199483.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\pe00050_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\pe00050_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0212299.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0212299.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme30.css to %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme30.css.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\outdr_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\outdr_01.mid.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na02423_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na02423_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na02361_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na02361_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na01852_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na01852_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na01357_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na01357_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme14.css to %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme14.css.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na01069_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na01069_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02077_.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02077_.gif.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0251301.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0251301.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pub6intl.rest.idx_dll to %ProgramFiles%\microsoft office\office14\1033\pub6intl.rest.idx_dll.2023lock
from %ProgramFiles%\microsoft office\office14\1033\ppintl.dll to %ProgramFiles%\microsoft office\office14\1033\ppintl.dll.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0304405.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0304405.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0295069.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0295069.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0285484.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0285484.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0251007.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0251007.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0239973.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0239973.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0238927.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0238927.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0232393.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0232393.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na00523_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na00523_.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0287005.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0287005.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0297749.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0297749.wmf.2023lock
from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18187_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18187_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir36f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir36f.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate.css.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\tab_on.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\tab_on.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\tab_off.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\tab_off.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir29f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir29f.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\button_right.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\button_right.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir17f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir17f.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_earthy.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_earthy.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme48.css to %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme48.css.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\utilityfunctions.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\utilityfunctions.js.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\hiring requisition.fdt to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\hiring requisition.fdt.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme32.css to %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme32.css.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme16.css to %ProgramFiles%\microsoft office\office14\1033\pubftscm\scheme16.css.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_slateblue.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\bg_slateblue.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubftscm\fontschm.ini to %ProgramFiles%\microsoft office\office14\1033\pubftscm\fontschm.ini.2023lock
from %ProgramFiles%\microsoft office\office14\1033\ppintl.rest.idx_dll to %ProgramFiles%\microsoft office\office14\1033\ppintl.rest.idx_dll.2023lock
from %ProgramFiles%\microsoft office\office14\1033\outlperf.h to %ProgramFiles%\microsoft office\office14\1033\outlperf.h.2023lock
from %ProgramFiles%\microsoft office\office14\1033\ois_f_col.hxk to %ProgramFiles%\microsoft office\office14\1033\ois_f_col.hxk.2023lock
from %ProgramFiles%\microsoft office\office14\1033\mspub_col.hxc to %ProgramFiles%\microsoft office\office14\1033\mspub_col.hxc.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\background.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\background.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir46f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir46f.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir6f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\pdir6f.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir17f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir17f.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\toolicons\indomain.ico to %ProgramFiles%\microsoft office\office14\groove\toolicons\indomain.ico.2023lock
from %ProgramFiles%\microsoft office\office14\1033\xlintl32.rest.idx_dll to %ProgramFiles%\microsoft office\office14\1033\xlintl32.rest.idx_dll.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_center.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_center.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\utilityfunctions.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\utilityfunctions.js.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_alignright.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_alignright.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\tab_on.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\tab_on.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\tab_off.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\tab_off.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lightspirit.css to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lightspirit.css.2023lock
from %ProgramFiles%\microsoft office\office14\1033\winword.dev_f_col.hxk to %ProgramFiles%\microsoft office\office14\1033\winword.dev_f_col.hxk.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\header.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\header.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\reviewrouting_review.xsn to %ProgramFiles%\microsoft office\office14\1033\reviewrouting_review.xsn.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\tab_off.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\tab_off.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\delete.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\delete.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\qryint32.dll to %ProgramFiles%\microsoft office\office14\1033\qryint32.dll.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_formshomepageslice.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_formshomepageslice.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\submit.js to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\submit.js.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir50b.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir50b.gif.2023lock
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\macroprogress.gif to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\macroprogress.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir43b.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir43b.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir2f.gif to %ProgramFiles%\microsoft office\office14\1033\pubspapr\zpdir2f.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0105276.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0105276.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\borders\msart10.bdr to %ProgramFiles%\microsoft office\office14\borders\msart10.bdr.2023lock
from %ProgramFiles%\microsoft office\office14\1033\msaccess_f_col.hxk to %ProgramFiles%\microsoft office\office14\1033\msaccess_f_col.hxk.2023lock
from %ProgramFiles%\microsoft office\office14\1033\ipedintl.dll to %ProgramFiles%\microsoft office\office14\1033\ipedintl.dll.2023lock
from %ProgramFiles%\microsoft office\media\office14\lines\j0115855.gif to %ProgramFiles%\microsoft office\media\office14\lines\j0115855.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\lines\bd21330_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd21330_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\lines\bd21305_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd21305_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\lines\bd14845_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd14845_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\lines\bd10307_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd10307_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\j0115839.gif to %ProgramFiles%\microsoft office\media\office14\bullets\j0115839.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd21480_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd21480_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd21344_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd21344_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd21304_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd21304_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd15173_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd15173_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd15056_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd15056_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd14868_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd14868_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd14756_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd14756_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd14578_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd14578_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd10300_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10300_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18254_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18254_.wmf.2023lock
from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18237_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18237_.wmf.2023lock
from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18221_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18221_.wmf.2023lock
from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18205_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18205_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\certintl.dll to %ProgramFiles%\microsoft office\office14\1033\certintl.dll.2023lock
from %ProgramFiles%\microsoft office\office14\1033\envelopr.dll to %ProgramFiles%\microsoft office\office14\1033\envelopr.dll.2023lock
from %ProgramFiles%\microsoft office\office14\1033\graph_col.hxc to %ProgramFiles%\microsoft office\office14\1033\graph_col.hxc.2023lock
from %ProgramFiles%\microsoft office\office14\accicons.exe to %ProgramFiles%\microsoft office\office14\accicons.exe.2023lock
from %ProgramFiles%\microsoft office\office14\forms\1033\signs.ico to %ProgramFiles%\microsoft office\office14\forms\1033\signs.ico.2023lock
from %ProgramFiles%\microsoft office\office14\forms\1033\scdrestl.ico to %ProgramFiles%\microsoft office\office14\forms\1033\scdrestl.ico.2023lock
from %ProgramFiles%\microsoft office\office14\forms\1033\reportl.ico to %ProgramFiles%\microsoft office\office14\forms\1033\reportl.ico.2023lock
from %ProgramFiles%\microsoft office\office14\forms\1033\ooftmpl.cfg to %ProgramFiles%\microsoft office\office14\forms\1033\ooftmpl.cfg.2023lock
from %ProgramFiles%\microsoft office\office14\forms\1033\exitems.ico to %ProgramFiles%\microsoft office\office14\forms\1033\exitems.ico.2023lock
from %ProgramFiles%\microsoft office\office14\forms\1033\appts.ico to %ProgramFiles%\microsoft office\office14\forms\1033\appts.ico.2023lock
from %ProgramFiles%\microsoft office\office14\entitydatahandler.dll to %ProgramFiles%\microsoft office\office14\entitydatahandler.dll.2023lock
from %ProgramFiles%\microsoft office\office14\convert\pab.sam to %ProgramFiles%\microsoft office\office14\convert\pab.sam.2023lock
from %ProgramFiles%\microsoft office\office14\convert\1033\org97r.sam to %ProgramFiles%\microsoft office\office14\convert\1033\org97r.sam.2023lock
from %ProgramFiles%\microsoft office\office14\groove\toolicons\sessionowner.ico to %ProgramFiles%\microsoft office\office14\groove\toolicons\sessionowner.ico.2023lock
from %ProgramFiles%\microsoft office\office14\charsettable.chr to %ProgramFiles%\microsoft office\office14\charsettable.chr.2023lock
from %ProgramFiles%\microsoft office\office14\1033\groove_col.hxt to %ProgramFiles%\microsoft office\office14\1033\groove_col.hxt.2023lock
from %ProgramFiles%\microsoft office\office14\bibliography\sort\year.xsl to %ProgramFiles%\microsoft office\office14\bibliography\sort\year.xsl.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts.css.2023lock
from %ProgramFiles%\microsoft office\office14\bcsclient.msg.dll to %ProgramFiles%\microsoft office\office14\bcsclient.msg.dll.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis.css.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert.css.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\tab_off.gif to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\tab_off.gif.2023lock
from %ProgramFiles%\microsoft office\office14\addins\msspc.ecf to %ProgramFiles%\microsoft office\office14\addins\msspc.ecf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_lightspirit.gif to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_lightspirit.gif.2023lock
from %ProgramFiles%\microsoft office\office14\forms\1033\tasks.ico to %ProgramFiles%\microsoft office\office14\forms\1033\tasks.ico.2023lock
from %ProgramFiles%\microsoft office\office14\groove\sounds\things\coupler.wav to %ProgramFiles%\microsoft office\office14\groove\sounds\things\coupler.wav.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0102984.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0102984.wmf.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\j0115835.gif to %ProgramFiles%\microsoft office\media\office14\bullets\j0115835.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0199473.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0199473.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0198102.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0198102.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0195428.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0195428.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0187883.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0187883.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0187647.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0187647.wmf.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg to %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg.2023lock
from %ProgramFiles%\java\jre1.8.0_45\bin\splashscreen.dll to %ProgramFiles%\java\jre1.8.0_45\bin\splashscreen.dll.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0185778.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0185778.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0171847.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0171847.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0153398.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0153398.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0152892.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0152892.wmf.2023lock
from %ProgramFiles%\java\jre1.8.0_45\bin\orbd.exe to %ProgramFiles%\java\jre1.8.0_45\bin\orbd.exe.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0152628.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0152628.wmf.2023lock
from %ProgramFiles%\java\jre1.8.0_45\bin\jpeg.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jpeg.dll.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0152432.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0152432.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0136865.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0136865.wmf.2023lock
from %ProgramFiles%\java\jre1.8.0_45\bin\javafx_iio.dll to %ProgramFiles%\java\jre1.8.0_45\bin\javafx_iio.dll.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0107528.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0107528.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0107458.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0107458.wmf.2023lock
from %ProgramFiles%\java\jre1.8.0_45\bin\glib-lite.dll to %ProgramFiles%\java\jre1.8.0_45\bin\glib-lite.dll.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0215718.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0215718.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0230558.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0230558.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\pe02288_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\pe02288_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\pe01172_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\pe01172_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\pe00608_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\pe00608_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\pe00034_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\pe00034_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\nbook_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\nbook_01.mid.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na02413_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na02413_.wmf.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na02264_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na02264_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na01848_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na01848_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na01064_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na01064_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\hh00623_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\hh00623_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na00494_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na00494_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na00330_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na00330_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0301432.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0301432.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0294989.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0294989.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0287417.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0287417.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0282932.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0282932.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0250504.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0250504.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0239965.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0239965.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0237759.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0237759.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0107300.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0107300.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0107150.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0107150.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0106146.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0106146.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09194_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00141_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04195_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01173_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif.2023lock
from %ProgramFiles%\microsoft analysis services\as oledb\10\msolui100.dll to %ProgramFiles%\microsoft analysis services\as oledb\10\msolui100.dll.2023lock
from %ProgramFiles%\java\jre1.8.0_45\license to %ProgramFiles%\java\jre1.8.0_45\license.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja to %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\jce.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jce.jar.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties.2023lock
from %ProgramFiles%\java\jre1.8.0_45\copyright to %ProgramFiles%\java\jre1.8.0_45\copyright.2023lock
from %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.2023lock
from %ProgramFiles%\java\jre1.8.0_45\bin\nio.dll to %ProgramFiles%\java\jre1.8.0_45\bin\nio.dll.2023lock
from %ProgramFiles%\java\jre1.8.0_45\bin\jp2native.dll to %ProgramFiles%\java\jre1.8.0_45\bin\jp2native.dll.2023lock
from %ProgramFiles%\java\jre1.8.0_45\bin\javafx_font.dll to %ProgramFiles%\java\jre1.8.0_45\bin\javafx_font.dll.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00265_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00265_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00985_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00985_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00098_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00439_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00439_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0105496.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0105496.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\carbn_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\carbn_01.mid.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0105348.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0105348.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0105266.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0105266.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0102594.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0102594.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099204.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099204.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099172.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099172.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0090779.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0090779.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0075478.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0075478.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\hm00426_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\hm00426_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\na01354_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\na01354_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\pe03466_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\pe03466_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\hh00231_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\hh00231_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\fd02075_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\fd02075_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\fd00799_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\fd00799_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\fd00382_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\fd00382_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\en00397_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\en00397_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01630_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01630_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01172_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01172_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01140_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01140_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00297_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00297_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\hh01329_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\hh01329_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\re00006_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\re00006_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\sl01041_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\sl01041_.wmf.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansregular.ttf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00269_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00269_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_greentea.gif to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\bg_greentea.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bl00122_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bl00122_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd09664_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bd00155_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\gr8galry.gra to %ProgramFiles%\microsoft office\office14\1033\gr8galry.gra.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an04206_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\an01184_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\eawfintl.dll to %ProgramFiles%\microsoft office\office14\1033\eawfintl.dll.2023lock
from %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll to %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll.2023lock
from %ProgramFiles%\microsoft office\office14\1033\bhointl.dll to %ProgramFiles%\microsoft office\office14\1033\bhointl.dll.2023lock
from %ProgramFiles%\microsoft office\media\office14\lines\bd21527_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd21527_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\lines\bd21326_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd21326_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\lines\bd15302_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd15302_.gif.2023lock
from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.2023lock
from %ProgramFiles%\microsoft office\media\office14\lines\bd14801_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd14801_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\lines\bd10289_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd10289_.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\boatinst.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\boatinst.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue.css to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue.css.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\tab_off.gif to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\tab_off.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\tab_off.gif to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\tab_off.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0090783.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0090783.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0086420.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0086420.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\in00046_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\in00046_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\hh01618_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\hh01618_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\hh00636_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\hh00636_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\hh00236_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\hh00236_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\fd02097_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\fd02097_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\fd00965_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\fd00965_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\fd00403_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\fd00403_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01761_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01761_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\explr_01.mid to %ProgramFiles%\microsoft office\clipart\pub60cor\explr_01.mid.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01176_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01176_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\dd01145_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd01145_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\dd00405_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\dd00405_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\msaccess_col.hxc to %ProgramFiles%\microsoft office\office14\1033\msaccess_col.hxc.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\classic1.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\classic1.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\bs00441_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\bs00441_.wmf.2023lock
from %ProgramFiles%\microsoft office\office14\1033\invite or link.one to %ProgramFiles%\microsoft office\office14\1033\invite or link.one.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\tab_on.gif to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\tab_on.gif.2023lock
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\tab_on.gif to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\tab_on.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099174.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099174.wmf.2023lock
from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18203_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18203_.wmf.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd21434_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd21434_.gif.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar to %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar.2023lock
from %ProgramFiles%\microsoft office\document themes 14\apex.thmx to %ProgramFiles%\microsoft office\document themes 14\apex.thmx.2023lock
from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02073_.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb02073_.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143748.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143748.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01770_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01770_.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01300_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01300_.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01241_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01241_.gif.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\tr00116_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\tr00116_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\tn00218_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\tn00218_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\sy00882_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\sy00882_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so02958_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so02958_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so02270_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so02270_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so02048_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so02048_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so01563_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so01563_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so00913_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so00913_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so00694_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so00694_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so00479_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so00479_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so00350_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so00350_.wmf.2023lock
from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\so00192_.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\so00192_.wmf.2023lock
from %ProgramFiles%\microsoft office\document themes 14\grid.thmx to %ProgramFiles%\microsoft office\document themes 14\grid.thmx.2023lock
from %ProgramFiles%\microsoft office\document themes 14\thatch.thmx to %ProgramFiles%\microsoft office\document themes 14\thatch.thmx.2023lock
from %ProgramFiles%\microsoft office\document themes 14\theme effects\civic.eftx to %ProgramFiles%\microsoft office\document themes 14\theme effects\civic.eftx.2023lock
from %ProgramFiles%\microsoft office\document themes 14\theme effects\module.eftx to %ProgramFiles%\microsoft office\document themes 14\theme effects\module.eftx.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd21301_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd21301_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd15171_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd15171_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd15022_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd15022_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd14866_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd14866_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd14754_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd14754_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd14533_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd14533_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd10298_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10298_.gif.2023lock
from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18252_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18252_.wmf.2023lock
from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18235_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18235_.wmf.2023lock
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099158.wmf to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099158.wmf.2023lock
from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18219_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18219_.wmf.2023lock
from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18184_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18184_.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0301480.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0301480.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0297551.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0297551.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0286034.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0286034.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0240695.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0240695.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0222015.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0222015.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0205462.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0205462.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\j0186002.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0186002.wmf.2023lock
from %ProgramFiles%\microsoft office\media\cagcat10\cagcat10.mmw to %ProgramFiles%\microsoft office\media\cagcat10\cagcat10.mmw.2023lock
from %ProgramFiles%\microsoft office\media\office14\bullets\bd21342_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd21342_.gif.2023lock
from %ProgramFiles%\microsoft office\office14\installed_schemas14.xss to %ProgramFiles%\microsoft office\office14\installed_schemas14.xss.2023lock

Modifies the following files

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' wbadmin delete catalog -quiet && vssadmin.exe delete shadows /all /quiet && bcdedit.exe /set {current} nx AlwaysOff && wmic SHADOWCOPY DELETE
'<SYSTEM32>\wbadmin.exe' delete catalog -quiet
'<SYSTEM32>\wbengine.exe'
'%WINDIR%\syswow64\mshta.exe' "%TEMP%\1576693964120002259.hta"
'<SYSTEM32>\vds.exe'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial