Trojan.Encoder.38857

Technical Information

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\iisstart.html
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Moves the following system files

from %WINDIR%\appcompat\programs\install\install_0000_697d9b86-6ade-46f3-a917-2aeb844ae975.txt to %WINDIR%\appcompat\programs\install\install_0000_697d9b86-6ade-46f3-a917-2aeb844ae975.txt.donnycrypted
from %WINDIR%\fonts\bod_blar.ttf to %WINDIR%\fonts\bod_blar.ttf.donnycrypted
from %WINDIR%\fonts\bod_blai.ttf to %WINDIR%\fonts\bod_blai.ttf.donnycrypted
from %WINDIR%\fonts\bod_bi.ttf to %WINDIR%\fonts\bod_bi.ttf.donnycrypted
from %WINDIR%\fonts\bod_b.ttf to %WINDIR%\fonts\bod_b.ttf.donnycrypted
from %WINDIR%\fonts\bkant.ttf to %WINDIR%\fonts\bkant.ttf.donnycrypted
from %WINDIR%\fonts\bernhc.ttf to %WINDIR%\fonts\bernhc.ttf.donnycrypted
from %WINDIR%\fonts\belli.ttf to %WINDIR%\fonts\belli.ttf.donnycrypted
from %WINDIR%\fonts\bellb.ttf to %WINDIR%\fonts\bellb.ttf.donnycrypted
from %WINDIR%\fonts\bod_cb.ttf to %WINDIR%\fonts\bod_cb.ttf.donnycrypted
from %WINDIR%\fonts\bell.ttf to %WINDIR%\fonts\bell.ttf.donnycrypted
from %WINDIR%\fonts\baskvill.ttf to %WINDIR%\fonts\baskvill.ttf.donnycrypted
from %WINDIR%\fonts\arlrdbd.ttf to %WINDIR%\fonts\arlrdbd.ttf.donnycrypted
from %WINDIR%\fonts\arialni.ttf to %WINDIR%\fonts\arialni.ttf.donnycrypted
from %WINDIR%\fonts\arialnbi.ttf to %WINDIR%\fonts\arialnbi.ttf.donnycrypted
from %WINDIR%\fonts\arialnb.ttf to %WINDIR%\fonts\arialnb.ttf.donnycrypted
from %WINDIR%\fonts\arialn.ttf to %WINDIR%\fonts\arialn.ttf.donnycrypted
from %WINDIR%\fonts\antquai.ttf to %WINDIR%\fonts\antquai.ttf.donnycrypted
from %WINDIR%\fonts\antquabi.ttf to %WINDIR%\fonts\antquabi.ttf.donnycrypted
from %WINDIR%\fonts\bauhs93.ttf to %WINDIR%\fonts\bauhs93.ttf.donnycrypted
from %WINDIR%\fonts\bod_cbi.ttf to %WINDIR%\fonts\bod_cbi.ttf.donnycrypted
from %WINDIR%\fonts\bod_ci.ttf to %WINDIR%\fonts\bod_ci.ttf.donnycrypted
from %WINDIR%\fonts\bod_cr.ttf to %WINDIR%\fonts\bod_cr.ttf.donnycrypted
from %WINDIR%\fonts\calist.ttf to %WINDIR%\fonts\calist.ttf.donnycrypted
from %WINDIR%\fonts\califr.ttf to %WINDIR%\fonts\califr.ttf.donnycrypted
from %WINDIR%\fonts\califi.ttf to %WINDIR%\fonts\califi.ttf.donnycrypted
from %WINDIR%\fonts\califb.ttf to %WINDIR%\fonts\califb.ttf.donnycrypted
from %WINDIR%\fonts\bssym7.ttf to %WINDIR%\fonts\bssym7.ttf.donnycrypted
from %WINDIR%\fonts\brushsci.ttf to %WINDIR%\fonts\brushsci.ttf.donnycrypted
from %WINDIR%\fonts\broadw.ttf to %WINDIR%\fonts\broadw.ttf.donnycrypted
from %WINDIR%\fonts\brlnsr.ttf to %WINDIR%\fonts\brlnsr.ttf.donnycrypted
from %WINDIR%\fonts\brlnsdb.ttf to %WINDIR%\fonts\brlnsdb.ttf.donnycrypted
from %WINDIR%\fonts\brlnsb.ttf to %WINDIR%\fonts\brlnsb.ttf.donnycrypted
from %WINDIR%\fonts\britanic.ttf to %WINDIR%\fonts\britanic.ttf.donnycrypted
from %WINDIR%\fonts\bradhitc.ttf to %WINDIR%\fonts\bradhitc.ttf.donnycrypted
from %WINDIR%\fonts\bookosi.ttf to %WINDIR%\fonts\bookosi.ttf.donnycrypted
from %WINDIR%\fonts\bookosbi.ttf to %WINDIR%\fonts\bookosbi.ttf.donnycrypted
from %WINDIR%\fonts\bookosb.ttf to %WINDIR%\fonts\bookosb.ttf.donnycrypted
from %WINDIR%\fonts\bookos.ttf to %WINDIR%\fonts\bookos.ttf.donnycrypted
from %WINDIR%\fonts\bod_r.ttf to %WINDIR%\fonts\bod_r.ttf.donnycrypted
from %WINDIR%\fonts\bod_pstc.ttf to %WINDIR%\fonts\bod_pstc.ttf.donnycrypted
from %WINDIR%\fonts\bod_i.ttf to %WINDIR%\fonts\bod_i.ttf.donnycrypted
from %WINDIR%\fonts\antquab.ttf to %WINDIR%\fonts\antquab.ttf.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w708fc392#\f3b842056d4d86f79d4da88593e8824e\microsoft.windows.diagnosis.commands.writediagprogress.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w708fc392#\f3b842056d4d86f79d4da88593e8824e\microsoft.windows.diagnosis.commands.writediagprogress.ni.dll.aux.donnycrypted
from %WINDIR%\fonts\alger.ttf to %WINDIR%\fonts\alger.ttf.donnycrypted
from %WINDIR%\fonts\agencyb.ttf to %WINDIR%\fonts\agencyb.ttf.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\srpuxsnapin\b07ff4fe454dafd8fc37cdec5781b495\srpuxsnapin.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\srpuxsnapin\b07ff4fe454dafd8fc37cdec5781b495\srpuxsnapin.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\securityaudf6921413#\c209010cb5e17e89ff05f644a53937b7\securityauditpoliciessnapin.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\securityaudf6921413#\c209010cb5e17e89ff05f644a53937b7\securityauditpoliciessnapin.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\presentationcore\98981e4f3b07e2c849059fcd6f067dd6\presentationcore.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\presentationcore\98981e4f3b07e2c849059fcd6f067dd6\presentationcore.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\presentatioaec034ca#\2a8c9ba0a515b7bd9c007268de1e85bd\presentationframework.aero2.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\presentatioaec034ca#\2a8c9ba0a515b7bd9c007268de1e85bd\presentationframework.aero2.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\presentatio5ae0f00f#\aedb8022dcd8b9d311fc5a92055a0465\presentationframework.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\presentatio5ae0f00f#\aedb8022dcd8b9d311fc5a92055a0465\presentationframework.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\napinit\270f73da430d947b2d1f419de547829d\napinit.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\napinit\270f73da430d947b2d1f419de547829d\napinit.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\napcrypt\8d9dd762201f38cc1e6895cbb5bc3e0e\napcrypt.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\napcrypt\8d9dd762201f38cc1e6895cbb5bc3e0e\napcrypt.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\mscorlib\8d60a20bcb7b36d0ddf74b96d554c96e\mscorlib.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\mscorlib\8d60a20bcb7b36d0ddf74b96d554c96e\mscorlib.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system\fef08a9d97fc5fe2e9193fbcb2227e37\system.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system\fef08a9d97fc5fe2e9193fbcb2227e37\system.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\mmcfxcommon\718eba8ba98332f6142308dd04484ceb\mmcfxcommon.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\mmcfxcommon\718eba8ba98332f6142308dd04484ceb\mmcfxcommon.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\miguicontrols\61eba73d7df922f33a3f269f7eb49791\miguicontrols.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\miguicontrols\61eba73d7df922f33a3f269f7eb49791\miguicontrols.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.wed3937f9#\14130b14212b53ab68edd5527308a073\microsoft.windows.diagnosis.sdcommon.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.wed3937f9#\14130b14212b53ab68edd5527308a073\microsoft.windows.diagnosis.sdcommon.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.we9f24001#\edd9211f6cc9487c211968d4a6c613f5\microsoft.wsman.management.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.we9f24001#\edd9211f6cc9487c211968d4a6c613f5\microsoft.wsman.management.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.we0722664#\42c14ac55141912d3a07bf84bdaf816e\microsoft.wsman.management.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.we0722664#\42c14ac55141912d3a07bf84bdaf816e\microsoft.wsman.management.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.wd75d181a#\a1303cf8536d170d6b6dbb782a7403c5\microsoft.windows.diagnosis.sdengine.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.wd75d181a#\a1303cf8536d170d6b6dbb782a7403c5\microsoft.windows.diagnosis.sdengine.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.wd518ee0d#\cad13f69f8f8cce80f3b6bfbd41cbd54\microsoft.windows.diagnosis.commands.updatediagreport.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.wd518ee0d#\cad13f69f8f8cce80f3b6bfbd41cbd54\microsoft.windows.diagnosis.commands.updatediagreport.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.wcffedcb4#\d0cd29b5e3873f8f151003e3e556c528\microsoft.windowssearch.commands.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.wcffedcb4#\d0cd29b5e3873f8f151003e3e556c528\microsoft.windowssearch.commands.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.wad78daf4#\16b1a3c310dc1a534c12818f0ecbc408\microsoft.windows.diagnosis.sdhost.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.wad78daf4#\16b1a3c310dc1a534c12818f0ecbc408\microsoft.windows.diagnosis.sdhost.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\mmcex\262dc79f790a5d0d78871d8116ee19b7\mmcex.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\mmcex\262dc79f790a5d0d78871d8116ee19b7\mmcex.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.confe64a9051#\8b196892625eaf49b77e5f1de6e1de05\system.configuration.install.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.confe64a9051#\8b196892625eaf49b77e5f1de6e1de05\system.configuration.install.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.configuration\250e8caa0952158e01ed2360a5e29908\system.configuration.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.configuration\250e8caa0952158e01ed2360a5e29908\system.configuration.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.core\b4bf7266d73c05a0e87b198b961a00a0\system.core.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.core\b4bf7266d73c05a0e87b198b961a00a0\system.core.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\windowsbase\4cda6e9d0d846d32936dddc3e7aa46c3\windowsbase.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\windowsbase\4cda6e9d0d846d32936dddc3e7aa46c3\windowsbase.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\taskscheduler\289920682908241cbec767452bade3f4\taskscheduler.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\taskscheduler\289920682908241cbec767452bade3f4\taskscheduler.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.xml.linq\fc0f48af079a84941a2dd4017bbfe907\system.xml.linq.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.xml.linq\fc0f48af079a84941a2dd4017bbfe907\system.xml.linq.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.xml\c33e6b4f8a7247b0990b8cf35428bc43\system.xml.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.xml\c33e6b4f8a7247b0990b8cf35428bc43\system.xml.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.xaml\316611b52eac69fa239127805a375b05\system.xaml.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.xaml\316611b52eac69fa239127805a375b05\system.xaml.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.windows.forms\2c083e80c5a030fa98949290d8996943\system.windows.forms.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.windows.forms\2c083e80c5a030fa98949290d8996943\system.windows.forms.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.web.services\dd6689f95555d77fa94bf8fba40fde5b\system.web.services.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.web.services\dd6689f95555d77fa94bf8fba40fde5b\system.web.services.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.transactions\ace2b7b849965c3cfe1a1c06a2f3978f\system.transactions.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.transactions\ace2b7b849965c3cfe1a1c06a2f3978f\system.transactions.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.servicemodel\202bc57b378e854112a5a24dcefe1998\system.servicemodel.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.servicemodel\202bc57b378e854112a5a24dcefe1998\system.servicemodel.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.serv759bfb78#\191678ea627035cf9d63bca07c17bbbb\system.serviceprocess.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.serv759bfb78#\191678ea627035cf9d63bca07c17bbbb\system.serviceprocess.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.runteb92aa12#\f7e5aae3c1cec018e996a4fdb1d29ce3\system.runtime.serialization.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.runteb92aa12#\f7e5aae3c1cec018e996a4fdb1d29ce3\system.runtime.serialization.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.runtc259d85b#\74e5cd74d348de538f675f5376567306\system.runtime.windowsruntime.ui.xaml.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.runtc259d85b#\74e5cd74d348de538f675f5376567306\system.runtime.windowsruntime.ui.xaml.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.runt73a1fc9d#\28ded34e9d09ec16f16a5b240a240c04\system.runtime.remoting.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.runt73a1fc9d#\28ded34e9d09ec16f16a5b240a240c04\system.runtime.remoting.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.net.http\40ed7008e01920d4cfeab11198a12441\system.net.http.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.net.http\40ed7008e01920d4cfeab11198a12441\system.net.http.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.management\8d7c7a7cc38c22bf1bb0340ac0ec57b0\system.management.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.management\8d7c7a7cc38c22bf1bb0340ac0ec57b0\system.management.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\9af305b8f9fdcee47a2a747766db7dfe\system.management.automation.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\9af305b8f9fdcee47a2a747766db7dfe\system.management.automation.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.drawing\c6d7a40d12247c54531a7ab2d7219dac\system.drawing.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.drawing\c6d7a40d12247c54531a7ab2d7219dac\system.drawing.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.dired13b18a9#\a320d7e1c44d21548c2c730e454134ee\system.directoryservices.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.dired13b18a9#\a320d7e1c44d21548c2c730e454134ee\system.directoryservices.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.data\db427565e809442f21a3befd343d2102\system.data.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\system.data\db427565e809442f21a3befd343d2102\system.data.ni.dll.aux.donnycrypted
from %WINDIR%\fonts\agencyr.ttf to %WINDIR%\fonts\agencyr.ttf.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w79a81d80#\a103fab9b46126926e46c7502572d079\microsoft.windows.diagnosis.commands.writediagtelemetry.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w79a81d80#\a103fab9b46126926e46c7502572d079\microsoft.windows.diagnosis.commands.writediagtelemetry.ni.dll.aux.donnycrypted
from %WINDIR%\fonts\calistb.ttf to %WINDIR%\fonts\calistb.ttf.donnycrypted
from %WINDIR%\fonts\coprgtl.ttf to %WINDIR%\fonts\coprgtl.ttf.donnycrypted
from %WINDIR%\fonts\juice___.ttf to %WINDIR%\fonts\juice___.ttf.donnycrypted
from %WINDIR%\fonts\jokerman.ttf to %WINDIR%\fonts\jokerman.ttf.donnycrypted
from %WINDIR%\fonts\itckrist.ttf to %WINDIR%\fonts\itckrist.ttf.donnycrypted
from %WINDIR%\fonts\itcedscr.ttf to %WINDIR%\fonts\itcedscr.ttf.donnycrypted
from %WINDIR%\fonts\itcblkad.ttf to %WINDIR%\fonts\itcblkad.ttf.donnycrypted
from %WINDIR%\fonts\infroman.ttf to %WINDIR%\fonts\infroman.ttf.donnycrypted
from %WINDIR%\fonts\imprisha.ttf to %WINDIR%\fonts\imprisha.ttf.donnycrypted
from %WINDIR%\fonts\htowerti.ttf to %WINDIR%\fonts\htowerti.ttf.donnycrypted
from %WINDIR%\fonts\latinwd.ttf to %WINDIR%\fonts\latinwd.ttf.donnycrypted
from %WINDIR%\fonts\kunstler.ttf to %WINDIR%\fonts\kunstler.ttf.donnycrypted
from %WINDIR%\fonts\harngton.ttf to %WINDIR%\fonts\harngton.ttf.donnycrypted
from %WINDIR%\fonts\harlowsi.ttf to %WINDIR%\fonts\harlowsi.ttf.donnycrypted
from %WINDIR%\fonts\goudysto.ttf to %WINDIR%\fonts\goudysto.ttf.donnycrypted
from %WINDIR%\fonts\goudosi.ttf to %WINDIR%\fonts\goudosi.ttf.donnycrypted
from %WINDIR%\fonts\goudosb.ttf to %WINDIR%\fonts\goudosb.ttf.donnycrypted
from %WINDIR%\fonts\goudos.ttf to %WINDIR%\fonts\goudos.ttf.donnycrypted
from %WINDIR%\fonts\gothici.ttf to %WINDIR%\fonts\gothici.ttf.donnycrypted
from %WINDIR%\fonts\gothicbi.ttf to %WINDIR%\fonts\gothicbi.ttf.donnycrypted
from %WINDIR%\fonts\htowert.ttf to %WINDIR%\fonts\htowert.ttf.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\accessibility\45986c96031f04d1e4bc87f96795a26a\accessibility.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\accessibility\45986c96031f04d1e4bc87f96795a26a\accessibility.ni.dll.aux.donnycrypted
from %WINDIR%\fonts\lbrite.ttf to %WINDIR%\fonts\lbrite.ttf.donnycrypted
from %WINDIR%\fonts\magnetob.ttf to %WINDIR%\fonts\magnetob.ttf.donnycrypted
from %WINDIR%\fonts\ltypeo.ttf to %WINDIR%\fonts\ltypeo.ttf.donnycrypted
from %WINDIR%\fonts\ltypebo.ttf to %WINDIR%\fonts\ltypebo.ttf.donnycrypted
from %WINDIR%\fonts\ltypeb.ttf to %WINDIR%\fonts\ltypeb.ttf.donnycrypted
from %WINDIR%\fonts\ltype.ttf to %WINDIR%\fonts\ltype.ttf.donnycrypted
from %WINDIR%\fonts\lsansi.ttf to %WINDIR%\fonts\lsansi.ttf.donnycrypted
from %WINDIR%\fonts\lsansdi.ttf to %WINDIR%\fonts\lsansdi.ttf.donnycrypted
from %WINDIR%\fonts\lsansd.ttf to %WINDIR%\fonts\lsansd.ttf.donnycrypted
from %WINDIR%\fonts\lsans.ttf to %WINDIR%\fonts\lsans.ttf.donnycrypted
from %WINDIR%\fonts\lhandw.ttf to %WINDIR%\fonts\lhandw.ttf.donnycrypted
from %WINDIR%\fonts\lfaxi.ttf to %WINDIR%\fonts\lfaxi.ttf.donnycrypted
from %WINDIR%\fonts\lfaxdi.ttf to %WINDIR%\fonts\lfaxdi.ttf.donnycrypted
from %WINDIR%\fonts\lfaxd.ttf to %WINDIR%\fonts\lfaxd.ttf.donnycrypted
from %WINDIR%\fonts\lfax.ttf to %WINDIR%\fonts\lfax.ttf.donnycrypted
from %WINDIR%\fonts\leelawdb.ttf to %WINDIR%\fonts\leelawdb.ttf.donnycrypted
from %WINDIR%\fonts\leelawad.ttf to %WINDIR%\fonts\leelawad.ttf.donnycrypted
from %WINDIR%\fonts\lcallig.ttf to %WINDIR%\fonts\lcallig.ttf.donnycrypted
from %WINDIR%\fonts\lbritei.ttf to %WINDIR%\fonts\lbritei.ttf.donnycrypted
from %WINDIR%\fonts\lbritedi.ttf to %WINDIR%\fonts\lbritedi.ttf.donnycrypted
from %WINDIR%\fonts\gothicb.ttf to %WINDIR%\fonts\gothicb.ttf.donnycrypted
from %WINDIR%\fonts\hatten.ttf to %WINDIR%\fonts\hatten.ttf.donnycrypted
from %WINDIR%\fonts\calisti.ttf to %WINDIR%\fonts\calisti.ttf.donnycrypted
from %WINDIR%\fonts\calistbi.ttf to %WINDIR%\fonts\calistbi.ttf.donnycrypted
from %WINDIR%\fonts\glecb.ttf to %WINDIR%\fonts\glecb.ttf.donnycrypted
from %WINDIR%\fonts\curlz___.ttf to %WINDIR%\fonts\curlz___.ttf.donnycrypted
from %WINDIR%\fonts\erasmd.ttf to %WINDIR%\fonts\erasmd.ttf.donnycrypted
from %WINDIR%\fonts\eraslght.ttf to %WINDIR%\fonts\eraslght.ttf.donnycrypted
from %WINDIR%\fonts\erasdemi.ttf to %WINDIR%\fonts\erasdemi.ttf.donnycrypted
from %WINDIR%\fonts\erasbd.ttf to %WINDIR%\fonts\erasbd.ttf.donnycrypted
from %WINDIR%\fonts\engr.ttf to %WINDIR%\fonts\engr.ttf.donnycrypted
from %WINDIR%\fonts\elephnti.ttf to %WINDIR%\fonts\elephnti.ttf.donnycrypted
from %WINDIR%\fonts\elephnt.ttf to %WINDIR%\fonts\elephnt.ttf.donnycrypted
from %WINDIR%\fonts\frabkit.ttf to %WINDIR%\fonts\frabkit.ttf.donnycrypted
from %WINDIR%\fonts\forte.ttf to %WINDIR%\fonts\forte.ttf.donnycrypted
from %WINDIR%\fonts\frabk.ttf to %WINDIR%\fonts\frabk.ttf.donnycrypted
from %WINDIR%\fonts\coopbl.ttf to %WINDIR%\fonts\coopbl.ttf.donnycrypted
from %WINDIR%\fonts\colonna.ttf to %WINDIR%\fonts\colonna.ttf.donnycrypted
from %WINDIR%\fonts\chiller.ttf to %WINDIR%\fonts\chiller.ttf.donnycrypted
from %WINDIR%\fonts\century.ttf to %WINDIR%\fonts\century.ttf.donnycrypted
from %WINDIR%\fonts\centaur.ttf to %WINDIR%\fonts\centaur.ttf.donnycrypted
from %WINDIR%\fonts\censcbk.ttf to %WINDIR%\fonts\censcbk.ttf.donnycrypted
from %WINDIR%\fonts\castelar.ttf to %WINDIR%\fonts\castelar.ttf.donnycrypted
from %WINDIR%\fonts\coprgtb.ttf to %WINDIR%\fonts\coprgtb.ttf.donnycrypted
from %WINDIR%\fonts\fradm.ttf to %WINDIR%\fonts\fradm.ttf.donnycrypted
from %WINDIR%\fonts\gil_____.ttf to %WINDIR%\fonts\gil_____.ttf.donnycrypted
from %WINDIR%\fonts\glsnecb.ttf to %WINDIR%\fonts\glsnecb.ttf.donnycrypted
from %WINDIR%\fonts\felixti.ttf to %WINDIR%\fonts\felixti.ttf.donnycrypted
from %WINDIR%\fonts\gilsanub.ttf to %WINDIR%\fonts\gilsanub.ttf.donnycrypted
from %WINDIR%\fonts\gillubcd.ttf to %WINDIR%\fonts\gillubcd.ttf.donnycrypted
from %WINDIR%\fonts\gili____.ttf to %WINDIR%\fonts\gili____.ttf.donnycrypted
from %WINDIR%\fonts\gilc____.ttf to %WINDIR%\fonts\gilc____.ttf.donnycrypted
from %WINDIR%\fonts\gilb____.ttf to %WINDIR%\fonts\gilb____.ttf.donnycrypted
from %WINDIR%\fonts\gilbi___.ttf to %WINDIR%\fonts\gilbi___.ttf.donnycrypted
from %WINDIR%\fonts\gigi.ttf to %WINDIR%\fonts\gigi.ttf.donnycrypted
from %WINDIR%\fonts\garait.ttf to %WINDIR%\fonts\garait.ttf.donnycrypted
from %WINDIR%\fonts\garabd.ttf to %WINDIR%\fonts\garabd.ttf.donnycrypted
from %WINDIR%\fonts\gara.ttf to %WINDIR%\fonts\gara.ttf.donnycrypted
from %WINDIR%\fonts\ftltlt.ttf to %WINDIR%\fonts\ftltlt.ttf.donnycrypted
from %WINDIR%\fonts\frscript.ttf to %WINDIR%\fonts\frscript.ttf.donnycrypted
from %WINDIR%\fonts\freescpt.ttf to %WINDIR%\fonts\freescpt.ttf.donnycrypted
from %WINDIR%\fonts\framdcn.ttf to %WINDIR%\fonts\framdcn.ttf.donnycrypted
from %WINDIR%\fonts\frahvit.ttf to %WINDIR%\fonts\frahvit.ttf.donnycrypted
from %WINDIR%\fonts\frahv.ttf to %WINDIR%\fonts\frahv.ttf.donnycrypted
from %WINDIR%\fonts\fradmit.ttf to %WINDIR%\fonts\fradmit.ttf.donnycrypted
from %WINDIR%\fonts\fradmcn.ttf to %WINDIR%\fonts\fradmcn.ttf.donnycrypted
from %WINDIR%\fonts\gothic.ttf to %WINDIR%\fonts\gothic.ttf.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w69ef49d2#\064831110d81cca806fbba3d562e966b\microsoft.windows.diagnosis.commands.getdiaginput.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w69ef49d2#\064831110d81cca806fbba3d562e966b\microsoft.windows.diagnosis.commands.getdiaginput.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w3cdb5602#\c9f988601f75e02c4124a18608800bca\microsoft.windows.diagnosis.troubleshootingpack.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w3cdb5602#\c9f988601f75e02c4124a18608800bca\microsoft.windows.diagnosis.troubleshootingpack.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w2ded559f#\7a95f33165954b49d260547a075b3b94\microsoft.windowsauthenticationprotocols.commands.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w2ded559f#\7a95f33165954b49d260547a075b3b94\microsoft.windowsauthenticationprotocols.commands.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p08ac43d5#\9613a2a9eb4c375136f5aa68a4f1aded\microsoft.powershell.utility.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p08ac43d5#\9613a2a9eb4c375136f5aa68a4f1aded\microsoft.powershell.utility.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p047767ce#\a4f2f0b617a18a8455d22f202fe420b2\microsoft.powershell.core.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p047767ce#\a4f2f0b617a18a8455d22f202fe420b2\microsoft.powershell.core.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.of2ff78c4#\5f7c174c7e99842f938ae7af4e31a7ee\microsoft.office.businessapplications.diagnostics.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.of2ff78c4#\5f7c174c7e99842f938ae7af4e31a7ee\microsoft.office.businessapplications.diagnostics.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.oeab01fba#\e682259863ddcd096c794951ab338793\microsoft.office.tools.word.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.oeab01fba#\e682259863ddcd096c794951ab338793\microsoft.office.tools.word.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.oe2e369ff#\4348e721df408af31351573633f832da\microsoft.office.tools.excel.implementation.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.oe2e369ff#\4348e721df408af31351573633f832da\microsoft.office.tools.excel.implementation.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.ob92d13a7#\ab2dafb3de06fb473cbf912a605f396b\microsoft.office.businessdata.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.ob92d13a7#\ab2dafb3de06fb473cbf912a605f396b\microsoft.office.businessdata.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.oab3f8ec6#\6ea16c7712920666d518740a1b963915\microsoft.office.tools.word.implementation.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.oab3f8ec6#\6ea16c7712920666d518740a1b963915\microsoft.office.tools.word.implementation.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p34f388c1#\21472ab46ac7f4d9647b08595c1d561a\microsoft.powershell.diagnostics.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p34f388c1#\21472ab46ac7f4d9647b08595c1d561a\microsoft.powershell.diagnostics.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o854200f9#\33d82b688bd0c20790ee74c9212d0b42\microsoft.office.tools.common.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o854200f9#\33d82b688bd0c20790ee74c9212d0b42\microsoft.office.tools.common.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o5263ae01#\8110e51484dc68504b7b78d6f32a70e8\microsoft.office.tools.outlook.implementation.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o5263ae01#\8110e51484dc68504b7b78d6f32a70e8\microsoft.office.tools.outlook.implementation.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o4b20f4dd#\4d2bad5ec936377008a93f396794dbf0\microsoft.office.tools.outlook.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o4b20f4dd#\4d2bad5ec936377008a93f396794dbf0\microsoft.office.tools.outlook.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o4a946565#\aaabac3c8a4dba31c69f1a8ff723f678\microsoft.office.tools.common.implementation.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o4a946565#\aaabac3c8a4dba31c69f1a8ff723f678\microsoft.office.tools.common.implementation.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o4161a3a3#\3698bd0395802f909af1a9210e5862ae\microsoft.office.tools.excel.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o4161a3a3#\3698bd0395802f909af1a9210e5862ae\microsoft.office.tools.excel.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o2eb0cc9a#\5c2b20cdbb08fd3de41183705e67498c\microsoft.office.tools.v4.0.framework.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o2eb0cc9a#\5c2b20cdbb08fd3de41183705e67498c\microsoft.office.tools.v4.0.framework.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.mff1be75b#\c4c2b351cdb2b0044cb569b3f183311d\microsoft.managementconsole.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.mff1be75b#\c4c2b351cdb2b0044cb569b3f183311d\microsoft.managementconsole.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.mf49f6405#\8b813dc271fa16252a4df96c852536f1\microsoft.management.infrastructure.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.mf49f6405#\8b813dc271fa16252a4df96c852536f1\microsoft.management.infrastructure.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.ic1a2041b#\b3cdc5fdc17260058decb01b8ea25d28\microsoft.isam.esent.interop.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.ic1a2041b#\b3cdc5fdc17260058decb01b8ea25d28\microsoft.isam.esent.interop.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o5949707a#\3eb7f0b0b8c54ae5cb32675463db5fbc\microsoft.office.tools.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.o5949707a#\3eb7f0b0b8c54ae5cb32675463db5fbc\microsoft.office.tools.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p655586bb#\20f6bd0673094f5c46862419d2a2d3d5\microsoft.powershell.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p655586bb#\20f6bd0673094f5c46862419d2a2d3d5\microsoft.powershell.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p6f9a5e83#\847126d8892631d93b356536d691b80f\microsoft.powershell.security.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p6f9a5e83#\847126d8892631d93b356536d691b80f\microsoft.powershell.security.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p9de5a786#\05ee1ea3087b7f8c8cd33aaa7292f95e\microsoft.powershell.management.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p9de5a786#\05ee1ea3087b7f8c8cd33aaa7292f95e\microsoft.powershell.management.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w79a81d80#\6d0aef5ee1ed6932544953f3c8b1ac25\microsoft.windows.diagnosis.commands.writediagtelemetry.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w79a81d80#\6d0aef5ee1ed6932544953f3c8b1ac25\microsoft.windows.diagnosis.commands.writediagtelemetry.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w708fc392#\0a3f0e34e68ead210a99970eef56a062\microsoft.windows.diagnosis.commands.writediagprogress.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w708fc392#\0a3f0e34e68ead210a99970eef56a062\microsoft.windows.diagnosis.commands.writediagprogress.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w69ef49d2#\54de23eb71720485ab7c92b5224d8d83\microsoft.windows.diagnosis.commands.getdiaginput.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w69ef49d2#\54de23eb71720485ab7c92b5224d8d83\microsoft.windows.diagnosis.commands.getdiaginput.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w3cdb5602#\4f2a8d581f121fb80dd9c89ec05b2899\microsoft.windows.diagnosis.troubleshootingpack.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w3cdb5602#\4f2a8d581f121fb80dd9c89ec05b2899\microsoft.windows.diagnosis.troubleshootingpack.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w193497eb#\184f8686de942f712ed35f625de5456d\microsoft.wsman.runtime.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w193497eb#\184f8686de942f712ed35f625de5456d\microsoft.wsman.runtime.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w0bb5dac4#\987f2b2078b4211d541d479cf3f6dbcb\microsoft.windows.diagnosis.commands.updatediagrootcause.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w0bb5dac4#\987f2b2078b4211d541d479cf3f6dbcb\microsoft.windows.diagnosis.commands.updatediagrootcause.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.vff41975e#\9abf71bc94804e5825e5e982b3877fc7\microsoft.visualstudio.tools.office.containercontrol.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.vff41975e#\9abf71bc94804e5825e5e982b3877fc7\microsoft.visualstudio.tools.office.containercontrol.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.vf9a08577#\d54ae164857887d0dd90770fa4a0a956\microsoft.visualstudio.tools.applications.hosting.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.vf9a08577#\d54ae164857887d0dd90770fa4a0a956\microsoft.visualstudio.tools.applications.hosting.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.v883708cb#\22136f295c6c3877865e4b6efcf7ebbb\microsoft.visualstudio.tools.applications.runtime.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.v883708cb#\22136f295c6c3877865e4b6efcf7ebbb\microsoft.visualstudio.tools.applications.runtime.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.v5499e76b#\eba1ba42381aaacbe5f30001f817f2a8\microsoft.visualstudio.tools.office.runtime.internal.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.v5499e76b#\eba1ba42381aaacbe5f30001f817f2a8\microsoft.visualstudio.tools.office.runtime.internal.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.v28a60cc2#\bf5c825e0bafe433828cfe5829d54e6d\microsoft.visualstudio.tools.office.runtime.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.v28a60cc2#\bf5c825e0bafe433828cfe5829d54e6d\microsoft.visualstudio.tools.office.runtime.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.v1955d7fd#\a255665fb73f2e94eebe444cad6f0abc\microsoft.visualstudio.tools.applications.serverdocument.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.v1955d7fd#\a255665fb73f2e94eebe444cad6f0abc\microsoft.visualstudio.tools.applications.serverdocument.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.sb6a1f1bc#\a539bf080b2b2d5191928e77e7908d95\microsoft.security.applicationid.policymanagement.xmlhelper.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.sb6a1f1bc#\a539bf080b2b2d5191928e77e7908d95\microsoft.security.applicationid.policymanagement.xmlhelper.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.sa56e3556#\d097a90f3274e45670a56f4b344b0173\microsoft.security.applicationid.wizards.automaticrulegenerationwizard.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.sa56e3556#\d097a90f3274e45670a56f4b344b0173\microsoft.security.applicationid.wizards.automaticrulegenerationwizard.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.s88747207#\9dd48802eab80053be1c9b860527bde8\microsoft.security.applicationid.policymanagement.cmdlets.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.s88747207#\9dd48802eab80053be1c9b860527bde8\microsoft.security.applicationid.policymanagement.cmdlets.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.s54faafb0#\8c4b61755e690a4d25b042a94bc9cb2e\microsoft.security.applicationid.policymanagement.policymanager.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.s54faafb0#\8c4b61755e690a4d25b042a94bc9cb2e\microsoft.security.applicationid.policymanagement.policymanager.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.s356e1ba0#\c1ffa449956708fd3f9e13cd7268b2d0\microsoft.security.applicationid.policymanagement.policyengineapi.interop.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.s356e1ba0#\c1ffa449956708fd3f9e13cd7268b2d0\microsoft.security.applicationid.policymanagement.policyengineapi.interop.ni.dll.aux.donnycryp...
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.s0f8e494c#\00914fd7f4871076a09a8361b6407e96\microsoft.security.applicationid.policymanagement.policymodel.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.s0f8e494c#\00914fd7f4871076a09a8361b6407e96\microsoft.security.applicationid.policymanagement.policymodel.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.pefb7a36b#\0b18080b3f34557605d26ce2dc41ae90\microsoft.powershell.workflow.servicecore.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.pefb7a36b#\0b18080b3f34557605d26ce2dc41ae90\microsoft.powershell.workflow.servicecore.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.i0cd65b90#\eb5d89120e221a9ca3d53c31a8cee5ec\microsoft.isam.esent.interop.wsa.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.i0cd65b90#\eb5d89120e221a9ca3d53c31a8cee5ec\microsoft.isam.esent.interop.wsa.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.wad78daf4#\19799abd705fabb32e17b8024854e276\microsoft.windows.diagnosis.sdhost.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.wad78daf4#\19799abd705fabb32e17b8024854e276\microsoft.windows.diagnosis.sdhost.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.ga41585c2#\2a9fbd97486faa4537d675c3a42860dd\microsoft.grouppolicy.admtmpleditor.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.ga41585c2#\2a9fbd97486faa4537d675c3a42860dd\microsoft.grouppolicy.admtmpleditor.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.be5f4b329#\cd3944bdc592fa7008919b8c35ce758d\microsoft.businessdata.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.be5f4b329#\cd3944bdc592fa7008919b8c35ce758d\microsoft.businessdata.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.outlookviewctl\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.outlookviewctl.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.outlookviewctl\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.outlookviewctl.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.outlook\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.outlook.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.outlook\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.outlook.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.graph\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.graph.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.graph\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.graph.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.excel\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.excel.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.excel\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.excel.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.access.dao\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.access.dao.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.access.dao\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.access.dao.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.access\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.access.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.access\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.access.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.office\15.0.0.0__71e9bce111e9429c\policy.11.0.office.config to %WINDIR%\assembly\gac_msil\policy.11.0.office\15.0.0.0__71e9bce111e9429c\policy.11.0.office.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.vbe.interop\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.vbe.interop.config to %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.vbe.interop\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.vbe.interop.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.powerpoint\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.powerpoint.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.powerpoint\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.powerpoint.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.word\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.word.config to %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.word\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.word.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.publisher\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.publisher.config to %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.publisher\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.publisher.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.powerpoint\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.powerpoint.config to %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.powerpoint\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.powerpoint.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.outlookviewctl\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.outlookviewctl.config to %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.outlookviewctl\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.outlookviewctl.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.outlook\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.outlook.config to %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.outlook\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.outlook.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.graph\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.graph.config to %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.graph\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.graph.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.excel\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.excel.config to %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.excel\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.excel.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.access\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.access.config to %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.access\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.access.config.donnycrypted
from %WINDIR%\appcompat\programs\install\install_ffff_697d9b86-6ade-46f3-a917-2aeb844ae975.txt to %WINDIR%\appcompat\programs\install\install_ffff_697d9b86-6ade-46f3-a917-2aeb844ae975.txt.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.smarttag\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.smarttag.config to %WINDIR%\assembly\gac_msil\policy.11.0.microsoft.office.interop.smarttag\15.0.0.0__71e9bce111e9429c\policy.11.0.microsoft.office.interop.smarttag.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.publisher\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.publisher.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.publisher\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.publisher.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.smarttag\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.smarttag.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.smarttag\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.smarttag.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.word\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.word.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.office.interop.word\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.office.interop.word.config.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.abf69f55a#\b7edea024a20c635e8d5292e2c329677\microsoft.applicationid.framework.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.abf69f55a#\b7edea024a20c635e8d5292e2c329677\microsoft.applicationid.framework.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.a26c32abb#\499e2e5064ff4c4b13b7e8c54a84f0dc\microsoft.applicationid.rulewizard.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.a26c32abb#\499e2e5064ff4c4b13b7e8c54a84f0dc\microsoft.applicationid.rulewizard.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\eventviewer\70c11b05d6eafb19ab097271dd26274c\eventviewer.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\eventviewer\70c11b05d6eafb19ab097271dd26274c\eventviewer.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\auditpolicy42d3d2cc#\04b72d0f6071ce73c476f2a6852b237a\auditpolicygpmanagedstubs.interop.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\auditpolicy42d3d2cc#\04b72d0f6071ce73c476f2a6852b237a\auditpolicygpmanagedstubs.interop.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.office\15.0.0.0__71e9bce111e9429c\policy.14.0.office.config to %WINDIR%\assembly\gac_msil\policy.14.0.office\15.0.0.0__71e9bce111e9429c\policy.14.0.office.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.vbe.interop\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.vbe.interop.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.vbe.interop\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.vbe.interop.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.word\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.word.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.word\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.word.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.smarttag\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.smarttag.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.smarttag\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.smarttag.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.publisher\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.publisher.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.publisher\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.publisher.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.powerpoint\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.powerpoint.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.powerpoint\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.powerpoint.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.outlookviewctl\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.outlookviewctl.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.outlookviewctl\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.outlookviewctl.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.outlook\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.outlook.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.outlook\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.outlook.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.onenote\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.onenote.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.onenote\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.onenote.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.graph\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.graph.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.graph\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.graph.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.excel\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.excel.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.excel\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.excel.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.access.dao\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.access.dao.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.access.dao\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.access.dao.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.access\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.access.config to %WINDIR%\assembly\gac_msil\policy.14.0.microsoft.office.interop.access\15.0.0.0__71e9bce111e9429c\policy.14.0.microsoft.office.interop.access.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.office\15.0.0.0__71e9bce111e9429c\policy.12.0.office.config to %WINDIR%\assembly\gac_msil\policy.12.0.office\15.0.0.0__71e9bce111e9429c\policy.12.0.office.config.donnycrypted
from %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.vbe.interop\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.vbe.interop.config to %WINDIR%\assembly\gac_msil\policy.12.0.microsoft.vbe.interop\15.0.0.0__71e9bce111e9429c\policy.12.0.microsoft.vbe.interop.config.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.d0ff51f83#\24a3c32e454c9eda5348cb5a5113643f\microsoft.dtc.powershell.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.d0ff51f83#\24a3c32e454c9eda5348cb5a5113643f\microsoft.dtc.powershell.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.wcffedcb4#\1ec3696def913a9603ad72216a5fb62d\microsoft.windowssearch.commands.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.wcffedcb4#\1ec3696def913a9603ad72216a5fb62d\microsoft.windowssearch.commands.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p1706cafe#\4041e05b389ab68e2bd9b9b1e3f93da5\microsoft.powershell.commands.diagnostics.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.p1706cafe#\4041e05b389ab68e2bd9b9b1e3f93da5\microsoft.powershell.commands.diagnostics.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.wd518ee0d#\d96d84e888c08715e2a74a69346fbcd9\microsoft.windows.diagnosis.commands.updatediagreport.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.wd518ee0d#\d96d84e888c08715e2a74a69346fbcd9\microsoft.windows.diagnosis.commands.updatediagreport.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pad0e0718#\223ca723b6d4159b9826a2291fdafba5\microsoft.powershell.cmdletization.odata.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pad0e0718#\223ca723b6d4159b9826a2291fdafba5\microsoft.powershell.cmdletization.odata.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p1706cafe#\8d1a2ff8072ad7dce23549aee0ceef79\microsoft.powershell.commands.diagnostics.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p1706cafe#\8d1a2ff8072ad7dce23549aee0ceef79\microsoft.powershell.commands.diagnostics.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p9de5a786#\cf7a83055935fa0a27ae355488b761e0\microsoft.powershell.management.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p9de5a786#\cf7a83055935fa0a27ae355488b761e0\microsoft.powershell.management.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p6f9a5e83#\902ecb489c694af0d2b259b8f6309732\microsoft.powershell.security.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p6f9a5e83#\902ecb489c694af0d2b259b8f6309732\microsoft.powershell.security.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p6f792626#\589534c61ac5d23b468dbfc5927ddc95\microsoft.powershell.security.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p6f792626#\589534c61ac5d23b468dbfc5927ddc95\microsoft.powershell.security.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p655586bb#\a6c7b2797ac517dad631aec506bc4447\microsoft.powershell.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p655586bb#\a6c7b2797ac517dad631aec506bc4447\microsoft.powershell.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p521220ea#\42f19218132f5547df98f2e979d9bd79\microsoft.powershell.commands.utility.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p521220ea#\42f19218132f5547df98f2e979d9bd79\microsoft.powershell.commands.utility.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p39041136#\bb78f2894b7e2e731c5aed426f59c91a\microsoft.powershell.scheduledjob.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p39041136#\bb78f2894b7e2e731c5aed426f59c91a\microsoft.powershell.scheduledjob.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p34f388c1#\09fee58234516c33d8a50e559bb5e313\microsoft.powershell.diagnostics.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p34f388c1#\09fee58234516c33d8a50e559bb5e313\microsoft.powershell.diagnostics.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pcd26229b#\cb41bc94e8cb691e1d1b8ba51c45c593\microsoft.powershell.graphicalhost.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pcd26229b#\cb41bc94e8cb691e1d1b8ba51c45c593\microsoft.powershell.graphicalhost.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pae3498d9#\8cd0287e1c7526bc4842b6fa87752566\microsoft.powershell.commands.management.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pae3498d9#\8cd0287e1c7526bc4842b6fa87752566\microsoft.powershell.commands.management.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\075e3caa3c612007e48fe73bff1927f5\microsoft.powershell.consolehost.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\075e3caa3c612007e48fe73bff1927f5\microsoft.powershell.consolehost.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p08ac43d5#\572fd541180c256c34419477deabec03\microsoft.powershell.utility.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p08ac43d5#\572fd541180c256c34419477deabec03\microsoft.powershell.utility.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p047767ce#\01bcaba0db0fb414a71ff11df0b30c74\microsoft.powershell.core.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p047767ce#\01bcaba0db0fb414a71ff11df0b30c74\microsoft.powershell.core.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.oeab01fba#\f93d17f000c4ab501cb01694446cbc2d\microsoft.office.tools.word.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.oeab01fba#\f93d17f000c4ab501cb01694446cbc2d\microsoft.office.tools.word.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.oe2e369ff#\b3cf6bc3c5c4e4c0f8b813565a113a2e\microsoft.office.tools.excel.implementation.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.oe2e369ff#\b3cf6bc3c5c4e4c0f8b813565a113a2e\microsoft.office.tools.excel.implementation.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.oab3f8ec6#\c0cd89c860465af1129d098421e23744\microsoft.office.tools.word.implementation.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.oab3f8ec6#\c0cd89c860465af1129d098421e23744\microsoft.office.tools.word.implementation.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o854200f9#\0f904fc82f4d46e8b44f4caf4b5c4ade\microsoft.office.tools.common.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o854200f9#\0f904fc82f4d46e8b44f4caf4b5c4ade\microsoft.office.tools.common.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o5949707a#\688420b49192c36d11c0aff24bcb8099\microsoft.office.tools.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o5949707a#\688420b49192c36d11c0aff24bcb8099\microsoft.office.tools.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p0e11b656#\68df6d9beb9df6de10090c231ad84c4f\microsoft.powershell.gpowershell.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p0e11b656#\68df6d9beb9df6de10090c231ad84c4f\microsoft.powershell.gpowershell.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pd3efef62#\e0cea5e14b6dcd3a6a1042fd3ca608ea\microsoft.powershell.isecommon.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pd3efef62#\e0cea5e14b6dcd3a6a1042fd3ca608ea\microsoft.powershell.isecommon.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w2d29a719#\80dfb98728c09b32bb807718351a0d3c\microsoft.windows.dsc.coreconfproviders.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w2d29a719#\80dfb98728c09b32bb807718351a0d3c\microsoft.windows.dsc.coreconfproviders.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o5263ae01#\5d2b69f072515067117f6a7c2f3fc35c\microsoft.office.tools.outlook.implementation.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o5263ae01#\5d2b69f072515067117f6a7c2f3fc35c\microsoft.office.tools.outlook.implementation.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o4a946565#\e75af51eae42bed47193f2d7d6eba97f\microsoft.office.tools.common.implementation.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o4a946565#\e75af51eae42bed47193f2d7d6eba97f\microsoft.office.tools.common.implementation.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w193497eb#\6854c7300aadee717c569edba09be598\microsoft.wsman.runtime.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w193497eb#\6854c7300aadee717c569edba09be598\microsoft.wsman.runtime.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w0bb5dac4#\c99dd9a87a3a07d15692c87a150af6ef\microsoft.windows.diagnosis.commands.updatediagrootcause.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w0bb5dac4#\c99dd9a87a3a07d15692c87a150af6ef\microsoft.windows.diagnosis.commands.updatediagrootcause.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.vff41975e#\85382ac56b00e8f76243371b6c68f549\microsoft.visualstudio.tools.office.containercontrol.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.vff41975e#\85382ac56b00e8f76243371b6c68f549\microsoft.visualstudio.tools.office.containercontrol.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.vf9a08577#\9a49477876be0b159a127a75606a47ea\microsoft.visualstudio.tools.applications.hosting.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.vf9a08577#\9a49477876be0b159a127a75606a47ea\microsoft.visualstudio.tools.applications.hosting.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.v9921e851#\07679246e54ecef1ba12c861a887c534\microsoft.visualbasic.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.v9921e851#\07679246e54ecef1ba12c861a887c534\microsoft.visualbasic.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.v883708cb#\736124b52b8eb4a12a8a03914c47a532\microsoft.visualstudio.tools.applications.runtime.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.v883708cb#\736124b52b8eb4a12a8a03914c47a532\microsoft.visualstudio.tools.applications.runtime.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.v5499e76b#\ec7b06c95451ef30e37c449937569a37\microsoft.visualstudio.tools.office.runtime.internal.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.v5499e76b#\ec7b06c95451ef30e37c449937569a37\microsoft.visualstudio.tools.office.runtime.internal.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.v28a60cc2#\c617ee1b4d0d2cad07d1b000993978af\microsoft.visualstudio.tools.office.runtime.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.v28a60cc2#\c617ee1b4d0d2cad07d1b000993978af\microsoft.visualstudio.tools.office.runtime.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.v1955d7fd#\92954441c1d1573ec570a93942427d6e\microsoft.visualstudio.tools.applications.serverdocument.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.v1955d7fd#\92954441c1d1573ec570a93942427d6e\microsoft.visualstudio.tools.applications.serverdocument.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.t9d753d8c#\7e6b17c588dd850c9d36946cf03c08f3\microsoft.tpm.commands.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.t9d753d8c#\7e6b17c588dd850c9d36946cf03c08f3\microsoft.tpm.commands.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.sb6a1f1bc#\0609c30f3f59ab190149bbbac1cb4b1b\microsoft.security.applicationid.policymanagement.xmlhelper.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.sb6a1f1bc#\0609c30f3f59ab190149bbbac1cb4b1b\microsoft.security.applicationid.policymanagement.xmlhelper.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.sa56e3556#\86e531c5c6b70508c3b49cc66c257d16\microsoft.security.applicationid.wizards.automaticrulegenerationwizard.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.sa56e3556#\86e531c5c6b70508c3b49cc66c257d16\microsoft.security.applicationid.wizards.automaticrulegenerationwizard.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.s88747207#\525d43ecc4c7a4304e7da192bc098022\microsoft.security.applicationid.policymanagement.cmdlets.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.s88747207#\525d43ecc4c7a4304e7da192bc098022\microsoft.security.applicationid.policymanagement.cmdlets.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.s54faafb0#\97c2c33343ef578910a6824b75591141\microsoft.security.applicationid.policymanagement.policymanager.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.s54faafb0#\97c2c33343ef578910a6824b75591141\microsoft.security.applicationid.policymanagement.policymanager.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.s356e1ba0#\ba1a01a3140ad106cb370261144db361\microsoft.security.applicationid.policymanagement.policyengineapi.interop.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.s356e1ba0#\ba1a01a3140ad106cb370261144db361\microsoft.security.applicationid.policymanagement.policyengineapi.interop.ni.dll.aux.donnycryp...
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.s1bc92e04#\3aec8600f504f01be9ca320ec4096957\microsoft.secureboot.commands.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.s1bc92e04#\3aec8600f504f01be9ca320ec4096957\microsoft.secureboot.commands.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.s0f8e494c#\25b34307182a62508edb6b2b2e8fabbd\microsoft.security.applicationid.policymanagement.policymodel.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.s0f8e494c#\25b34307182a62508edb6b2b2e8fabbd\microsoft.security.applicationid.policymanagement.policymodel.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pefb7a36b#\a41e5db33b1ea467cd927e36d0f62a9c\microsoft.powershell.workflow.servicecore.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.pefb7a36b#\a41e5db33b1ea467cd927e36d0f62a9c\microsoft.powershell.workflow.servicecore.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p10d01611#\d22c48fdcfb269605655bb88b735f801\microsoft.powershell.editor.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.p10d01611#\d22c48fdcfb269605655bb88b735f801\microsoft.powershell.editor.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o4b20f4dd#\b57beb22042d26933800b79f6c822f1e\microsoft.office.tools.outlook.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o4b20f4dd#\b57beb22042d26933800b79f6c822f1e\microsoft.office.tools.outlook.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o4161a3a3#\86e6cebeb641463041b9d780489282f3\microsoft.office.tools.excel.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o4161a3a3#\86e6cebeb641463041b9d780489282f3\microsoft.office.tools.excel.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.we9f24001#\fadf35a12bcad5afa2614ec1277b9b2c\microsoft.wsman.management.activities.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.we9f24001#\fadf35a12bcad5afa2614ec1277b9b2c\microsoft.wsman.management.activities.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\srpuxsnapin\52bcf5c771bc0d9449fefef539262188\srpuxsnapin.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\srpuxsnapin\52bcf5c771bc0d9449fefef539262188\srpuxsnapin.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.xml\c4ffd21a36faf0241c78216a619f2623\system.xml.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.xml\c4ffd21a36faf0241c78216a619f2623\system.xml.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.xaml\7f519460610808a56104a1722db7a02c\system.xaml.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.xaml\7f519460610808a56104a1722db7a02c\system.xaml.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.runteb92aa12#\6031b6bf010e37836cce5e0fd81ec07d\system.runtime.serialization.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.runteb92aa12#\6031b6bf010e37836cce5e0fd81ec07d\system.runtime.serialization.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.runtc259d85b#\4c3053ab03b2482ad3bc260d9ae2a68e\system.runtime.windowsruntime.ui.xaml.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.runtc259d85b#\4c3053ab03b2482ad3bc260d9ae2a68e\system.runtime.windowsruntime.ui.xaml.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.net.http\e2254c3b4ea55b8b86bb2ae5c52fff47\system.net.http.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.net.http\e2254c3b4ea55b8b86bb2ae5c52fff47\system.net.http.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.core\84705775928cda4b16362bb96b8bc12c\system.core.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.core\84705775928cda4b16362bb96b8bc12c\system.core.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.configuration\d60f2999cd2ec3cd51c7ba6167d5ab8c\system.configuration.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.configuration\d60f2999cd2ec3cd51c7ba6167d5ab8c\system.configuration.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system\3b82ac2a7aa1eb0957c2ba3eb9eaaa93\system.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system\3b82ac2a7aa1eb0957c2ba3eb9eaaa93\system.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\securityaudf6921413#\d8a166d943ad154098e0db89fa5885c0\securityauditpoliciessnapin.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\securityaudf6921413#\d8a166d943ad154098e0db89fa5885c0\securityauditpoliciessnapin.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\taskscheduler\56fe05ead08ebaabb285725ac1d60e96\taskscheduler.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\taskscheduler\56fe05ead08ebaabb285725ac1d60e96\taskscheduler.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentationcore\bca9a0d854d914dab4c185b5643eb002\presentationcore.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentationcore\bca9a0d854d914dab4c185b5643eb002\presentationcore.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentatioaec034ca#\9d2a868c5dea06ce323b2ff9340dd7b4\presentationframework.aero2.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentatioaec034ca#\9d2a868c5dea06ce323b2ff9340dd7b4\presentationframework.aero2.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentatio5ae0f00f#\fe3be0ddd71190dab0559bff81e983e0\presentationframework.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentatio5ae0f00f#\fe3be0ddd71190dab0559bff81e983e0\presentationframework.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\napinit\4ae934f030b3a88650e215a59620a7b9\napinit.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\napinit\4ae934f030b3a88650e215a59620a7b9\napinit.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\mscorlib\2fd365eef9c2999c233994057e037e6b\mscorlib.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\mscorlib\2fd365eef9c2999c233994057e037e6b\mscorlib.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\mmcfxcommon\b88dd102804927692f24dff2b0230115\mmcfxcommon.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\mmcfxcommon\b88dd102804927692f24dff2b0230115\mmcfxcommon.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\mmcex\70e9f3cac2d56b4e9754d144f268bb2a\mmcex.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\mmcex\70e9f3cac2d56b4e9754d144f268bb2a\mmcex.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.wed3937f9#\92f1a7163474d76c3740f466bb50fef1\microsoft.windows.diagnosis.sdcommon.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.wed3937f9#\92f1a7163474d76c3740f466bb50fef1\microsoft.windows.diagnosis.sdcommon.ni.dll.aux.donnycrypted
from %WINDIR%\fonts\maian.ttf to %WINDIR%\fonts\maian.ttf.donnycrypted
from %WINDIR%\fonts\lbrited.ttf to %WINDIR%\fonts\lbrited.ttf.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\windowsbase\156861e2108bdfc6b447a8221eff17f5\windowsbase.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\windowsbase\156861e2108bdfc6b447a8221eff17f5\windowsbase.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\custommarshalers\afa65d068afa02b20db5c41ea5b9ce77\custommarshalers.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\custommarshalers\afa65d068afa02b20db5c41ea5b9ce77\custommarshalers.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.xml.linq\8635e8acb0e225221a2faf53c431e68a\system.xml.linq.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.xml.linq\8635e8acb0e225221a2faf53c431e68a\system.xml.linq.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o2eb0cc9a#\967d324703859d25f074239378493df0\microsoft.office.tools.v4.0.framework.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.o2eb0cc9a#\967d324703859d25f074239378493df0\microsoft.office.tools.v4.0.framework.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.mff1be75b#\593e839119e822fea522c4926cd3b81d\microsoft.managementconsole.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.mff1be75b#\593e839119e822fea522c4926cd3b81d\microsoft.managementconsole.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.mf5ac9168#\1159545cc420f4283c2d95298a80fe60\microsoft.management.infrastructure.cimcmdlets.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.mf5ac9168#\1159545cc420f4283c2d95298a80fe60\microsoft.management.infrastructure.cimcmdlets.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.mf49f6405#\634f52e7ab2a274689942d4783065e6e\microsoft.management.infrastructure.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.mf49f6405#\634f52e7ab2a274689942d4783065e6e\microsoft.management.infrastructure.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.m870d558a#\5897615f3e29177dcfcbbabed4e02e8b\microsoft.management.infrastructure.native.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.m870d558a#\5897615f3e29177dcfcbbabed4e02e8b\microsoft.management.infrastructure.native.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.kd58820a5#\5bf48dc7ce5a1864bfb7fd7de6ca099e\microsoft.keydistributionservice.cmdlets.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.kd58820a5#\5bf48dc7ce5a1864bfb7fd7de6ca099e\microsoft.keydistributionservice.cmdlets.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.ic1a2041b#\0ce2702901bcc15480ff45d18b31ed45\microsoft.isam.esent.interop.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.ic1a2041b#\0ce2702901bcc15480ff45d18b31ed45\microsoft.isam.esent.interop.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.i7676db1a#\28cd3119d831c2149496764f9c52e0ef\microsoft.internationalsettings.commands.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.i7676db1a#\28cd3119d831c2149496764f9c52e0ef\microsoft.internationalsettings.commands.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.i0cd65b90#\698631f2f132e111563d88fd08874289\microsoft.isam.esent.interop.wsa.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.i0cd65b90#\698631f2f132e111563d88fd08874289\microsoft.isam.esent.interop.wsa.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.ga41585c2#\4bce36e2fcfd84fe92236c2d0ca95746\microsoft.grouppolicy.admtmpleditor.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.ga41585c2#\4bce36e2fcfd84fe92236c2d0ca95746\microsoft.grouppolicy.admtmpleditor.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.g91a07420#\79d2872bcae2888b0a9d8d8b0ae25306\microsoft.grouppolicy.reporting.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.g91a07420#\79d2872bcae2888b0a9d8d8b0ae25306\microsoft.grouppolicy.reporting.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.g46fcc235#\a99fbca3367201c8bb84c031de2a1903\microsoft.grouppolicy.interop.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.g46fcc235#\a99fbca3367201c8bb84c031de2a1903\microsoft.grouppolicy.interop.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.d0ff51f83#\7e2b1b8c39d88c589817772b72959a48\microsoft.dtc.powershell.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.d0ff51f83#\7e2b1b8c39d88c589817772b72959a48\microsoft.dtc.powershell.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.c99be4d25#\e106ccf0dca49636e110d32e713a3bfe\microsoft.configci.commands.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.c99be4d25#\e106ccf0dca49636e110d32e713a3bfe\microsoft.configci.commands.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.c26a36d2b#\53ac4c6ecba2afde863751c06b3c3ea4\microsoft.certificateservices.pkiclient.cmdlets.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.c26a36d2b#\53ac4c6ecba2afde863751c06b3c3ea4\microsoft.certificateservices.pkiclient.cmdlets.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.abf69f55a#\436b75c1f98276ccfc496abafc5b3fda\microsoft.applicationid.framework.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.abf69f55a#\436b75c1f98276ccfc496abafc5b3fda\microsoft.applicationid.framework.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.a26c32abb#\f6c9401e5f11afbd2d34f8350282aa7e\microsoft.applicationid.rulewizard.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.a26c32abb#\f6c9401e5f11afbd2d34f8350282aa7e\microsoft.applicationid.rulewizard.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\eventviewer\2779b6ef04a451ad52dbb341d4db3c36\eventviewer.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\eventviewer\2779b6ef04a451ad52dbb341d4db3c36\eventviewer.ni.dll.aux.donnycrypted
from %WINDIR%\assembly\nativeimages_v4.0.30319_64\auditpolicy42d3d2cc#\361b72c8d7abaeeefcbec8762e505c45\auditpolicygpmanagedstubs.interop.ni.dll.aux to %WINDIR%\assembly\nativeimages_v4.0.30319_64\auditpolicy42d3d2cc#\361b72c8d7abaeeefcbec8762e505c45\auditpolicygpmanagedstubs.interop.ni.dll.aux.donnycrypted
from %WINDIR%\fonts\maturasc.ttf to %WINDIR%\fonts\maturasc.ttf.donnycrypted

Modifies the following files

%HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\favorites\bing.url
%HOMEPATH%\searches\winrt--{s-1-5-21-2377844457-1847597103-2569463324-1000}-.searchconnector-ms

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: 'OleMainThreadWndClass' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial