Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Trojan.MulDrop11.41422

Added to the Dr.Web virus database: 2020-02-13

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKLM>\Software\Classes\NWBCfile\shell\open\command] '' = '%ProgramFiles(x86)%\SAP\NWBC50\NWBC.exe %1'
  • [<HKLM>\Software\Classes\sapnwbc\shell\open\command] '' = '"%ProgramFiles(x86)%\SAP\NWBC50\NwbcUrlHandler.exe" "%1"'
  • [<HKLM>\Software\Classes\sap-nwbc\shell\open\command] '' = '"%ProgramFiles(x86)%\SAP\NWBC50\NwbcUrlHandler.exe" "%1"'
Modifies file system
Creates the following files
  • %TEMP%\ixp000.tmp\nwbc50~1.exe
  • %ProgramFiles(x86)%\sap\nwbc50\nwbccore.exe
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcdesktopagent.exe
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcconfiguration.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcbrowsercom.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcbrowser.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbc.exe
  • %ProgramFiles(x86)%\sap\nwbc50\interop.saprotwr.dll
  • %ProgramFiles(x86)%\sap\nwbc50\interop.sapfewselib.dll
  • %PROGRAMDATA%\application data\sap\nwbc\nwbcremoteoptions.xml.template
  • %ProgramFiles(x86)%\sap\nwbc50\interop.shdocvw.dll
  • %ProgramFiles(x86)%\sap\nwbc50\interop.browserutil.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcsettings.dll
  • %ProgramFiles(x86)%\sap\nwbc50\browserutil.dll
  • %ProgramFiles(x86)%\sap\nwbc50\browserserver.exe
  • %ProgramFiles(x86)%\sap\nwbc50\axinterop.browserutil.dll
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapstart.exe
  • %ProgramFiles(x86)%\sap\sapsetup\logs\nwsapsetup.log
  • %TEMP%\sapa0a8.tmp\sapsx.cfg
  • %ProgramFiles(x86)%\sap\nwbc50\interop.mssearch.dll
  • %TEMP%\sapa0a8.tmp\setup\serverrecord.xml
  • %TEMP%\sapa0a8.tmp\setup\scriptsamples.xml
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcmodel.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcdesktopsearch.dll
  • %PROGRAMDATA%\application data\sap\nwbc\nwbcoptions.xml.template
  • %PROGRAMDATA%\application data\sap\nwbc\nwbcoptions.xsd
  • %ProgramFiles(x86)%\sap\nwbc50\reset_fontcache.bat
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcpropertycollector.exe
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcextensionapi.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcpluginapi.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcutil.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcfederatedruntime.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbctaskbarhandler.exe
  • %ProgramFiles(x86)%\sap\nwbc50\nwbchttpruntime.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbctranslation.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcsapguiextractor.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcsapguiruntime.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcsapguicom.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcremoting.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcpipelib.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcthemes.dll
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcurlhandler.exe
  • %TEMP%\sapa0a8.tmp\setup\sapmsoffice2003piashared.xml
  • %ProgramFiles(x86)%\sap\nwbc50\nwbcuiutil.dll
  • %TEMP%\sapa0a8.tmp\setup\sapvc12rtshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsncclientencryptionsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsncclientencryptionlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsetupvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsetuplocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sappackagesetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapnwrfcx86shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapnwbc50vars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapwuslocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapnwbc50shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapnwbc50locale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsvcr71shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsvcp71shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsofficepiavars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsofficepiashared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsofficepiaextvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsofficepiaextshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsoffice2010piashared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapnwbc50setup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapwusshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapwussetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsrxshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsrxlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapwdtlogocxshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvisualenterpriseviewerlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvevvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvevshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvevsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvegdtfontshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvefiletransfershared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsrxsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvedirectx9sdkshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsncclientencryptionvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc11rtx64shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc11rtshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc10rtx64shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc10rtshared.xml
  • %TEMP%\sapa0a8.tmp\setup\saptwk_setup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapstartshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsrxvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc8rtshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsoffice2007piashared.xml
  • %ProgramFiles(x86)%\sap\nwbc50\documentation\nwbc50.pdf
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_et.txt
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapnwbc50wksta.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapguinwbcwksta.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapguinwbcwksta.xml
  • C:\users\public\desktop\netweaver business client 5.0.lnk
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\netweaver business client 5.0.lnk
  • %ProgramFiles(x86)%\sap\sapsetup\setup\productvars.dtd
  • %ProgramFiles(x86)%\sap\sapsetup\setup\productlocales.dtd
  • %ProgramFiles(x86)%\sap\sapsetup\setup\productdefinition2.dtd
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapsplash.jpg
  • %ProgramFiles(x86)%\sap\sapsetup\setup\productdefinition.dtd
  • %ProgramFiles(x86)%\sap\sapsetup\setup\processconfig.cfg
  • %ProgramFiles(x86)%\sap\sapsetup\setup\nwsnapshot64.exe
  • %ProgramFiles(x86)%\sap\sapsetup\setup\nwsapfeiut.dll
  • %ProgramFiles(x86)%\sap\sapsetup\setup\nwsapfeilg.dll
  • %ProgramFiles(x86)%\sap\sapsetup\setup\dotnetutils20.exe
  • %ProgramFiles(x86)%\sap\sapsetup\setup\dotnetutils40.exe
  • %ProgramFiles(x86)%\sap\sapsetup\setup\nwsapsetupui.dll
  • %ProgramFiles(x86)%\sap\sapsetup\setup\nwsapsetupatlcommon.dll
  • %ProgramFiles(x86)%\sap\sapsetup\setup\productcommon.dtd
  • %ProgramFiles(x86)%\sap\sapsetup\setup\nwsapsetupengine.dll
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapnwbc50wksta.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapvc12rtwksta.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapsetuplocale.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapsetuplocale.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapnwbc50locale.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapnwbc50locale.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapguinwbclocale.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapguinwbclocale.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapwkstavars.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapwkstavars.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapnwbc50wkstaui.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapnwbc50wkstaui.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapvc11rtwksta.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapvc11rtwksta.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapstartwksta.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapstartwksta.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapsetupwksta.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapsetupwksta.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sappackagewksta.xml.xig
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sappackagewksta.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapvc12rtwksta.xml.xig
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_ar.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2.txt
  • %ProgramFiles(x86)%\sap\sapsetup\setup\nwcheckworkstation.exe
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_fi.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_ko.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_ja.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_it.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_hu.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_hr.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_he.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_fr.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_lt.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_lv.txt
  • %ProgramFiles(x86)%\sap\sapsetup\setup\nwsapsetuponrebootinstsvc.exe
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_en.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_el.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_de.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_da.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_cs.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_ca.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_bg.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_es.txt
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapsetuperror.xsl
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_nl.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_tr.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_zh_cn.txt
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapregsv.exe
  • %ProgramFiles(x86)%\sap\sapsetup\setup\mfcm120u.dll
  • %ProgramFiles(x86)%\sap\sapsetup\setup\mfc120u.dll
  • %ProgramFiles(x86)%\sap\sapsetup\setup\msvcr120.dll
  • %ProgramFiles(x86)%\sap\sapsetup\setup\msvcp120.dll
  • %TEMP%\sapstart.log
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_zh_tw.txt
  • %ProgramFiles(x86)%\sap\sapsetup\setup\nwsapsetup.exe
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_no.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_pl.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_sv.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_sl.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_sk.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_sh.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_ru.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_ro.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_pt.txt
  • %ProgramFiles(x86)%\sap\nwbc50\lang\nwbcv2_th.txt
  • %TEMP%\sapa0a8.tmp\setup\sapmfc71shared.xml
  • %TEMP%\sapa0a8.tmp\setup\saplibrfc32x64shared.xml
  • %TEMP%\sapa0a8.tmp\setup\saplibrfc32ushared.xml
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcthemes.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcmodel.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcfederatedruntime.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcdesktopsearch.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbchttpruntime.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbccore.exe
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcdesktopagent.exe
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcremoting.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcconfiguration.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcbrowser.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbc.exe
  • %TEMP%\sapa0a8.tmp\nwbc\interop.saprotwr.dll
  • %TEMP%\sapa0a8.tmp\nwbc\interop.sapfewselib.dll
  • %TEMP%\sapa0a8.tmp\nwbc\interop.shdocvw.dll
  • %TEMP%\sapa0a8.tmp\nwbc\interop.mssearch.dll
  • %TEMP%\sapa0a8.tmp\nwbc\interop.browserutil.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcsettings.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcbrowsercom.dll
  • %TEMP%\sapa0a8.tmp\nwbc\browserutil.dll
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_da.txt
  • %TEMP%\sapa0a8.tmp\nwbc\browserserver.exe
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_cs.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ca.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_bg.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ar.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2.txt
  • %TEMP%\sapa0a8.tmp\nwbc\documentation\nwbc50.pdf
  • %TEMP%\sapa0a8.tmp\nwbc\configuration\nwbcremoteoptions.xml.template
  • %TEMP%\sapa0a8.tmp\nwbc\configuration\nwbcoptions.xml.template
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcsapguiruntime.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcsapguicom.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcpropertycollector.exe
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcextensionapi.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcpluginapi.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcutil.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbctaskbarhandler.exe
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcurlhandler.exe
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcuiutil.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbctranslation.dll
  • %TEMP%\sapa0a8.tmp\nwbc\reset_fontcache.bat
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcsapguiextractor.dll
  • %TEMP%\sapa0a8.tmp\nwbc\configuration\nwbcoptions.xsd
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\vcomp110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110cht.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\msvcp120.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfcm120u.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfcm120.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120u.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120rus.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120kor.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120jpn.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\vcamp120.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120ita.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120esn.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120enu.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120deu.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120cht.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120chs.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120.dll
  • %TEMP%\sapa0a8.tmp\setup\sapstart.exe
  • %ProgramFiles(x86)%\sap\sapsetup\logs\nwbc50~1.log
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120fra.dll
  • %TEMP%\sapa0a8.tmp\nwbc\axinterop.browserutil.dll
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_de.txt
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\msvcr120.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110rus.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110kor.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110jpn.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110ita.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110fra.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110esn.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110enu.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110deu.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\vcomp120.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\vccorlib120.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfcm110u.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfcm110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110u.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\vcamp110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\atl110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\vccorlib110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\msvcp110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110chs.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\msvcr110.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcpipelib.dll
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_el.txt
  • %TEMP%\sapa0a8.tmp\setup\sapdhtmledshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapaxlshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapchartocxshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapbwcommon.xml
  • %TEMP%\sapa0a8.tmp\setup\sapbivars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapbishared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapbisetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapbilocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapaxlvars.xml
  • %TEMP%\sapa0a8.tmp\setup\nwsapfeiut.dll
  • %TEMP%\sapa0a8.tmp\setup\sapguilocale.xml
  • %TEMP%\sapa0a8.tmp\setup\processconfig.cfg
  • %TEMP%\sapa0a8.tmp\setup\sapatl71shared.xml
  • %TEMP%\sapa0a8.tmp\setup\productvars.dtd
  • %TEMP%\sapa0a8.tmp\setup\productlocales.dtd
  • %TEMP%\sapa0a8.tmp\setup\productdefinition2.dtd
  • %TEMP%\sapa0a8.tmp\setup\productdefinition.dtd
  • %TEMP%\sapa0a8.tmp\setup\productcommon.dtd
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetupis.exe
  • %TEMP%\sapa0a8.tmp\setup\sapaxllocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapaxlsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguinwbclocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapishmedshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapishmedvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapkw_setup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapkwshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapkwlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapjnetvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapjnetshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapjnetsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapjnetlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\saplibrfc32shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguinwbcsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguinwbcshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapishmedlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapicu_50shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguivars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguishared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguisetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguipackage.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguinwbcvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapishmedsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\nwsnapshot64.exe
  • %TEMP%\sapa0a8.tmp\setup\nwsapfeilg.dll
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_en.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ro.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_pt.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_pl.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_no.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_nl.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_lv.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_lt.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_sh.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ko.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_it.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_hu.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_hr.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_he.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_fr.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_fi.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_et.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_es.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ja.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_sk.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ru.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_sl.txt
  • %TEMP%\sapa0a8.tmp\setup\dotnetutils20.exe
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetup.exe
  • %TEMP%\sapa0a8.tmp\setup\dotnetutils40.exe
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetupui.dll
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetupatlcommon.dll
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetupengine.dll
  • %TEMP%\sapa0a8.tmp\setup\sapsplash.jpg
  • %TEMP%\sapa0a8.tmp\setup\sapsetuperror.xsl
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetuponrebootinstsvc.exe
  • %TEMP%\sapa0a8.tmp\setup\nwcheckworkstation.exe
  • %TEMP%\sapa0a8.tmp\setup\sapregsv.exe
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_sv.txt
  • %TEMP%\sapa0a8.tmp\setup\mfcm120u.dll
  • %TEMP%\sapa0a8.tmp\setup\mfc120u.dll
  • %TEMP%\sapa0a8.tmp\setup\msvcr120.dll
  • %TEMP%\sapa0a8.tmp\setup\msvcp120.dll
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_zh_tw.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_zh_cn.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_tr.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_th.txt
  • %ProgramFiles(x86)%\sap\sapsetup\setup\sapwkstasetup.xml
  • %ProgramFiles(x86)%\sap\sapsetup\setup\signatures\sapwkstasetup.xml.xig
Deletes the following files
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcthemes.dll
  • %TEMP%\sapa0a8.tmp\setup\sapaxlshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapaxlvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapbilocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapbisetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapbishared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapbivars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapbwcommon.xml
  • %TEMP%\sapa0a8.tmp\setup\sapchartocxshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapdhtmledshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguilocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguinwbclocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguinwbcshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapjnetsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguinwbcvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguipackage.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguisetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguishared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguivars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapicu_50shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapishmedlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapishmedsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapishmedshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapishmedvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapjnetlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapaxlsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapguinwbcsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapaxllocale.xml
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetupatlcommon.dll
  • %TEMP%\sapa0a8.tmp\setup\msvcp120.dll
  • %TEMP%\sapa0a8.tmp\setup\msvcr120.dll
  • %TEMP%\sapa0a8.tmp\setup\mfc120u.dll
  • %TEMP%\sapa0a8.tmp\setup\mfcm120u.dll
  • %TEMP%\sapa0a8.tmp\setup\sapregsv.exe
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetup.exe
  • %TEMP%\sapa0a8.tmp\setup\nwcheckworkstation.exe
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetuponrebootinstsvc.exe
  • %TEMP%\sapa0a8.tmp\setup\sapsetuperror.xsl
  • %TEMP%\sapa0a8.tmp\setup\sapsplash.jpg
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetupengine.dll
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetupui.dll
  • %TEMP%\sapa0a8.tmp\setup\productvars.dtd
  • %TEMP%\sapa0a8.tmp\setup\dotnetutils40.exe
  • %TEMP%\sapa0a8.tmp\setup\dotnetutils20.exe
  • %TEMP%\sapa0a8.tmp\setup\nwsapfeilg.dll
  • %TEMP%\sapa0a8.tmp\setup\nwsapfeiut.dll
  • %TEMP%\sapa0a8.tmp\setup\nwsnapshot64.exe
  • %TEMP%\sapa0a8.tmp\setup\processconfig.cfg
  • %TEMP%\sapa0a8.tmp\setup\nwsapsetupis.exe
  • %TEMP%\sapa0a8.tmp\setup\productcommon.dtd
  • %TEMP%\sapa0a8.tmp\setup\productdefinition.dtd
  • %TEMP%\sapa0a8.tmp\setup\productdefinition2.dtd
  • %TEMP%\sapa0a8.tmp\setup\productlocales.dtd
  • %TEMP%\sapa0a8.tmp\setup\sapatl71shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsofficepiavars.xml
  • %TEMP%\sapa0a8.tmp\sapsx.cfg
  • %TEMP%\sapa0a8.tmp\setup\sapkwlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsrxsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsrxshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsrxvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapstartshared.xml
  • %TEMP%\sapa0a8.tmp\setup\saptwk_setup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc10rtshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc10rtx64shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc11rtshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc11rtx64shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc12rtshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvc8rtshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvefiletransfershared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapjnetvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvegdtfontshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvevsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvevshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvevvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvisualenterpriseviewerlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapwdtlogocxshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapwuslocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapwussetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapwusshared.xml
  • %TEMP%\sapa0a8.tmp\setup\scriptsamples.xml
  • %TEMP%\sapa0a8.tmp\setup\serverrecord.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsrxlocale.xml
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_zh_tw.txt
  • %TEMP%\sapa0a8.tmp\setup\sapsncclientencryptionvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsofficepiashared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapkwshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapkw_setup.xml
  • %TEMP%\sapa0a8.tmp\setup\saplibrfc32shared.xml
  • %TEMP%\sapa0a8.tmp\setup\saplibrfc32ushared.xml
  • %TEMP%\sapa0a8.tmp\setup\saplibrfc32x64shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmfc71shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsoffice2003piashared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsoffice2007piashared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsoffice2010piashared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsofficepiaextshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsofficepiaextvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapjnetshared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsncclientencryptionlocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsvcp71shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapmsvcr71shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapnwbc50locale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapnwbc50setup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapnwbc50shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sapnwbc50vars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapnwrfcx86shared.xml
  • %TEMP%\sapa0a8.tmp\setup\sappackagesetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsetuplocale.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsetupvars.xml
  • %TEMP%\sapa0a8.tmp\setup\sapsncclientencryptionsetup.xml
  • %TEMP%\sapa0a8.tmp\setup\sapvedirectx9sdkshared.xml
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_zh_cn.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ko.txt
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfcm110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfcm110u.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110chs.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110cht.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110deu.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110enu.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110esn.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110fra.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110ita.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110jpn.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110kor.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\vcomp110.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcbrowsercom.dll
  • %TEMP%\sapa0a8.tmp\nwbc\axinterop.browserutil.dll
  • %TEMP%\sapa0a8.tmp\nwbc\browserserver.exe
  • %TEMP%\sapa0a8.tmp\nwbc\browserutil.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcsettings.dll
  • %TEMP%\sapa0a8.tmp\nwbc\interop.browserutil.dll
  • %TEMP%\sapa0a8.tmp\nwbc\interop.mssearch.dll
  • %TEMP%\sapa0a8.tmp\nwbc\interop.shdocvw.dll
  • %TEMP%\sapa0a8.tmp\nwbc\interop.sapfewselib.dll
  • %TEMP%\sapa0a8.tmp\nwbc\interop.saprotwr.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbc.exe
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcbrowser.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110u.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110rus.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\mfc110.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120kor.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcdesktopagent.exe
  • %TEMP%\sapa0a8.tmp\setup\sapstart.exe
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120chs.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120cht.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120deu.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120enu.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120esn.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120fra.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120ita.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120jpn.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120rus.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\atl110.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfc120u.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfcm120.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\mfcm120u.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\msvcp120.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\msvcr120.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\vcamp120.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\vccorlib120.dll
  • %TEMP%\sapa0a8.tmp\system\vc12\x86\vcomp120.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\msvcr110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\msvcp110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\vccorlib110.dll
  • %TEMP%\sapa0a8.tmp\system\vc11\x86\vcamp110.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcutil.dll
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_th.txt
  • %TEMP%\sapa0a8.tmp\nwbc\nwbchttpruntime.dll
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_el.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_en.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_es.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_et.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_fi.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_fr.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_he.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_hr.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_hu.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_it.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ja.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_lt.txt
  • %TEMP%\sapa0a8.tmp\nwbc\nwbccore.exe
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_lv.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_nl.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_no.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_pl.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_pt.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ro.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ru.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_sh.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_sk.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_sl.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_sv.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_de.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_tr.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_da.txt
  • %TEMP%\sapa0a8.tmp\nwbc\nwbctaskbarhandler.exe
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcdesktopsearch.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcfederatedruntime.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcmodel.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcpipelib.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcremoting.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcsapguicom.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcsapguiruntime.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcsapguiextractor.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbctranslation.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcuiutil.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcurlhandler.exe
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcconfiguration.dll
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ca.txt
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcpluginapi.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcextensionapi.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcpropertycollector.exe
  • %TEMP%\sapa0a8.tmp\nwbc\reset_fontcache.bat
  • %TEMP%\sapa0a8.tmp\nwbc\configuration\nwbcoptions.xsd
  • %TEMP%\sapa0a8.tmp\nwbc\configuration\nwbcoptions.xml.template
  • %TEMP%\sapa0a8.tmp\nwbc\configuration\nwbcremoteoptions.xml.template
  • %TEMP%\sapa0a8.tmp\nwbc\documentation\nwbc50.pdf
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_ar.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_bg.txt
  • %TEMP%\sapa0a8.tmp\nwbc\lang\nwbcv2_cs.txt
  • %TEMP%\ixp000.tmp\nwbc50~1.exe
Substitutes the following files
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcthemes.dll
  • %TEMP%\sapa0a8.tmp\nwbc\nwbcdesktopagent.exe
Miscellaneous
Creates and executes the following
  • '%TEMP%\ixp000.tmp\nwbc50~1.exe' /Silent /Package="NWBC50"
  • '%TEMP%\sapa0a8.tmp\setup\nwsapsetup.exe' /package:"cb59c355-efb2-41fb-9ef2-3db3753eb15c" /Silent /Package=NWBC50
  • '%TEMP%\sapa0a8.tmp\setup\sapregsv.exe' "%ProgramFiles(x86)%\SAP\NWBC50\browserserver.exe" /s /w
  • '%ProgramFiles(x86)%\sap\nwbc50\browserserver.exe' /RegServer
  • '%TEMP%\sapa0a8.tmp\setup\sapregsv.exe' "%ProgramFiles(x86)%\SAP\NWBC50\BrowserUtil.dll" /s /w
  • '%ProgramFiles(x86)%\sap\sapsetup\setup\sapstart.exe' /refresh
  • '%TEMP%\ixp000.tmp\nwbc50~1.exe' /Silent /Package="NWBC50"' (with hidden window)
  • '%TEMP%\sapa0a8.tmp\setup\sapregsv.exe' "%ProgramFiles(x86)%\SAP\NWBC50\browserserver.exe" /s /w' (with hidden window)
  • '%TEMP%\sapa0a8.tmp\setup\sapregsv.exe' "%ProgramFiles(x86)%\SAP\NWBC50\BrowserUtil.dll" /s /w' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' "%ProgramFiles(x86)%\SAP\NWBC50\NwbcThemes.dll" /Silent /Codebase /unregister' (with hidden window)
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' "%ProgramFiles(x86)%\SAP\NWBC50\NwbcDesktopAgent.exe" /Silent /Codebase /unregister' (with hidden window)
  • '%ProgramFiles(x86)%\sap\sapsetup\setup\sapstart.exe' /refresh' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c xcopy "%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\SAP Front End\SAP Logon.lnk" "C:\Users\Public\Desktop" /y' (with hidden window)
Executes the following
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' "%ProgramFiles(x86)%\SAP\NWBC50\NwbcThemes.dll" /Silent /Codebase /unregister
  • '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' "%ProgramFiles(x86)%\SAP\NWBC50\NwbcDesktopAgent.exe" /Silent /Codebase /unregister
  • '<SYSTEM32>\cmd.exe' /c xcopy "%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\SAP Front End\SAP Logon.lnk" "C:\Users\Public\Desktop" /y
  • '<SYSTEM32>\xcopy.exe' "%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\SAP Front End\SAP Logon.lnk" "C:\Users\Public\Desktop" /y

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android